12 questions, 3 minutes — a 0–100 score of your network + UC HIPAA posture and a ranked list of the gaps most likely to show up in your next risk analysis.
The HIPAA Security Rule has 18 standards and 36 implementation specifications. A paper-HIPAA posture has all of them written down; a real-HIPAA posture has them working when you look at the wire. This quiz scores the 12 vectors that a real risk analysis looks at first — the ones where the gap between policy and practice tends to be widest. Each answer maps to a specific HIPAA §164.312 or §164.308 requirement, and the weight reflects how badly that gap typically bites during a breach or an audit. You get a 0–100 score, the three gaps that matter most, and a report you can email yourself and hand to the compliance officer.
Answer the 12 questions, click Score HIPAA readiness.
Your posture is defensible in a risk analysis. Maintain MFA, patch cadence, and restore-test discipline.
Two to four gaps would show up in a real audit. Address in the next 6 months before a BAA partner or insurer asks.
One or more breach-material gaps are live. A single ePHI exposure here turns into an OCR investigation fast.
Most HIPAA programs focus on applications and databases — the EHR, the billing system, the scheduling platform. Those are where ePHI is obviously stored, so compliance attention lands there first. The network and UC plane gets less attention because ePHI is in transit rather than at rest, and transit feels ephemeral. It isn't. A voicemail left by a patient with their diagnosis is ePHI at rest on the Unity Connection server. A call between two clinicians about a patient is ePHI in transit over RTP. A Webex meeting with a screen-shared chart is ePHI that traverses Expressway-E into the Webex cloud. Every one of those paths is in scope for the Security Rule.
The heaviest-weighted dimensions in this quiz are SIP/SCCP signaling encryption and SRTP media encryption (12 points each). That's because unencrypted voice on a flat network is the single most common finding we see during a technical review at a healthcare client. The fix is well-documented and not technically hard — enable a CUCM CallManager trust certificate authority, generate phone CAPF certificates, and switch phone security profiles to encrypted — but it rarely gets prioritized because calls work fine without it. An OCR finding changes that calculus.
Voice VLAN segmentation is the next most-overlooked. A flat VLAN shared between voice and data means a compromised workstation has direct L2 access to every phone, every CUCM administration page, and every Unity voicemail subscriber mailbox. The Security Rule's "network activity" and "workforce access" controls (§164.308(a)(3) and (a)(4)) don't mandate segmentation explicitly, but segmentation is the practical implementation of minimum-necessary access for the voice plane.
Audit log retention is the quiet killer. HIPAA requires 6 years of audit records from creation. Most CUCM deployments keep RTMT call records for a rolling window (90 days to 1 year). Syslog to a central SIEM with 6-year retention is standard in healthcare but far from universal. A breach investigation that can't produce 6-year call-detail history for the affected patients is a finding independent of the breach itself.
BAA coverage is the paperwork dimension that looks simple on a compliance matrix and collapses in practice. Your Cisco partner needs a BAA if they have admin access to your CUCM. Your Webex Calling provider needs a BAA. Your call-recording SaaS needs a BAA. Your managed-SIP trunk carrier may fall under the Conduit Exception, but the interpretation is conservative and most healthcare privacy officers insist on a BAA regardless. A BAA-gap audit often produces 3–5 findings at any mid-market healthcare org; the fix is administrative (email procurement) but takes longer than technical fixes because contract cycles are long.
Rerun the score every 6 months and after any major change — CUCM upgrade, new managed-service vendor, Webex Calling go-live. HIPAA posture is a point-in-time assessment that decays.
No. This covers the 12 network/UC vectors where gaps between policy and practice are widest. A full audit needs a compliance partner and a written Risk Analysis.
Covered Entities and Business Associates — hospitals, clinics, dental, behavioral-health, ancillary vendors.
Encryption is "addressable" — you can choose not to encrypt, but you must document why and deploy an equivalent safeguard. Modern interpretations treat unencrypted ePHI in transit as a finding.
If they handle ePHI, yes. Pure transport-only carriers may fall under the Conduit Exception, but managed-service and call-recording vendors always need a BAA.
The score is computed in your browser. We only receive your data if you click "Email me this report".
CUCM 14 encrypted, segmented VLANs, MFA on admin, 6-year syslog, full BAAs, tested DRS.
CUCM 12.5 supported, SIP TLS partial, voicemail on Unity not encrypted, BAAs partial, RTMT email alerts only.
CUCM 11.5 past LDoS, flat VLAN, shared admin creds, no BAAs tracked, no IRP.
The Network & UC Health Assessment includes a HIPAA-technical-safeguards gap analysis against your actual CUCM, Unity, Expressway, and perimeter configs. We verify every answer you just gave and add 30 more, then return a prioritized remediation plan.