HIPAA Compliance Checklist

This HIPAA compliance checklist covers what a small practice or a health-tech vendor has to have in place under the three main rules: the Privacy Rule, the Security Rule and the Breach Notification Rule. The short version is that you need a documented security risk analysis, written policies and procedures that match how you actually work, trained staff, technical safeguards on every system that holds protected health information, signed business associate agreements with every vendor that touches that information, and the records to prove all of it. The rest of this guide turns that sentence into a list you can work through. This is general information, not legal advice.

• HIPAA in 200 words
• The rules
• HIPAA compliance checklist by rule
• Vendors and business associate agreements
• Documentation

HIPAA in 200 words: what it is, who enforces it, who it applies to

What is HIPAA law? The Health Insurance Portability and Accountability Act is a US federal law whose administrative simplification provisions led to the regulations most people mean by “HIPAA”: national standards for protecting individually identifiable health information, known as protected health information or PHI. The HITECH Act later strengthened the rules, extended them directly to business associates and raised the penalties.

Who enforces HIPAA? The Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services (HHS) investigates complaints and breach reports, conducts audits and settles or imposes civil penalties. State attorneys general can also bring actions on behalf of residents, and criminal violations are referred to the Department of Justice. The official rules and guidance live at hhs.gov/hipaa.

Who does it apply to? Two groups:

• Covered entities: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions (claims, eligibility checks, referrals and the like). Almost every practice that bills insurance electronically is a covered entity.
• Business associates: any person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity. That includes EHR vendors, billing companies, cloud hosting providers, IT support firms, transcription services, and the subcontractors of all of them.

If you are a health-tech founder, read the second bullet twice. If your software stores or processes PHI for a provider or plan, you are a business associate and directly liable under the Security Rule and parts of the Privacy Rule.

The rules

Rule	What it governs	Who it binds
Privacy Rule	How PHI in any form (paper, spoken, electronic) may be used and disclosed; patients’ rights to access, amend and receive an accounting of their records; the minimum necessary standard; the Notice of Privacy Practices	Covered entities, and business associates for the uses and disclosures their contracts allow
Security Rule	Administrative, physical and technical safeguards for electronic PHI (ePHI); the security risk analysis; workforce training; contingency planning; documentation	Covered entities and business associates
Breach Notification Rule	Assessing whether an impermissible use or disclosure of unsecured PHI is a reportable breach; notifying affected individuals, HHS and in large cases the media; business associates notifying covered entities	Covered entities and business associates
Enforcement Rule	Investigations, civil money penalties and the procedures OCR follows	Everyone covered by the other rules

Two points trip people up. First, the Security Rule has “required” and “addressable” implementation specifications, and addressable does not mean optional: you implement it, implement a reasonable alternative, or document why neither is reasonable. Second, HHS has proposed updates to the Security Rule; check the current official text before relying on any summary, including this one.

HIPAA compliance checklist by rule

Work through each block in order. Items marked “document” need a dated record, because under HIPAA an undocumented control is treated as if it does not exist.

Privacy Rule checklist

• Designate a Privacy Officer (one named person, even in a two-provider practice).
• Publish and distribute a Notice of Privacy Practices; post it in the office and on your website; obtain and document acknowledgment of receipt where required.
• Write a uses-and-disclosures policy: what is permitted for treatment, payment and health care operations, what needs written authorization, and how you handle requests from family, employers, law enforcement and researchers.
• Apply the minimum necessary standard: role-based limits on who sees what, including inside your own team.
• Set up procedures for patient rights: access to records (including electronic copies), amendment requests, accounting of disclosures, restriction requests and confidential communications, with response times and fees in line with the current rule.
• Create an authorization form that meets the rule’s content requirements for marketing, sale of PHI, psychotherapy notes and other non-routine uses.
• Train the workforce on privacy policies at hire and after any material change; keep the attendance record.
• Define a sanctions policy for workforce members who violate privacy or security policies, and apply it.
• Handle complaints: a documented intake process and a no-retaliation rule.

