Use this checklist to verify your organization's compliance with the technical safeguard requirements under 45 CFR §164.312 and the 2026 NPRM updates. Mark each item as implemented (✓), in progress, or not started.
Access Control (§164.312(a))
- Unique user identification assigned to every workforce member
- Emergency access procedures documented and tested
- Automatic logoff after defined period of inactivity (≤15 minutes recommended)
- Encryption and decryption of ePHI at rest (required under 2026 NPRM)
- Multi-factor authentication enabled for all ePHI system access (required 2026)
- Role-based access controls in place; principle of least privilege enforced
- Access provisioning and deprovisioning procedures documented and followed
Audit Controls (§164.312(b))
- Audit logging enabled on all systems that access, store, or transmit ePHI
- Audit log retention policy documented (minimum 6 years)
- Audit logs protected from unauthorized modification or deletion
- Regular review of audit logs for anomalous activity
- Audit logging coverage includes login events, access failures, data exports
Integrity (§164.312(c))
- Data integrity mechanisms in place (checksums, digital signatures, or equivalent)
- Integrity verification procedures documented for ePHI in transit and at rest
- Process for detecting and responding to unauthorized ePHI alteration or destruction
Transmission Security (§164.312(e))
- TLS 1.2 or higher enforced for all ePHI transmissions
- End-to-end encryption for ePHI transmitted over open networks
- Encryption key management procedures documented
2026 NPRM Additions
- Vulnerability scanning program operational (at least every 6 months)
- Critical vulnerabilities (CVSS ≥9.0) remediated within 15 days
- Technology asset inventory maintained and reviewed annually
- Patch management policy documented with defined SLAs
- Iron Fort monitors all 23 of these controls continuously and alerts you when any fail. Book a free gap assessment at goironfort.com/demo