What Is the IT Risk Questionnaire?

The IT Risk Questionnaire is a technical controls assessment that evaluates the security of your information technology environment — the systems, networks, and software that store, process, or transmit ePHI. Where the SRA covers your policies and general security posture, the IT Risk Questionnaire goes deeper into your specific technical controls.

This questionnaire is most accurately completed with the involvement of your IT staff, managed services provider (MSP), or IT consultant. If you do not have IT support, answer based on your best current knowledge and flag items for follow-up.

Accessing the Questionnaire

From your Privacy Officer dashboard, navigate to Audit in the left menu and click IT Risk Questionnaire. The questionnaire is organized by control domain and uses a consistent response format: Yes, No, Partial, or N/A — with a notes field for each item.

Key Domains Covered

Network Security

Assessment of your network perimeter and internal segmentation. Key items: Do you have a firewall? Is your clinical network segmented from guest Wi-Fi? Are remote access connections (VPN, RDP) encrypted and multi-factor authenticated? Are network logs collected and reviewed?

Access Management

How user accounts are provisioned, managed, and deprovisioned. Key items: Is access granted on a least-privilege basis? Is multi-factor authentication (MFA) enabled for all accounts with PHI access? Are former employee accounts disabled within 24 hours of termination? Are shared or generic accounts in use (a HIPAA red flag)?

Encryption

Encryption of ePHI at rest and in transit. Key items: Are all laptops and workstations encrypted (BitLocker, FileVault)? Are mobile devices that access email or EHR encrypted? Is ePHI transmitted only over encrypted connections (TLS/HTTPS)? Is backup data encrypted?

Patch Management

How quickly vulnerabilities are addressed. Key items: Are operating systems and software updated within 30 days of patch release? Is there an automated patch management tool? Are end-of-life operating systems (Windows 7, Windows Server 2008) in use?

Logging and Monitoring

Audit trail capabilities. Key items: Does your EHR or system log who accessed which records and when? Are login failures logged and monitored? Is there a process for reviewing audit logs? How long are logs retained?

Backup and Recovery

Business continuity for your data. Key items: Are backups performed at least daily? Are backups stored off-site or in the cloud? Have you tested recovery from backup in the past 12 months? How long would it take to restore operations after a ransomware attack?

Tip: If you use a cloud-based EHR, many of these controls are managed by the EHR vendor. Request a copy of their SOC 2 Type II report or HIPAA compliance documentation to confirm — and keep a copy on file. This is what your BAA with them is supposed to cover.

Important: Single-factor authentication (username + password only) for systems with PHI access is considered a high-risk gap by OCR. If you have not implemented MFA, make it a Priority 1 remediation item.

After Completing the Questionnaire

The portal generates a summary of your technical control findings. High-severity findings are automatically linked to your Gap Analysis and will appear in your remediation plan queue. Share the summary with your IT provider and work together to address critical items first.