Practices with active BAAs
62%Across the practices we've audited, fewer than two-thirds had BAAs with every active vendor. The most-missed: email and scheduling.
Source · Higglo HIPAA reviews, n=14Free tool · for ABA & behavioral health
Score your HIPAA posture in under ten minutes.
A 25-item self-audit across the six domains the OCR actually reviews - data storage, BAAs, staff training, incident response, devices, and patient rights. You get a score, a per-domain gap list, and a printable action plan.
The audit
Six domains. Twenty-five honest questions.
Built from the questions OCR auditors actually ask, mapped to the requirements that practices most often miss. Tick what's true, leave the rest blank - the gap report is the value.
Six compliance domains0 / 23
Progress0% · High risk
Data storage & access
Where PHI lives and who can touch it.
Business Associate Agreements
Every vendor handling PHI has a signed BAA on file.
Staff training
Onboarding and annual refresh, documented.
Incident response
When something goes wrong, you have a plan.
Device & network security
Endpoints, networks, and remote work hygiene.
Patient rights
What patients are owed under HIPAA.
What auditors actually look at
Four patterns we see almost every time.
R.01
BAAs are the fastest way to fail an audit.
Every vendor that touches PHI - EHR, billing, scheduling, even your email host - needs a signed BAA on file. Most practices are missing two or three.
R.02
Training without documentation doesn't count.
If you can't produce a signed acknowledgment from each staff member, the OCR will treat training as not done. Use a checklist tracker, not memory.
R.03
Personal cloud storage is the silent breach.
Personal Google Drive, Dropbox, or iCloud holding any PHI - even one document - is a violation. Audit shared drives twice a year.
R.04
The 60-day rule is non-negotiable.
Notification windows for breaches are calendar days, not business days. A documented response procedure removes the panic and the missed deadline.
Benchmarks · ABA category
Where most practices actually sit.
Documented annual refresh
48%Less than half of ABA practices document annual HIPAA refresh training in a way that would survive an OCR spot-check.
Source · 2025 cohort review30-day record access
91%Strong area - practices respond to record requests on time, but few practices document the response itself, which is the actual requirement.
Source · Higglo client cohortKeep going
Related tools.
Pressure-test the score
Bring your gap report to a 20-minute call.
The checklist tells you where the gaps are. We'll tell you which gap to close first based on actual OCR enforcement priorities - and which ones can wait without raising your audit risk.