FAQ & Resources
Understand what an assessment involves, see how real regulatory obligations lead to meaningful MCIC questions, and prepare an informed inquiry.
Frequently asked questions
Practical answers for business owners, executives, and operational teams seeking a documented understanding of where their organization stands on applicable mandatory requirements.
What exactly does I.M.P.A.C.T. do for my business?
Think about the regulatory requirements your business must satisfy. Some require employee training, documented procedures, licenses, periodic reviews, or records demonstrating that certain activities have been completed. I.M.P.A.C.T. identifies applicable obligations within an agreed assessment scope and uses the MCIC to request relevant business facts and supporting evidence. It then delivers documented PASS / RISK / FAIL findings and a certificate identifying the assessed scope and results.
What is the MCIC, and why does it request evidence?
The Mandatory Client Information & Compliance (MCIC) document organizes questions that are linked to particular governed obligations. It establishes relevant business facts, resolves applicability, and identifies supporting records needed for assessment. A simple statement that a business is compliant is not necessarily sufficient evidence.
How are the questions related to my daily or periodic operations?
An applicable requirement may involve routine training, license maintenance, written procedures, reviews, or recordkeeping. The MCIC asks about those activities only when relevant to an assessed obligation. Required timing comes from the obligation, not from a generic daily, weekly, or annual checklist.
What if a requested document is missing?
Identify the evidence as unavailable rather than creating or guessing records. Missing, incomplete, or contradictory information is handled through the assessment process and can affect the resulting finding. An inquiry form is not the place to submit evidence.
Do you assess every regulation affecting my business?
No. I.M.P.A.C.T. assesses a defined, supported set of prioritized mandatory obligations and applies obligation-specific applicability criteria. Results do not certify universal compliance or replace legal advice.
What do PASS, RISK, and FAIL mean?
They are the assessment outcome categories determined by the governed evaluation process. Their meaning is tied to the applicable obligation, evidence, and assessment contract. The certificate reports the results without independently reinterpreting them.
When do I submit actual business records?
Not through this public website. Sensitive artifacts should be submitted only through an approved secure client process after scope, engagement terms, payment arrangements, and authorization are established.
How do I get started?
Explore the sample MCIC, review the service and scope information, and send a general inquiry describing your organization, industry, location, and needs. Do not include confidential records, patient information, or payment details.
Sample MCIC Starter Kit
Example organization: Fictional privately owned outpatient physician practice in Texas. These questions illustrate how actual regulatory provisions lead to applicability inquiries and evidence requests. They are not a verified crosswalk to the currently configured Healthcare_TX obligation IDs, a complete MCIC, or a compliance determination.
| Regulatory obligation | Illustrative MCIC question | Example supporting evidence |
|---|---|---|
| HIPAA Security Rule: Risk Analysis 45 CFR §164.308(a)(1)(ii)(A) | For a covered entity or business associate, has an accurate and thorough risk analysis of electronic protected health information been performed? | Documented risk analysis, date, scope, risks and vulnerabilities identified. |
| HIPAA Privacy Rule: Notice of Privacy Practices 45 CFR §164.520 | Where the notice requirements apply, is a current notice maintained and made available as required? | Current notice, effective/revision date, and records relevant to distribution or acknowledgment. |
| HIPAA Security Rule: Workforce Security 45 CFR §164.308(a)(3) | What policies and procedures govern workforce authorization and access to electronic protected health information? | Applicable access policies, authorization and access-management records. |
| HIPAA Security Rule: Contingency Plan 45 CFR §164.308(a)(7) | What contingency procedures protect systems containing electronic protected health information? | Data backup, disaster recovery, emergency-mode operation documentation and related records. |
HIPAA obligations depend on covered-entity/business-associate status, applicable provisions, and other facts. Each actual assessment uses its governed obligation definitions, applicability logic, and evidence requirements. Never send protected health information through the public inquiry form.
Download Sample MCIC (PDF)