YouAttest GRC Survey for HIPAA YouAttest is a certified identity re-certification tool that automates identity governance. This survey will help determine if your security and governance would improve with YouAttest. Does your enterprise have a system to automate detections of identity risk - such as over premission accounts? HIPAA Standard 164.308(a)(1)Security Management Process: Implement policies and procedures to prevent, detect, contain, and correct security violations. This includes risk analysis, risk management, sanction policy, and information system activity review. Please select your answer Yes No Is there an assigned resource to implement the policies of risk assessment? HIPAA Standard 164.308(a)(2)Assigned Security Responsibility: Identify the security official who is responsible for the development and implementation of the policies and procedures required by this subpart for the entity. Please select your answer Yes No Does your organization have a policies and practices around allocating appropriate acces to ePHI. HIPAA Standard 164.308(a)(3)Workforce Security: Implement policies and procedures to ensure that all members of its workforce have appropriate access to ePHI, and to prevent those workforce members who do not have access from obtaining access to ePHI. This includes authorization/supervision, workforce clearance, and termination procedures. Please select your answer Yes No Does you organization have quantified access request/appoval for ePHI resources? HIPAA Standard 164.308(a)(4)YouAttest enables managers to run scheduled campaigns to certify, delegate, or revoke access to sensitive resources (e.g., ePHI databases). AI-driven scoring flags high-risk accounts for prioritized review. Please select your answer Yes No Security Incident Procedures: Implement policies and procedures to address security incidents, including response and reporting. HIPAA Standard 164.308(a)(6)YouAttest uses identity triggers to notify managers of changes in entitlements, allowing quick incident response (e.g., attestation or revocation). Audit logs provide evidence for reporting. Please select your answer Yes No Does your enterprise have automated methods to review access in disaster recovery/ emergency mode operations? HIPAA Standard 164.308(a)(7)Contingency Plan: Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence that damages systems containing ePHI. This includes data backup, disaster recovery, emergency mode operation, testing/revision, and applications/data criticality analysis. Please select your answer Yes No Does your enterprise does period evaluations of key resources for security controls around the ePHI resources - including who has access? HIPAA Standard 164.308(a)(8)Evaluation: Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of ePHI, that establishes the extent to which an entity's security policies and procedures meet the requirements of this subpart. Please select your answer Yes No Does your enterprise have the ability to review access by by group/role to physical access to ePHI resource? HIPAA Standard 164.310(a)Facility Access Controls: Implement policies and procedures to limit physical access to its electronic information systems and the facility or facilities in which they are housed, while ensuring that properly authorized access is allowed. This includes contingency operations, facility security plan, access control/validation, and maintenance records. Please select your answer Yes No Does your organization ensure that individual access is granted to users of ePHI for both allocation, review and revocation. HIPAA Standard 164.312(a)Access Control: Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software programs that have been granted access rights. This includes unique user identification, emergency access procedure, automatic logoff, and encryption/decryption. Please select your answer Yes No Does your organization have an establish and repeated method to accertain access to ePHI and create the reprorts for compliance and security? HIPAA Standard 164.312(b)YouAttest generates audit trails of access reviews, providing documentation for compliance. Please select your answer Yes No 1 out of 10 Thank you for completing the HIPAA Assessment! Your responses have been successfully recorded, and your personalized results are now available. Below, you’ll find your overall score along with a detailed breakdown of key controls that may require attention. Use these insights to strengthen and refine your security posture. Important: Please fill out the contact form below, to retrieve your full results and in-depth analysis. Name Email Business Phone GRC Partner Email (optional) Time's up
