Can this plan include PHI?

Yes. Include PHI only when necessary, minimize exposed fields, and ensure storage and transmission comply with HIPAA and any BAAs in place.

Is an electronic signature valid?

Electronic signatures are legally enforceable under ESIGN and UETA when intent, consent, attribution, and record retention are met.

Do I need a BAA for vendors?

Yes. If a vendor accesses or stores PHI related to the assessment, execute a Business Associate Agreement before sharing data.

How long should I retain the plan?

Retain for the active term plus applicable periods: HIPAA requires six years from creation or last effective date; follow longer state rules where applicable.

Can I notarize or use RON?

Notarization is rarely required for internal assessments; remote online notarization may be available depending on state law and document purpose.

What if remediation cannot be completed on time?

Document compensating controls, update the risk rating, notify stakeholders, and schedule regular progress verification until full remediation is achieved.

Electronic Signature
Templates
Healthcare
Healthcare Security Assessment Plan

Healthcare Security Assessment Plan

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

HEALTHCARE SECURITY ASSESSMENT PLAN

Administration

Organization Name:

Facility / Department Address

Assessment Reference ID: Assessment Date:

Assessor Information

Assessor Name Title / Role Contact Information

Scope & Objectives

Scope (systems, locations, and business processes covered):

Objectives (high-level goals of this assessment including regulatory drivers):

Data & Systems Inventory

Presence of Protected Health Information (PHI) or other sensitive data: PHI PII Financial Data

Systems in Scope

Methodology & Standards

Methodology (assessment techniques to be employed, e.g. interviews, configuration review, vulnerability scanning):

Applicable frameworks and standards (list the compliance frameworks and internal policies that guide this assessment):

Findings & Risk Assessment

Summary of key vulnerabilities and nonconformities:

Risk rating approach: Each finding shall be rated for likelihood and impact and assigned a risk level (Low, Medium, High, Critical). Risk level assigned to primary findings:

Primary Risk Ratings

Recommended Controls & Remediation Plan

Recommendations shall address administrative, physical, and technical safeguards. For each finding provide recommended action, priority, owner, estimated effort, and target completion date.

Implementation Resource Estimate

Timeline & Review

Target remediation milestones and review cadence:

Authorization Expiration Date

Legal & Administrative Provisions

Confidentiality: Assessment documentation and findings are proprietary to the organization and, where applicable, contain Protected Health Information. All recipients shall maintain confidentiality consistent with applicable law and organizational policy. Distribution is limited to personnel with a documented need to know.

Accuracy Certification: The assessor certifies that the information contained in this plan reflects a good faith, professional evaluation based on the methodology described. Findings are accurate as of the Assessment Date and are subject to change as systems or configurations change.

Residual Risk Acceptance: Approval of this plan, or of specific remediation deferrals, constitutes formal acceptance of any residual risks identified and assigns responsibility for ongoing monitoring to the approver or delegate identified in the remediation plan.

Records Retention: Assessment records, attachments, and evidence of remediation shall be retained in accordance with organizational retention policy and applicable legal requirements.

Amendment: This plan may be amended by mutual written agreement of the assessor and the approving executive; amendments must be appended and dated.

Attachments & Evidence

Attachments included with this plan (network diagrams, scan reports, interview notes, policy excerpts):

Acknowledgment

By signing below, the parties acknowledge receipt of this Healthcare Security Assessment Plan, confirm the scope and findings as stated, and accept the responsibilities assigned herein. The approver confirms authority to approve remediation timelines and residual risk acceptance on behalf of the organization.

Prepared By (Assessor):

By:

Date:

Approved By (Executive):

By:

Date:

What the Healthcare Security Assessment Plan Is

A Healthcare Security Assessment Plan is a structured document that records the scope, findings, and remediation steps for evaluating information security in healthcare settings. It documents system and data inventories, threat and vulnerability analysis, prioritized risk ratings, recommended mitigations, and an implementation timeline. The plan supports compliance with HIPAA privacy and security requirements, documents due diligence for audits, and provides a repeatable format for periodic reassessments and executive reporting across clinical, administrative, and vendor-managed systems.

