FREE TEMPLATE

ADHICS Statement of Applicability

Per-facility SoA template mapping every ADHICS V2 control to applicability, implementation status, evidence and control owner. The core artefact TRBA auditors open first.

What's in the template

Facility metadata header

Facility name, DoH licence, applicable ADHICS tier, accountable owner, SoA review date.

Full ADHICS V2 control list

Every control across all 12 families with reference number and short description.

Applicability column

Each control marked Applicable / Not applicable, with a justification note where excluded.

Implementation status

Implemented / Partial / Planned per control, with target close date for anything open.

Evidence mapping

Column linking each control to the artefact that proves it — policy, log, screenshot, contract.

Control owner

Named person accountable for the control, matched to the role in the governance policy.

Approval line

Signature block for the accountable owner (or CISO at Advanced tier) and executive sponsor.

Version history

Change log showing SoA revisions quarter-over-quarter, feeding the quarterly report workflow.

Tier-specific guidance

Basic tier

Clinics, dental practices, pharmacies and standalone diagnostic labs. SoA uses the Basic column set with simpler evidence depth.

Transitional tier

Multi-site providers and specialty centres. SoA adds risk-rating per control and vendor-dependency mapping.

Advanced tier

Hospitals and complex providers. SoA adds internal-audit column, control-effectiveness metrics and CISO sign-off.

How to use the template

One SoA per facility

A single corporate SoA is not accepted by DoH. Clone the template per DoH-licensed facility — each gets its own applicability, status and evidence pointers.

Fill applicability first

Walk every ADHICS control. Mark Applicable or Not applicable with a one-sentence justification for every exclusion. Exclusions are the first thing a TRBA auditor challenges.

Set implementation status

For applicable controls, mark Implemented, Partial or Planned. Partial and Planned need a target close date and an owner.

Attach evidence

Link every Implemented control to its artefact — policy section, screenshot, log excerpt, contract page. Vague links trigger finding counts.

Approval and quarterly review

Accountable owner (CISO at Advanced tier) signs the SoA. Revisit at every quarterly report — any change feeds the next quarter’s submission.

SoA across multiple sites?

LowerPlane maintains a facility-specific SoA for every DoH-licensed site and keeps them in sync with your live evidence pack. One change, every SoA updated.

See Multi-Site SoA Automation