Managed IT ServicesHIPAA is the foundation of patient data protection in the United States, and it isn’t a box you check once. A practical HIPAA compliance checklist gives your practice a structured way to find gaps, fix them, and prove to auditors, insurers, and patients that protected health information (PHI) is safe.
Healthcare remains one of the most targeted industries for cyberattacks, and breaches in healthcare are among the most expensive of any sector. At the same time, the HHS Office for Civil Rights (OCR) has made risk analysis failures a central focus of its enforcement. Small practices are not exempt.
This HIPAA compliance checklist breaks the work into 20 steps across the three types of safeguards the HIPAA Security Rule requires: administrative, physical, and technical. We’ve also added what’s changing in 2026 and tips for keeping compliance going year-round. It’s the same framework eMDTec uses with medical and dental practices across New Jersey.
Why Every Practice Needs a HIPAA Compliance Checklist
HIPAA’s Security Rule is intentionally flexible. It tells you what outcomes to achieve but leaves much of the “how” to you, based on your size and risk. That flexibility is useful, but it also makes it easy to miss requirements, especially for practices without a dedicated compliance officer.
A HIPAA compliance checklist turns the rule into concrete tasks with owners and dates. It helps you:
- Find gaps before OCR or an attacker does. Many enforcement actions start with a breach report, then uncover years of missing risk analyses.
- Prioritize spending. You’ll see which fixes reduce the most risk for the least cost.
- Answer insurance and vendor questionnaires accurately. Cyber insurers now ask detailed questions about MFA, backups, and encryption.
- Keep documentation in one place. HIPAA requires you to keep security policies and related records for six years.
Before you start, make sure you know what counts as protected health information. It includes far more than chart notes: appointment schedules, billing records, insurance details, and even emails with patients can all contain PHI.
HIPAA Administrative Safeguards Checklist
Administrative safeguards are the policies, procedures, and people decisions behind your security program. OCR consistently finds the biggest gaps here, so this is where your HIPAA compliance checklist should start.
1. Conduct a HIPAA security risk assessment
The risk analysis is the single most important item on any HIPAA compliance checklist. Identify where ePHI lives (EHR, practice management, email, imaging, laptops, phones, cloud apps), what threats it faces, and how likely and damaging each one would be. Repeat it at least annually and whenever you add a major system. A professional HIPAA security risk assessment gives you an objective baseline and documentation OCR expects to see.
2. Create a risk management plan
A risk assessment without follow-through doesn’t satisfy HIPAA. Document how you’ll address each risk you found, who owns the fix, and the target date. Track progress until each item is closed.
3. Appoint a security officer and a privacy officer
HIPAA requires named individuals responsible for security and privacy. In a small practice, one person can hold both roles, often a practice manager supported by an outside IT partner.
4. Write and maintain policies and procedures
Document how PHI is accessed, used, shared, stored, and destroyed. Cover acceptable use, remote work, device use, passwords, and sanctions for violations. Review your policies at least once a year.
5. Train every workforce member
Train new hires before they get system access and provide refresher training at least annually. Include phishing awareness, since email remains one of the most common entry points for healthcare breaches. Keep sign-in sheets or completion records.
6. Manage workforce access
Grant access based on job role and remove it the same day someone leaves. Review user accounts quarterly to catch former staff, shared logins, and people who have more access than they need.
7. Sign business associate agreements
Any vendor that creates, receives, stores, or transmits PHI for you needs a signed business associate agreement (BAA). That includes your EHR vendor, billing company, cloud backup provider, email host, and IT provider. Keep a vendor list with BAA dates.
8. Build an incident response and breach notification plan
Document how staff report suspected incidents, who investigates, and how you decide whether an incident is a reportable breach. Under the HIPAA Breach Notification Rule, affected patients must be notified without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people must also be reported to HHS within 60 days, and to the media in the affected state.
HIPAA Physical Safeguards Checklist
Physical safeguards protect the buildings, rooms, and devices where PHI is stored or accessed. They’re often overlooked in small practices, where front-desk computers sit in plain view of the waiting room.
9. Control facility access
Restrict access to areas where PHI or network equipment is kept. Lock server closets, use keycards or keyed locks, keep visitor logs, and make sure cleaning crews and contractors can’t wander into records rooms unattended.
10. Secure workstations
Position screens away from public view, use privacy filters at reception, and set computers to lock automatically after a few minutes of inactivity. Staff should lock their screens whenever they step away.
11. Control devices and media
Keep an inventory of laptops, tablets, phones, and removable drives that store or access PHI. Track who has each device and where it goes, especially for providers who work from home or multiple locations.