Why a Formal Plan Matters for Healthcare Security

A formal plan creates an auditable trail of risk decisions, shows HIPAA-focused due diligence, and aligns technical remediation with organizational priorities to reduce exposure and regulatory risk.

Who Typically Prepares and Reviews This Plan

Teams across IT, compliance, and clinical operations commonly prepare and use the plan to coordinate security work.

IT security teams responsible for vulnerability scanning, patching, and network segmentation, ensuring technical controls are documented and scheduled for remediation.
Compliance officers and privacy leads who map findings to HIPAA safeguards and confirm that administrative controls and policies are updated.
Clinical or operations managers who validate scope, confirm continuity plans, and approve schedule and resource allocations for remediation activities.

The plan should be distributed to stakeholders for approval, retained for audits, and revisited after major system changes or incidents.

Essential Data Elements to Include

Patient Identifiers: Names, MRNs, DOBs, limited to required scope

System Inventory: Hosts, applications, versions, network segments

Vulnerability Findings: CVE IDs, severity, exploitability

Risk Ratings: Likelihood and impact scores

Remediation Tasks: Owner, due date, status

Assessor Details: Name, firm, signature, assessment date

Step-by-Step: Completing the Assessment Plan

Follow a linear workflow from scoping to reporting to ensure consistent, auditable results for compliance and operations.

01

Define scope: List systems, PHI flows, and third parties in scope
02

Collect data: Gather inventories, logs, configs, and prior findings
03

Assess risk: Map vulnerabilities to likelihood and impact ratings
04

Produce plan: Document remediation, owners, timelines, and verification

How to Configure an Online Assessment Workflow

Define field-level rules and routing to automate reviewer assignments and capture required attestations.

Field	Configuration
Effective Date Field	Required, MM/DD/YYYY, auto-fill today's date option
Risk Rating Field	Dropdown with numeric scale, conditional comments required
Owner Assignment	Auto-assign to role-based groups via directory
Signature Requirement	Require signer authentication and timestamp

Where to Send and File Completed Plans

Establish a single canonical repository and distribution list for signed plans to maintain version control and auditability.

Internal Archive: Store final signed plan in secure records repository with access controls
Compliance Team: Send certified copy to privacy/compliance mailbox for review
IT Ticketing: Create remediation tickets and attach plan for traceability
Third-Party Vendors: Share scoped excerpts under BAA or data processing agreement

Technical Requirements for Digital Completion and Sharing

Confirm platform capabilities for encryption, audit trails, and access controls before eSubmitting sensitive healthcare records.

File formats: PDF, DOCX supported for signed, archived files
Authentication: Email OTP, SSO, or stronger MFA for signer identity
Integrations: CRM, EHR, and cloud storage connectors available

Use platforms that support AES-256 at rest and TLS 1.2/1.3 in transit, plus a Business Associate Agreement (BAA) when handling PHI.

Typical Timelines and Regulatory Deadlines

Establish dates for initial assessment, remediation milestones, and regulatory notifications to meet compliance and operational expectations.

Initial Assessment Completion:

Complete baseline assessment within 30–60 days of project start

Remediation Plan Delivery:

Provide prioritized remediation plan within 30 days after assessment

Remediation Completion Target:

Complete high-risk items within 90 days unless extended

Breach Notification Deadline:

HIPAA breach notifications typically issued within 60 days where applicable

Periodic Reassessment:

Schedule follow-up assessment annually or after major changes

Common Mistakes to Avoid

Failing to scope third-party systems leads to incomplete findings and unaddressed exposures during audits or incidents.
Using inconsistent risk scoring prevents meaningful prioritization and can delay remediation of critical vulnerabilities.
Omitting evidence links and logs undermines the forensic trail and weakens audit responses and incident investigations.
Not obtaining required BAAs before sharing assessment data with vendors can create HIPAA compliance liabilities.

