HIPAA compliance checklist for small practices

The checklist

What to have in place, and what to keep as proof.

• 1. A current risk analysis (164.308(a)(1))Every system, device and vendor that creates, receives, stores or sends ePHI, the threats to each, and a plan for what you will fix. Proof to keep: the dated analysis, the risk register and the treatment plan. More on this
• 2. Administrative safeguards (164.308)A named security official, access granted and removed by role, a contingency plan with tested backups, and someone who regularly reviews access logs and incident reports. Proof to keep: the appointment, access reviews, the backup test and the review notes. More on this
• 3. Physical safeguards (164.310)Locked rooms or cabinets for servers and records, workstations placed so screens are not on public view, and devices and media wiped before reuse or disposal. Proof to keep: the device inventory and the disposal records. More on this
• 4. Technical safeguards (164.312)A unique login for every person, a way to confirm each login is who it claims to be (MFA is the usual answer, and the January 2025 proposed update, not yet final, would require it), automatic logoff, encryption on laptops and phones, and audit logs on systems that hold ePHI. Proof to keep: sign-in settings, encryption status per device and the log retention setting. More on this
• 5. Business associate agreementsA signed agreement with every vendor that handles PHI for you, signed before they get access: billing, IT, cloud storage, email, transcription. Proof to keep: the inventory with each agreement, its owner and its renewal date. More on this
• 6. Written policies and procedures (164.316)Policies that describe how the practice actually works, including a sanction policy, kept for six years from when they were last in effect. Proof to keep: the current set, past versions and each acknowledgment. More on this
• 7. Security awareness trainingTraining for every workforce member when they join and when things change, with phishing and password rules in it. Proof to keep: a record per person with the date and the content. More on this
• 8. Breach notification readinessAn incident plan that names who decides, a breach log, and the clock: affected individuals within 60 days of discovery, HHS and the media too when 500 or more people are affected. Proof to keep: the plan, the log and the last exercise. More on this
• 9. An annual reviewOnce a year, and whenever something big changes, refresh the risk analysis, re-read the policies, re-run training and check every BAA. Proof to keep: the dated review and what changed. More on this

Not sure the checklist applies to you? It does if you are a HIPAA covered entity or one of their business associates. Free starting points for items 5 and 6, a BAA review checklist and a patient authorization form, are on our compliance templates page, and the terms are defined in the compliance glossary. To have all nine areas tracked for you between reviews, see how our HIPAA compliance platform works.