12. Dispose of equipment and media securely
Wipe or physically destroy hard drives, copiers, and phones before they leave your control, and keep certificates of destruction. A recycled PC with an intact drive is a breach waiting to happen.
13. Protect paper records
Paper still counts. Lock file cabinets, shred documents with PHI, and don’t leave charts or fax printouts on open counters.
HIPAA Technical Safeguards Checklist
Technical safeguards are the technology controls that protect ePHI. This section of your HIPAA compliance checklist is where an experienced IT partner adds the most value.
14. Use unique user IDs and strong access control
Every person needs their own login for the EHR, email, and computers. Shared accounts make it impossible to know who accessed a record, and HIPAA requires that ability.
15. Turn on multi-factor authentication
Require MFA for email, remote access, the EHR (where supported), and any cloud apps holding PHI. MFA blocks the vast majority of password-based attacks and is one of the first things insurers ask about.
16. Encrypt ePHI at rest and in transit
Encrypt laptops, phones, and servers, and use secure email or a patient portal for messages containing PHI. Under the Breach Notification Rule, properly encrypted data that’s lost or stolen generally isn’t considered a reportable breach.
17. Enable audit logs and review them
Turn on logging in your EHR, email, and network systems, and actually review the logs. Look for unusual access, such as staff opening records of patients they don’t treat or logins at odd hours.
18. Protect endpoints and patch systems
Run managed endpoint protection on every device and apply security updates promptly. Retire systems that no longer receive updates. Our mobile and endpoint security service handles this for practices that don’t have in-house IT.
19. Back up ePHI and test restores
HIPAA requires a contingency plan with data backup, disaster recovery, and emergency-mode operations. Keep encrypted, isolated backups and test restoring them regularly. A backup you’ve never restored is a guess, not a plan. Our guide to backup and recovery plans explains what to look for.
20. Secure email and remote access
Use email filtering to block phishing and malicious attachments, and require a secure VPN or zero-trust access for anyone connecting from outside the office. Disable remote desktop ports exposed to the internet.
What’s Changing in 2026: The HIPAA Security Rule Update
In January 2025, HHS published a proposed rule that would make the biggest changes to the HIPAA Security Rule since it took effect. The HHS Security Rule guidance tracks its status. Key proposals include:
- Removing the distinction between “required” and “addressable” safeguards, so most controls become mandatory.
- Requiring multi-factor authentication and encryption of ePHI, with limited exceptions.
- Requiring a written technology asset inventory and a network map, updated at least annually.
- Requiring the ability to restore critical systems within 72 hours.
- Requiring vulnerability scans at least every six months and penetration testing at least annually.
- Requiring an annual compliance audit and written verification from business associates.
Timelines for the final rule have shifted more than once, so check the current status before you plan around a specific date. The smart move is to build these controls into your HIPAA compliance checklist now. Most of them are already best practice, and practices that wait will face a rushed, expensive catch-up. We cover the details in our article on the 2026 HIPAA Security Rule update.
HIPAA Compliance Checklist at a Glance
Use this summary table to assign owners and track how often each item on your HIPAA compliance checklist should be revisited.
| Checklist item | Safeguard type | Review frequency |
|---|---|---|
| Security risk assessment and risk management plan | Administrative | Annually and after major changes |
| Security and privacy officers named | Administrative | When roles change |
| Policies and procedures | Administrative | Annually |
| Workforce training | Administrative | At hire and at least annually |
| User access reviews | Administrative | Quarterly |
| Business associate agreements | Administrative | At signing and annually |
| Incident response and breach plan | Administrative | Annually, plus a tabletop test |
| Facility, workstation, and paper record controls | Physical | Semi-annually |
| Device inventory and secure disposal | Physical | Ongoing |
| Unique IDs, MFA, and encryption | Technical | Quarterly |
| Audit log review | Technical | Monthly |
| Patching and endpoint protection | Technical | Monthly |
| Backup restore test | Technical | Quarterly |
A 90-Day Plan for Working Through the HIPAA Compliance Checklist
Twenty items can feel overwhelming if you’re starting from scratch. Here’s how we typically sequence the HIPAA compliance checklist with a new practice so the biggest risks get handled first.
Days 1–30: Assess and stop the bleeding
Complete the security risk assessment and build a device and vendor inventory. At the same time, fix the urgent issues it uncovers: turn on MFA for email, remove former employees’ accounts, confirm backups are running, and collect any missing business associate agreements. These quick wins cut a large share of your real-world risk.
