Does finishing this make us HIPAA compliant?

No. It organizes your assessment. Compliance is a legal/regulatory determination.

Addressable means optional, right?

No. Addressable means you must implement it, implement an equivalent alternative, or document why neither is reasonable.

Can I mark a Required item n/a?

Only with a clear justification (e.g. not a clearinghouse for 164.308(a)(4)(ii)(A)). Otherwise it's scored as absent.

Where do the 47 specs come from?

45 CFR 164 Appendix A matrix + section text via eCFR (cited in references/).

Do you store our ePHI answers?

The skill runs locally. Don't put ePHI in the notes fields.

hipaa security risk assessment workbook

Example session with this skill installed

We're a 6-provider family clinic. Help me run a HIPAA Security Rule risk assessment and show the biggest gaps.

Read your context and instructions
Compiled the hipaa security risk
Generated the data export

Answer for Example Family Clinic: 25% weighted score, 19 Required specification gaps.

Status mix: implemented=6, partial=6, planned=1, absent=33 (one Required clearinghouse item correctly marked n/a).

Top of the risk register (likelihood × impact):

CRITICAL 20 — 164.308(a)(1)(ii)(A) Risk analysis only partial; 164.308(a)(1)(ii)(D) Information system activity review absent; 164.312(b) Audit controls absent

CRITICAL 15 — Incident response planned not live; DR plan never restore-tested; emergency mode plan absent; 2 of 5 BAAs outstanding; workstation use / media disposal absent

Deliverables: sra.md with a remediation section per gap, register.csv for tracking, sra.json. Template CSV covers

47 Required/Addressable specs from 45 CFR 164.308–316 (eCFR matrix text included).

Next steps: close Required gaps first; attach evidence paths in the CSV; re-score after each remediation sprint. Addressable ≠ optional — document the decision.

DISCLAIMER (printed in every report): This workbook is an organizational aid,

NOT legal advice and

NOT a certification of HIPAA compliance.

(Real run on bundled examples/sample-answers.csv.)

CSV · data export

Generated

Example file from a real run - the skill writes it into your workspace.

Connects securely to your tools. The creator never sees your data.

About this skill

A Security Rule risk assessment workbook your agent can actually score.

47 Required and Addressable implementation specifications from 45 CFR 164.308, 164.310, 164.312, 164.314 and 164.316 (eCFR matrix). Fill a CSV (implemented / partial / planned / absent / n/a), get a weighted score (Required counts double), required-gap list, likelihood×impact risk register and a remediation plan with evidence checklist.

NOT LEGAL ADVICE. Not a certification of HIPAA compliance.

What's included

SKILL.md, scripts/hipaa_sra.py, sample filled answers, references to eCFR.

How to use

Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

Reviews

No reviews yet

Be one of the first to try it. Every listed skill passes our trust checks below.

Security scanned

Passed our 8-point scan before listing

Fresh listing

Recently published to Agensi

Money-back guarantee

Doesn't do what its page promises? You get your money back.

hipaa security risk assessment workbook