Security Rule checklist: administrative safeguards

• Security risk analysis (document). An accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of all ePHI you hold. It must cover every system, device and vendor that touches ePHI, not just the EHR. OCR’s risk analysis guidance describes what “thorough” means; our IT risk assessment template gives you the format.
• Risk management plan (document). For each risk, the control you chose, who owns it and when it was done. Review and update the analysis after any major change and on a regular cycle.
• Designate a Security Officer (can be the same person as the Privacy Officer in a small organization).
• Workforce security: authorization and supervision procedures, background checks where appropriate, and a termination checklist that removes access the same day.
• Information access management: role-based access, a documented approval process for granting and changing access, and periodic access reviews.
• Security awareness and training: periodic reminders, protection from malicious software, log-in monitoring and password management, with specific training on phishing.
• Security incident procedures: how staff report a suspected incident, who investigates, how it is contained and documented, including incidents that turn out not to be breaches.
• Contingency plan: a data backup plan, a disaster recovery plan, an emergency mode operation plan, testing and revision procedures, and an applications and data criticality analysis. Test a restore, not just a backup.
• Periodic evaluation: a technical and non-technical review of whether your safeguards still meet the rule after operational or environmental changes.
• Business associate contracts: a signed BAA with every business associate before any ePHI is shared (see the next section).

Security Rule checklist: physical safeguards

• Facility access controls: who can enter the areas where ePHI systems live, visitor procedures, and a facility security plan.
• Workstation use and security policies: screen positioning, automatic screen locks, no PHI on personal devices unless managed, clean-desk rules.
• Device and media controls: an inventory of laptops, phones, tablets, USB drives and servers that hold ePHI; procedures for disposal, reuse, and tracking movement; full-disk encryption on portable devices.

Security Rule checklist: technical safeguards

• Access control: a unique user ID for every person (no shared logins), an emergency access procedure, automatic logoff, and encryption of ePHI at rest wherever reasonable and appropriate.
• Audit controls: logs that record who accessed what ePHI and when, retained and reviewed. Cover file shares, email and cloud storage, not only the EHR.
• Integrity controls: mechanisms that detect improper alteration or destruction of ePHI, such as checksums, version history and database integrity checks.
• Person or entity authentication: multi-factor authentication for remote access, email and administrative accounts, and strong passwords everywhere else.
• Transmission security: encryption in transit (TLS) for every connection carrying ePHI, including email, patient portals, APIs and interfaces to labs, pharmacies and clearinghouses.

Breach Notification Rule checklist

• Define “breach” in your policy using the rule’s language, and write down the four-factor risk assessment used to decide whether an impermissible disclosure has a low probability of compromise: the nature and extent of the PHI, who received it, whether it was actually acquired or viewed, and the extent of mitigation.
• Keep an incident log that records every potential breach, the assessment, the conclusion and the evidence, even when you decide notification is not required.
• Prepare notification templates for individuals, HHS and the media, and know the timing and content requirements in the current rule so you are not reading them for the first time during an incident.
• If you are a business associate, your BAA sets how quickly you must notify the covered entity; build that into your incident procedure.
• Encrypt ePHI to the standard HHS guidance recognizes. PHI that is encrypted in line with that guidance is not “unsecured”, which can take a lost laptop out of the breach category altogether.

Vendors and business associate agreements

Every vendor that creates, receives, maintains or transmits PHI on your behalf is a business associate and needs a signed business associate agreement (BAA) before it sees any data. List every system and service and ask one question for each: can this vendor access PHI, even incidentally? Email providers, cloud storage, EHR and practice management vendors, telehealth platforms, billing and clearinghouse services, IT support companies, shredding and offsite storage firms, answering services, and analytics tools that touch patient data usually need one. A vendor that only transports encrypted data without accessing it may fall under the narrow conduit exception; do not assume it does.

A BAA must, among other things, describe the permitted uses and disclosures, require appropriate safeguards and compliance with the Security Rule, require reporting of security incidents and breaches, flow the same obligations down to subcontractors, support the covered entity’s patient-rights obligations, and set out what happens to PHI when the contract ends. Keep a register of every BAA with the signature date and renewal date.