Days 31–60: Document and train
Write or update your policies and procedures, name your security and privacy officers, and finalize your incident response and breach notification plan. Run workforce training and record attendance. By the end of this phase, the administrative section of your HIPAA compliance checklist should be complete and documented.
Days 61–90: Harden and test
Encrypt every laptop and phone, tighten workstation and facility controls, enable audit logging, and test a full restore from backup. Close out the remaining items in your risk management plan and schedule the recurring reviews from the table above.
After the first 90 days, the HIPAA compliance checklist becomes a maintenance routine: monthly patching and log reviews, quarterly access and backup checks, and an annual risk assessment and policy review.
Who Should Own Your HIPAA Compliance Checklist?
In most small practices, the practice manager owns the HIPAA compliance checklist day to day, with the physician-owner signing off on policies and major decisions. The technical items, such as encryption, MFA, logging, patching, and backups, usually belong to your IT provider.
What matters is that every line of the HIPAA compliance checklist has a name next to it. When OCR investigates, “we thought the IT company handled that” is not a defense. Your business associate agreement with your IT provider should spell out which safeguards they manage, and your practice should receive regular reports showing the work was done.
Many practices schedule a short quarterly meeting with their IT partner to walk through the HIPAA compliance checklist, review open items, and update the risk management plan. Thirty minutes a quarter is far cheaper than a corrective action plan.
HIPAA Compliance Checklist for Remote Work and Telehealth
Many practices now have billers, coders, and even providers working from home. Remote work doesn’t change HIPAA’s requirements, but it changes how you meet them. Add these items to your HIPAA compliance checklist if anyone accesses PHI outside the office:
- Company-managed, encrypted devices instead of personal computers.
- Secure remote access with MFA, never open remote desktop ports.
- Telehealth platforms that will sign a BAA.
- Home-office rules covering screen privacy, printing, and family members.
- The ability to remotely lock or wipe a lost device.
Tips for Implementing Your HIPAA Compliance Checklist
- Start with the risk assessment. It tells you which checklist items matter most for your practice.
- Assign an owner and date to every item. A checklist without owners turns into a wish list.
- Keep everything documented. If it isn’t written down, OCR will treat it as if it didn’t happen. Store policies, training records, risk assessments, and BAAs for at least six years.
- Review your HIPAA compliance checklist quarterly. Staff changes, new software, and new vendors all create new risks.
- Make training ongoing. Short, regular reminders work better than one long annual session.
- Get outside help where it counts. An experienced HIPAA compliance consultant can run the risk assessment, write policies, and handle the technical safeguards so your team can focus on patients.
Common HIPAA Compliance Mistakes in Small Practices
- Skipping the annual risk analysis. It’s the most cited failure in OCR enforcement actions.
- Using personal email or texting for PHI. Convenience is not an exception.
- Missing BAAs. Practices often forget their IT provider, shredding company, or answering service.
- Shared logins at the front desk. They make audit trails useless.
- Untested backups. Many practices discover their backups don’t work during a ransomware attack.
- Old, unsupported computers. Systems that no longer receive security updates are an easy way in.
Frequently Asked Questions
How often should we complete a HIPAA compliance checklist?
Review the full HIPAA compliance checklist at least once a year, alongside your annual risk assessment, and revisit individual items whenever you add systems, change vendors, or have a security incident.
Does HIPAA apply to small practices?
Yes. HIPAA applies to covered entities of every size, including solo practitioners, and to business associates that handle PHI on their behalf. The rule scales to your size, but the core requirements still apply.
Is a HIPAA compliance checklist enough to be compliant?
A checklist is a tool, not a certificate. Compliance comes from completing the work, documenting it, and keeping it current. There is no official government “HIPAA certification.”
What happens if we fail a HIPAA audit?
OCR may require a corrective action plan, impose civil money penalties, or both. Penalties scale with the level of negligence and are adjusted for inflation each year. Practices that can show good-faith effort and documentation fare much better.
Partner with eMDTec for HIPAA Compliance Peace of Mind
HIPAA compliance is an ongoing commitment to your patients, not a one-time project. Working through this HIPAA compliance checklist every year, and keeping up with the 2026 rule changes, protects your patients’ trust and your practice’s future.
eMDTec has supported New Jersey healthcare practices since 2002, including more than 25 years of experience with CGM eMDs. Our healthcare IT support team handles risk assessments, policies, encryption, backups, and monitoring so you can focus on care.
Not sure where your practice stands? Schedule a free consultation and we’ll walk through your HIPAA compliance checklist together.