Engineer Self-Test

Two-minute, no-backend checklist. Answers stay in your browser. Share results with a link.

Profile: Clinic

Pick a profile

Profiles only change labels. Scoring rules stay sensible across all three.

Your org

Questions

MFA is enforced for admin roles in your EHR/critical systems. SSO is enabled for staff (IdP like Okta/Entra); local passwords disabled where possible. Quarterly access reviews are performed and documented. Audit logs retention ≥ 12 months and exportable to SIEM on request.

BAAs are signed for EHR, billing, backups, and any PHI-touching vendor. Disaster recovery last restore test succeeded within 6 months, with evidence. TLS in transit enforced between internal systems where PHI flows. Breach runbook exists with comms template; staff know where it lives.

Engineer Self-Test

Pick a profile

Your org

Questions

Results