HIPAA AI Readiness Assessment

Section 1: Identity & Access Management

Foundation security controls that must be in place before any AI deployment.

• 1. MFA enforced for all users — Multi-factor authentication required for every account
• 2. Conditional Access policies configured — Access restricted by location, device compliance, and risk level
• 3. Admin accounts secured — Separate admin accounts with privileged access workstations
• 4. Session timeout policies — Automatic logout after inactivity
• 5. Password/passkey policies — Strong password requirements or passwordless authentication

Section 2: Data Protection

Controls that prevent PHI from leaving your secured environment.

• 6. DLP policies for HIPAA/PHI — Data Loss Prevention rules detecting and blocking PHI exfiltration
• 7. Sensitivity labels deployed — Documents classified with PHI labels
• 8. Public AI sites blocked — ChatGPT, Claude, Gemini blocked via DLP/web filtering
• 9. Encryption at rest — All stored data encrypted (AES-256 or equivalent)
• 10. Encryption in transit — TLS 1.2+ enforced for all data transmission

Section 3: Threat Protection

Active defenses against cyber threats.

• 11. Email protection — Anti-phishing, anti-malware, safe links, safe attachments
• 12. Endpoint protection — Managed antivirus/EDR on all devices
• 13. Mobile device management — Intune or equivalent MDM
• 14. Security awareness training — Regular training for all staff
• 15. Incident response plan — Documented breach notification procedures

Section 4: Compliance & Governance

Documentation required for HIPAA compliance.

• 16. Microsoft BAA in place — Business Associate Agreement signed
• 17. Risk assessment completed — Annual HIPAA security risk assessment
• 18. AI usage policies documented — Written policies on acceptable AI use
• 19. Audit logging enabled — Comprehensive audit trails for PHI access
• 20. Staff training documented — HIPAA training records maintained

Section 5: AI Infrastructure Readiness

Technical requirements for compliant clinical AI.

• 21. Azure subscription available — Access to Azure for private AI deployment
• 22. Azure OpenAI access approved — Application submitted/approved for GPT-4o
• 23. Private network capability — Understanding of private endpoints and VNet
• 24. EHR integration requirements defined — FHIR, HL7, API needs documented
• 25. Monitoring/SIEM plan — Plan for monitoring AI usage and compliance

Score Your Readiness