Planning documentation and templates drawn from our accreditation, risk management, and integration engagements. Download them, adapt them to your environment, and put them to work.
Free to download, no sign-up required. Every file opens as a plain document you can edit, brand, and route for approval internally.
A complete framework for drafting your Business Continuity & Disaster Recovery plan — from governance and business impact analysis through recovery, emergency operations, and testing.
A companion checklist to verify every element of your plan is documented, current, and testable — useful ahead of mock surveys, audits, or diligence requests.
A scoring template that rates the probability, risk, and preparedness of natural, human, utility, and technology events at each location, so planning attention follows the highest totals.
A structured assessment template to identify threats and vulnerabilities to ePHI, rate risk, and document the safeguards that bring each risk to an acceptable level.
A verification checklist covering access control, monitoring, encryption, device and network safeguards, vendor management, and documentation governance.
A readiness checklist for adopting AI in radiology operations — covering sponsorship, use case prioritization, data readiness, integration, privacy, clinical validation, vendor review, and value measurement.
Each template maps to the HIPAA Security Rule contingency plan requirements (45 CFR 164.308(a)(7)) and applicable Joint Commission standards.
Purpose statement, coverage across facilities, systems, and staff, plus objectives tied to patient care and ePHI protection.
Plan owner, executive sponsor, IT/security, clinical, communications, and privacy roles with a defined review cycle.
Critical functions with RTO, RPO, disruption impact, and dependencies — PACS, RIS, teleradiology workflow, dictation, and billing.
Threats rated by likelihood and impact with existing controls and mitigation plans for ransomware, outages, vendor failure, and more.
Backup and replication approach, alternate operating sites, failover configuration, vendor contingencies, and downtime procedures.
Downtime clinical workflow, contact rosters, escalation paths, and regulatory notification steps including OCR and CMS.
Seven-step response procedure plus a schedule for tabletop exercises, restoration tests, and staff training.
The HVA rates each potential event on probability, risk, and preparedness, then ranks the totals so emergency planning resources follow the events that matter most at each location.
Probability, risk, and preparedness ratings multiplied for each event, with totals ranked in descending order to show where planning focus is needed.
Headquarters, primary and secondary datacenters, the radiologist home office footprint, and enterprise-wide systems and services.
Historical data and vendor statistics for probability; life, service, financial, and legal exposure for risk; plans, training, insurance, and back-up systems for preparedness.
Reference lists covering natural events, human events, utility failures, and technology events, with room to add organization-specific scenarios.
A worksheet per location so each event is scored against that site's exposure, with a total and rank for every entry.
Totals ranked in descending order per event table, with a threshold value below which no action is necessary that the organization defines and formally accepts.
Every location captures an analysis of its top events, a review of how structure or redundancy limits impact, and the preventative actions to take.
A dedicated enterprise section for email interruption, malware, data center breach and outage, DDoS, and PACS database failure events.
The assessment documents the risk analysis and risk management steps the HIPAA Security Rule requires (45 CFR 164.308(a)(1)(ii)(A) and (B)), with the six-year retention record required by 45 CFR 164.316.
Systems, locations, and ePHI flows in scope, the assessment method used, participants, and any excluded areas.
Systems, devices, facilities, and services that hold or touch ePHI, each recorded with its location and owner.
Natural, human, and environmental threats with likelihood ratings — ransomware, credential compromise, outages, device loss, and vendor failure.
Weaknesses found through audits, scans, and observation, mapped to the affected assets and existing controls.
A consistent scale so every finding is rated the same way, from low to high likelihood and impact.
Each threat and vulnerability combined into a risk level with an assigned remediation priority.
Administrative, physical, and technical safeguards with the owner, target date, and status for each action.
Highest-priority risks, accepted risks with justification, officer sign-off, and the retention and review dates.
Each verification category maps to the HIPAA Security Rule safeguard standards (45 CFR 164.308 through 164.316) so findings can be traced to evidence during an audit or survey.
Unique user IDs, role-based least privilege, multi-factor authentication, access reviews, offboarding, emergency access, and automatic logoff.
Logging of access, modification, and deletion events, log review cadence, retention, and alerting for anomalous activity.
Encryption at rest and in transit, key management, secure disposal and media sanitization, and encrypted, tested backups.
Device encryption, endpoint protection, patching, firewall rules, remote access, and segmentation of clinical, imaging, and administrative traffic.
Business Associate Agreements, subprocessor review, vendor security questionnaires, and prompt revocation of unused access.
Annual policy review, workforce training and tracking, sanction policy, incident response testing, and breach notification procedures.
A current risk analysis, a tracked remediation plan, designated Security and Privacy Officers, and six-year documentation retention.
Ten readiness categories take an AI initiative from sponsorship through scale, with validation and monitoring checkpoints that keep adoption aligned with HIPAA obligations and accreditation standards.
A named executive sponsor, the problem stated in writing, agreed success measures, and a roadmap aligned with growth or exit strategy.
Triage, QA, documentation, coding, billing, and scheduling use cases ranked by clinical impact, workflow effort, and time to value.
Source systems, ownership, quality, and retention rules confirmed — with data flows mapped so PHI never leaves approved boundaries.
PACS, RIS, dictation, EHR, and reporting dependencies assessed, with HL7, FHIR, or API integration and downtime behavior defined.
PHI handling, access controls, audit logging, and encryption verified, and AI-assisted records checked against accreditation standards.
Validation thresholds, performance on your own patient mix, radiologist override paths, drift monitoring, and scheduled re-validation.
Business Associate Agreements, model transparency, training-data use, uptime commitments, pricing tested against volume, and exit terms.
Staff trained on new workflows with a feedback channel, plus baselines for turnaround time, quality, and revenue tracked against the original goals.
Templates get you started. We can complete the business impact analysis, align the plan to your accreditation obligations, and run the exercises that prove it works.
Schedule a Consultation