Scope & data mapping
Map where protected health information lives, flows, and is shared. You can’t protect — or scope — what you haven’t inventoried, so this is the foundation everything else builds on.
Key activities
- Confirm whether you’re a covered entity or business associate
- Inventory every system that touches PHI / ePHI
- Map data flows to vendors and subcontractors
- Identify the BAAs you need in place
Deliverable






















