Contains a list of safeguards that must be taken - everything on the list must be addressed and documented (how was it addressed?). This list is not implementation-specific: it tells you what you must accomplish, but how (which technologies you use, etc.) is not proscribed, either by this document or by the law itself.

This list is not comprehensive, it’s intended to cover only the engineering and information technology aspects of the law. This checklist is intended as a precursor to prepare for a proper audit.

In no way is this document to be construed as legal advice or as a substitute for the actual text of HIPAA regulations.