HIPAARemediation PlanningDemo

Classify each failing implementation specification as deploy, runbook, or accepted risk. CFR citations travel with each action so auditors can trace remediation back to the Security Rule.

Demo mode. Deployments are simulated. Your tenant run applies real M365 changes and generates runbooks per control.

8 failed controls8 to auto-deployBreak-glass: b••••••••••••m

8 auto-deploy0 runbook only

Export Plan:HTMLMarkdownPDF

🔑

1 controls require licenses not detected in your tenant

These controls cannot be remediated until the required licenses are assigned. They are excluded from the remediation selection below.

Control	Domain	Severity	Detail
Information system activity review — regular audit-log review HIPAA-164.308(a)(1)(ii)(D)	Administrative	high	Non-compliant — Security Management Process implementation does not meet the Security Rule requirement.
Data backup plan — create retrievable exact copies of ePHI HIPAA-164.308(a)(7)(ii)(A)	Administrative	high	Non-compliant — Contingency Plan implementation does not meet the Security Rule requirement.
Record & examine activity in info systems containing ePHI HIPAA-164.312(b)	Technical	high	Non-compliant — Audit Controls implementation does not meet the Security Rule requirement.
Termination procedures — deprovision access on workforce exit HIPAA-164.308(a)(3)(ii)(C)	Administrative	medium	Non-compliant — Workforce Security implementation does not meet the Security Rule requirement.
Log-in monitoring & discrepancy reporting HIPAA-164.308(a)(5)(ii)(C)	Administrative	medium	Non-compliant — Security Awareness & Training implementation does not meet the Security Rule requirement.
Automatic logoff — terminate sessions after predetermined inactivity HIPAA-164.312(a)(2)(iii)	Technical	medium	Non-compliant — Access Control implementation does not meet the Security Rule requirement.
Encryption & decryption of ePHI at rest HIPAA-164.312(a)(2)(iv)	Technical	medium	Non-compliant — Access Control implementation does not meet the Security Rule requirement.
Encryption — encrypt ePHI in transit whenever deemed appropriate HIPAA-164.312(e)(2)(ii)	Technical	medium	Non-compliant — Transmission Security implementation does not meet the Security Rule requirement.