ComplyAI

Do you have a process for handling data subject access requests (DSARs) within 30 days?

Is your privacy policy updated to reflect all data processing activities?

Do you have a documented lawful basis for every category of personal data processing?

Are access rights reviewed and recertified at least quarterly?

Do you maintain audit logs for all production system access?

Is multi-factor authentication enforced for all privileged accounts?

Have all employees with PHI access completed HIPAA training in the last 12 months?

Do you have a Business Associate Agreement with every vendor that handles PHI?

Is PHI encrypted both in transit and at rest?

Do you have a documented incident response plan?

Are security patches applied to production systems within 72 hours of release?

Do you conduct annual penetration testing?

Compliance Checklist