The Compliance Score is a single, auditable number that summarises how close your program is to defensible. It is not a vanity metric. Every point is tied to an evidence file, an owner, and a date — so when the number goes up or down, the reason is one click away.
What it does
- Produces a score across every §164 standard, weighted by implementation specification type (required vs addressable) and evidence freshness.
- Shows the delta since last review, with the controls responsible for the change named.
- Publishes the methodology, so an outside reviewer can reproduce the number from the inputs.
- Feeds the Executive Summary Report so board updates stay consistent with the operating record.
How it maps to HIPAA
A quantified posture number aligns with §164.308(a)(8) (periodic evaluation) and feeds §164.308(a)(1)(ii)(B) (risk management) by making the “what moved” question answerable. It is not a certification — HHS runs none — but it is the measure a Security Officer uses between formal reviews.
Where it fits
The score lives in the Compliance Management module and feeds the Compliance Dashboard. The full artefact buyers and insurers accept is the HIPAA Readiness Report.