Practices with active BAAs
62%Across the practices we've audited, fewer than two-thirds had BAAs with every active vendor. The most-missed: email and scheduling.
Source · Higglo HIPAA reviews, n=14A 25-item self-audit across the six domains the OCR actually reviews — data storage, BAAs, staff training, incident response, devices, and patient rights. You get a score, a per-domain gap list, and a printable action plan.
Built from the questions OCR auditors actually ask, mapped to the requirements that practices most often miss. Tick what's true, leave the rest blank — the gap report is the value.
Where PHI lives and who can touch it.
Every vendor handling PHI has a signed BAA on file.
Onboarding and annual refresh, documented.
When something goes wrong, you have a plan.
Endpoints, networks, and remote work hygiene.
What patients are owed under HIPAA.
Every vendor that touches PHI — EHR, billing, scheduling, even your email host — needs a signed BAA on file. Most practices are missing two or three.
If you can't produce a signed acknowledgment from each staff member, the OCR will treat training as not done. Use a checklist tracker, not memory.
Personal Google Drive, Dropbox, or iCloud holding any PHI — even one document — is a violation. Audit shared drives twice a year.
Notification windows for breaches are calendar days, not business days. A documented response procedure removes the panic and the missed deadline.
Across the practices we've audited, fewer than two-thirds had BAAs with every active vendor. The most-missed: email and scheduling.
Source · Higglo HIPAA reviews, n=14Less than half of ABA practices document annual HIPAA refresh training in a way that would survive an OCR spot-check.
Source · 2025 cohort reviewStrong area — practices respond to record requests on time, but few practices document the response itself, which is the actual requirement.
Source · Higglo client cohortThe checklist tells you where the gaps are. We'll tell you which gap to close first based on actual OCR enforcement priorities — and which ones can wait without raising your audit risk.