← All documentation

Compliance score and posture trend

Each program you assess has its own compliance score (0–100, graded A–F): a weighted read on how that program is doing right now, computed live, and shown out of 100, the same unit as an assessment score. Your AI governance score is always shown. Once your organization has a HIPAA assessment, or has recorded that it is a covered entity or business associate, a HIPAA score sits beside it. The two are never blended into one number: they measure different programs against different records.

A score measures your program on the platform; it is not a determination that you meet any law or standard.

Two things about the weights, because they are shares rather than fixed percentages of 100:

  • A dimension with no data yet is left out of the average — not counted as zero, and not counted as perfect (one exception: Risk analysis, below). If you have not written any policies, the Policies dimension does not drag your score down, and the remaining weights below are shares of what has been measured. A program with nothing recorded anywhere is not scored at all, and Score history says so rather than showing a grade.
  • The AI governance weights add up to 85, not 100, so each is a share of the dimensions measured: with all four measured, Findings counts for 30/85 of the score.

The AI governance score

  • Findings (weight 30) — the share of findings that are resolved, accepted, or marked false-positive vs. still open, weighted by severity: an open critical finding drags the score roughly five times as hard as an open low one (critical 5×, high 3×, medium 2×, low/informational 1×). Severity comes from the finding's risk level, which in turn reflects each question's criticality weight in the question bank. It counts the findings your AI governance assessments raised, and every finding added by hand.
  • Policies & docs (weight 20) — coverage across the ten AI governance policy areas, minus a penalty for any of those policies overdue for review.
  • Training (weight 20) — the share of your workforce trained within the last 365 days on any course other than the HIPAA courses (your own courses included). The workforce is the union (de-duplicated by email) of your organization's active members (not auditors, not Backsplice staff) and your training roster; a person counts as trained if either a logged training record or a passed delivered course falls within the window. Not scored while the training register is switched off.
  • Incident response (weight 15) — penalized for incidents involving AI (or where that was not recorded) left open or under review for more than 30 days.

The HIPAA score

The same rules, read from your HIPAA records:

  • Findings (weight 30) — the findings your HIPAA assessments raised, weighted by severity as above. A finding added by hand counts toward the AI governance score, not this one.
  • Policies & docs (weight 20) — coverage across the HIPAA policy areas, minus a penalty for any of those policies overdue for review.
  • Training (weight 15) — the share of your workforce trained on the HIPAA courses within the last 365 days. Not scored while the training register is switched off.
  • Business associates (weight 15) — the share of vendors marked as handling PHI for you whose business associate agreement is in force (current, or expiring soon). Not scored while the vendor register is switched off. A vendor still to confirm is counted in the detail, never in the score.
  • Incident response (weight 10) — penalized for incidents involving protected health information (or where that is not yet known) left open or under review for more than 30 days.
  • Risk analysis (weight 10) — full marks when a HIPAA security risk analysis was approved in the last 12 months, none when the last approval is older or none has been approved. Not scored until you start one, unless you have completed a HIPAA program assessment: from then on, having none started scores 0.

The AI risk register is not scored, and vendors count only toward the HIPAA score's business associates: a count of vendors or risks says nothing about whether they are well managed. Their state shows on their own pages and in the risk portfolio.

Assessment scores, and how N/A is treated

The program score above (your AI governance score or HIPAA score) is separate from an assessment score, the score of one assessment: its pass rate, the share of its applicable questions answered Yes, out of those answered (a question not yet answered is not scored). It is the number the assessment's signed report and certificate print, and it is recorded when the assessment is completed. The same number shows on your Home posture tile and in the score log on Score history, with one exception: an entry recorded before assessments recorded their pass rate holds a different number, a findings score, which weighs the findings the assessment raised by severity. Those entries are labeled "Findings score" on Home and in the score log and are never recomputed. The Score column of the assessments list always shows the pass rate, worked out from the answers, so for an assessment completed before then it can differ from the findings score Home shows; a trend plots one kind of number and never joins a findings score to a pass rate as one line.

Questions you mark N/A are excluded from the score entirely — they leave both the top and the bottom of the fraction. A question that doesn't apply to you isn't a partial failure, so it shouldn't pull your score down. If your assessment has 130 questions and 40 genuinely don't apply to your organization, your score is measured out of the 90 that do.

This is why marking N/A honestly matters in both directions: marking something N/A that does apply hides a real gap, and answering No to something that doesn't apply understates a program that's actually in good shape. The platform requires a note when you mark a question N/A so the reasoning is on the record for an auditor.

The posture trend

Once a day a snapshot of each score is recorded. Reports → Score history shows today's score immediately, plus a 90-day trend chart once a few days of snapshots have accrued; when you have both scores, a tab switches between them. The trend is org-wide and continuous — distinct from the per-assessment score, which is recorded only when an assessment is completed.

Drift alerts

If a score drops by 5 or more points versus its previous snapshot, your org admins are notified (the alert names the score and which dimensions regressed). This is the "3 controls slipped this quarter" early-warning — catch a regression before an auditor does. The alert respects the weekly-digest notification preference.

Gap analysis

Reports → Gap analysis turns one compliance score into a work list: the AI governance score, or the HIPAA score on its own tab once your organization is scored in HIPAA. Pick a target (default A / 90) and the report shows every program dimension and assessment category that's below it — worst gap first — with the points-to-target and a concrete next action for each ("Resolve or formally accept the open findings.", "Answer 4 remaining questions and remediate the gaps.", "Close out long-running open incidents."). It's deterministic (no AI): program scores come from findings, policies, training and incidents (and, for the HIPAA score, business associate agreements and the risk analysis); category scores come from that score's program assessment answers. When nothing is below target, it says so.