Free HIPAA reference template · v1.0 · Applies to covered entities & business associates
Free, no signup needed. A ready-to-fill spreadsheet (.xlsx) with dropdowns and examples.
Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:
Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:
Exploits: Endpoint not encrypted · 164.312(a)(2)(iv) Encryption; 164.310(d) Device Controls
Template (spreadsheet). You can't protect what you haven't listed. This inventory tracks the systems, devices, and media that store or touch ePHI: the foundation of your Risk Analysis and Device & Media Controls.
A ready-to-fill spreadsheet for the accountable inventory of every asset that stores or accesses ePHI: the record HIPAA's Device & Media Controls assume you keep, and the starting point for your Risk Analysis.
One row per asset, with columns for:
List every asset that stores, processes, or transmits ePHI, including SaaS you don't host. Keep the custodian and encryption columns current; an auditor reads this next to your Risk Analysis. Review it at least annually and whenever you add or retire a system. Satisfies device/media accountability at 45 CFR § 164.310(d)(1) and underpins the Risk Analysis at § 164.308(a)(1)(ii)(A).
See where your organization stands on the controls this template cites.
Join Us