Business associates have their own checklist: the Security Rule applies to you directly, you need BAAs with your own subcontractors, and customers increasingly ask for evidence (a risk analysis, policies, a SOC 2 report) rather than a signature. If you build software that handles PHI, the technical side is covered in our guide to HIPAA-compliant software development.

Documentation: what you must be able to produce

When OCR investigates a complaint or a breach report, the first request is for documents. The Security Rule requires that policies, procedures and records of actions, activities and assessments be kept in writing, retained for the period the rule specifies, available to the people responsible for implementing them, and reviewed and updated periodically. The practical set:

• The current security risk analysis and every prior version, with the risk management plan and evidence of remediation.
• All privacy and security policies and procedures, version-controlled, with approval dates.
• Training records: who, what, when, including new-hire and refresher sessions.
• The BAA register and the signed agreements.
• The asset inventory of devices and systems that hold ePHI.
• Access authorization records and the results of periodic access reviews.
• The incident log and breach risk assessments.
• Contingency plan test results and backup restore tests.
• Patient-rights request logs (access, amendment, accounting) with response dates.
• Sanctions applied and complaints received.

This documentation set overlaps with what data governance in healthcare asks for, and the two programs are easier to run together. If you are introducing AI tools that process PHI, add them to the risk analysis and the BAA register; our guide to AI governance in healthcare covers the extra controls.

Where PS3G fits

PS3G helps practices and health-tech vendors of every size work through this list. Our HIPAA compliance consulting covers the security risk analysis, the risk management plan, policies written for how you actually operate, workforce training and BAA review, and we coordinate with your attorney or auditor where their sign-off is needed. For vendors and providers building their own systems, our healthcare software development team builds PHI handling in from the first design. We also operate our HIPAA-compliant EHR and telehealth platform, DocVilla, so the advice comes from running a regulated system, not only from reading the rule.

Related reading

• HIPAA-Compliant Software Development: Requirements & Checklist
• Data Governance in Healthcare: HIPAA, Quality, Interoperability
• AI Governance in Healthcare: HIPAA, Clinical Risk, Controls
• HIPAA compliance consulting services

Frequently asked questions

Is there an official HIPAA certification?

No. HHS does not certify organizations, software or people as HIPAA compliant, and no third-party certificate carries legal weight with OCR. Training vendors issue certificates of completion, which are useful as training records and nothing more. What counts is evidence: a current risk analysis, policies that match practice, trained staff, working safeguards and signed BAAs, because compliance is an ongoing state, not a one-time award.

How often should a HIPAA risk assessment be done?

The Security Rule requires the risk analysis to be kept current rather than setting a fixed calendar interval. Most organizations review it at least annually and whenever something material changes: a new EHR, a cloud migration, a merger, a new telehealth service, a security incident. Each review should produce an updated document and an updated risk management plan showing what was fixed and what was accepted.

Does HIPAA apply to a small practice with only a few employees?

Yes, if the practice transmits health information electronically for standard transactions such as claims, which nearly every insurance-billing practice does. The rule’s “flexibility of approach” lets a small practice choose safeguards that are reasonable for its size, complexity and resources, but it cannot skip the risk analysis, policies, training or BAAs. Smaller scope means a shorter checklist, not an exemption.

Is a cloud provider a business associate?

Generally yes, if it stores or processes ePHI for you, even if the data is encrypted and the provider never looks at it. HHS guidance on cloud computing says the provider is a business associate and a BAA is required. The major cloud platforms offer BAAs and publish lists of eligible services; you remain responsible for configuring those services correctly and for everything you build on top of them.

What is the difference between a HIPAA violation and a breach?

A violation is any failure to comply with the rules, such as missing policies, an untrained employee or no risk analysis, whether or not any data was exposed. A breach is an impermissible acquisition, access, use or disclosure of unsecured PHI that compromises its security or privacy. Many investigations start with a breach report and end with penalties for the violations that allowed it, usually a missing or inadequate risk analysis.