Key Risks and Potential Consequences

Regulatory Fines: Civil monetary penalties possible

Corrective Action: Mandated remediation and monitoring

Patient Harm: PHI exposure increases liability

Reputational Loss: Public disclosure damages trust

Operational Disruption: System downtime and recovery costs

Legal Exposure: Potential civil litigation risk

Core Components of a Professional Assessment Plan

A complete plan combines technical detail, prioritized risk treatment, and governance artifacts so executive and technical audiences can act.

Scope

Defines systems, data types (PHI), locations, and third parties included or excluded from assessment and remediation.

Inventory

Comprehensive asset list with owners, versions, interfaces, and PHI processing details for accurate coverage mapping and control testing.

Threat Analysis

Document credible threat scenarios, threat actor capabilities, and the most likely attack vectors for prioritized defense planning.

Vulnerability Findings

Record discovered vulnerabilities with references (CVE), evidence, and reproducible steps for verification by remediation teams.

Remediation Plan

Prioritized tasks with owners, deadlines, verification methods, and fallback mitigations for items that cannot be fixed immediately.

Executive Summary

High-level risk overview, compliance implications, resource needs, and recommended governance actions for leadership review.

Practical Tips for Accurate and Efficient Completion

Apply consistent processes and automation to reduce errors, speed completion, and maintain an audit-ready record.

Standardize scoring and templates

Use a common risk matrix and a template for findings so teams produce comparable results; automation reduces manual entry errors.

Attach evidence to findings

Include screenshots, log extracts, and ticket IDs with each finding to speed verification and demonstrate due diligence to auditors.

Use role-based assignments

Assign remediation tasks to named roles and groups rather than individuals to ensure continuity when personnel change.

Schedule follow-up validation

Validate remediation through retesting and document verification procedures to close items formally in the plan.

Real-World Examples of Assessment Use

These short examples show how organizations used assessment plans to improve security posture and maintain compliance.

Fertility Centers of Illinois

The team needed a repeatable compliance format for patient data

Clinical and IT stakeholders aligned on remediation priorities
The organization used structured plans to centralize evidence, satisfy audits, and coordinate vendor BAAs while maintaining patient care continuity.

Martin Properties

A distributed operations environment required consistent assessments across sites

Central IT enforced a standard remediation SLA
Using a common plan format, the company reduced remediation variance, tracked closures, and demonstrated compliance to stakeholders.

Who Typically Signs the Plan

Chief Information Security Officer

The CISO or equivalent signs to acknowledge acceptance of residual risk and to authorize resource allocations, providing executive-level responsibility for the plan.

Privacy or Compliance Officer

The compliance or privacy lead signs to confirm HIPAA alignment, BAA status with vendors, and that required disclosures have been documented and retained.

eSignature Pricing and Feature Comparison for This Use Case

This table summarizes entry pricing and a few capability points to consider when choosing an eSignature provider for healthcare assessment plans.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial, no credit card required	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Varies by plan	Varies by plan	Varies by plan	Varies by plan
Envelope Cap	No cap	100 envelopes/user/year	Varies by plan	Varies by plan	Varies by plan

FAQs and Troubleshooting for the Assessment Plan

Answers to common questions about execution, signing, retention, and compliance when using a Healthcare Security Assessment Plan.

Need help? Contact support

Can this plan include PHI?
Yes. Include PHI only when necessary, minimize exposed fields, and ensure storage and transmission comply with HIPAA and any BAAs in place.
Is an electronic signature valid?
Electronic signatures are legally enforceable under ESIGN and UETA when intent, consent, attribution, and record retention are met.
Do I need a BAA for vendors?
Yes. If a vendor accesses or stores PHI related to the assessment, execute a Business Associate Agreement before sharing data.
How long should I retain the plan?
Retain for the active term plus applicable periods: HIPAA requires six years from creation or last effective date; follow longer state rules where applicable.
Can I notarize or use RON?
Notarization is rarely required for internal assessments; remote online notarization may be available depending on state law and document purpose.
What if remediation cannot be completed on time?
Document compensating controls, update the risk rating, notify stakeholders, and schedule regular progress verification until full remediation is achieved.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now