Reviewed by Dallas Stewart, President & Owner, CMIT Solutions of Bellevue. Last updated: October 2026.
A HIPAA compliance checklist helps a healthcare practice confirm that it protects patient information the way federal regulations require. The checklist covers three areas.
The Privacy Rule controls who can use and share protected health information. The Security Rule sets administrative, physical and technical safeguards for electronic patient data. The Breach Notification Rule explains what to do if data is exposed.
This guide walks through each rule and the IT controls behind it. It is written for medical and dental practices on Seattle’s Eastside and beyond. Regular reviews help you avoid penalties and enforcement actions. They also protect your patients’ trust.
Who needs to comply with HIPAA?
HIPAA applies to covered entities and their business associates. Covered entities include health plans, healthcare clearinghouses and healthcare providers that send health information in electronic form. Medical, dental, therapy and specialty practices usually fall into this group.
Business associates are vendors that create, receive, store or transmit patient information for a covered entity. Billing companies, cloud providers and IT service providers are common examples. Business associates must also safeguard patient data and are directly accountable for their own compliance.
What is protected health information (PHI)?
Protected health information is individually identifiable health information that a covered entity or business associate holds or shares. It can be oral, written or electronic. Examples include a patient’s name linked to a diagnosis, appointment dates, billing records and insurance details. When PHI is stored or sent in electronic form, it is called electronic PHI, or ePHI.
What is the HIPAA Privacy Rule?
Congress passed HIPAA, the main federal law that protects patient health information, in 1996. Later, the U.S. Department of Health and Human Services (HHS) issued the regulations that put the law into practice. Two of the most important are the Privacy Rule and the Security Rule.
The Privacy Rule requires safeguards for PHI. It also limits how PHI can be used or disclosed without patient permission. Patients have rights over their information, including the right to:
- Get a copy of their health records
- Request corrections if there are errors
- Have their records sent to another provider
- Request an accounting of disclosures made in the past six years
The Privacy Rule is the foundation of HIPAA compliance. Use it as the starting point for a checklist tailored to your own practice.
What does the HIPAA Security Rule require?
The Security Rule applies to electronic protected health information. It requires three categories of safeguards.
What are administrative safeguards?
Administrative safeguards cover the policies and people side of security. They include a documented security risk analysis and a risk management plan. They also require a designated security official, workforce training and incident response procedures.
What are physical safeguards?
Physical safeguards protect the facilities and devices where patient data lives. Access to offices and server rooms should be controlled. Workstations, laptops and mobile devices that store or access patient data need clear rules for use and storage.
What are technical safeguards?
Technical safeguards are the technology controls. They include unique user identification, access controls, audit logs, transmission security and automatic logoff.
A security risk analysis is a required part of the Security Rule, not an optional best practice. Review it regularly and whenever your systems change.
How do you run a HIPAA security risk analysis?
A risk analysis identifies where patient data lives and what could put it at risk. For a small practice, the process usually follows these steps:
- Inventory your ePHI. List every system, device and vendor that stores, receives or transmits patient data. Include your EHR, email, backups, laptops, phones and cloud applications.
- Identify threats and weak spots. Consider phishing, ransomware, lost or stolen devices, weak passwords, outdated software and human error.
- Review your current safeguards. Note which controls are already in place, such as MFA, encryption and backups.
- Rate likelihood and impact. Estimate how likely each risk is and how much harm it could cause to patients and to the practice.
- Document the results. Keep a written record of the analysis and the decisions you made.
- Create a risk management plan. Prioritize fixes, assign owners and set deadlines. Then revisit the plan as your practice changes.
What should a healthcare HIPAA compliance checklist include?
Use this HIPAA compliance checklist to keep your practice aligned with HIPAA and your patients’ data secure.
Which policies and people steps should you check?
- Designate a privacy and security official responsible for HIPAA training and implementation.
- Make sure every staff member understands what counts as PHI and how to handle it.
- Train all workforce members on the policies that apply to their roles.
- Write policies for using and disclosing PHI.
- Know when patient permission is required, and set a process to get it.
- Create procedures for patients to access their records or request transfers.
- Create a process for staff to report possible HIPAA violations.
- Retain HIPAA policies and related documentation for at least six years.
Which IT controls support HIPAA compliance?
- Complete and document a security risk analysis, and update it when systems change.
- Require unique logins and multi-factor authentication (MFA) for systems that access patient data.
- Encrypt laptops, mobile devices and backups that contain patient information.
- Keep operating systems and software patched and supported.
- Back up patient data and test that it can be restored.
- Keep audit logs of who accesses patient records.
- Sign a business associate agreement (BAA) with every vendor that handles patient data, including your IT provider.
- Prepare an incident response and contingency plan for the loss or exposure of patient data.
What are common HIPAA compliance mistakes in small practices?
- Skipping or never updating the risk analysis. A risk analysis completed once and forgotten does not reflect new systems, staff or threats.
- Shared logins. When several people use one account, you cannot tell who accessed patient records.
- Unencrypted laptops and phones. A lost device with unencrypted patient data can become a reportable breach.
- Missing business associate agreements. Every vendor with access to patient data needs a signed BAA.
- Untested backups. A backup that has never been restored may fail when you need it most.
- One-time training. Staff need regular security awareness training, especially about phishing emails.
How does HIPAA apply to remote work and mobile devices?
Many practices now use laptops, tablets and phones outside the office. The same safeguards still apply. Devices that access patient data should:
- Be encrypted
- Use strong passwords and MFA
- Receive security updates promptly
Staff should connect through secure networks and report lost devices right away. Mobile device management tools help your practice enforce these policies and remotely wipe a lost device.
What about telehealth and patient messaging?
Telehealth visits, patient portals and secure messaging all involve ePHI. Choose platforms designed for healthcare that will sign a BAA. Limit access to the staff who need it, and include these tools in your risk analysis. Avoid sending patient details through personal email or standard text messages.
How should you document HIPAA compliance?
Documentation shows regulators and auditors that your safeguards exist and are maintained. Keep these records organized and current:
- Your most recent security risk analysis and risk management plan
- Written privacy and security policies
- Training records with dates and attendees
- Signed business associate agreements
- Incident and breach logs
- Backup and restore test results
HIPAA requires you to retain this documentation for at least six years.
What happens if a HIPAA breach occurs?
The Breach Notification Rule sets clear deadlines. A practice must notify affected patients without unreasonable delay. Notice must go out no later than 60 days after the breach is discovered.
Breaches that affect 500 or more people must also be reported to HHS within that window. When 500 or more residents of a state are affected, the practice must also notify prominent local media. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year.
How do HIPAA compliant IT services help a practice?
Most small practices do not have a full-time IT security team. HIPAA compliant IT services fill that gap. A managed IT provider can:
- Run and document the security risk analysis
- Configure access controls and MFA
- Encrypt devices and secure email
- Monitor systems for threats
- Manage and test backups
- Help you prepare an incident response plan
Because the provider works with systems that hold patient data, it is a business associate. It should sign a BAA with your practice.
What should you ask before choosing an IT provider for HIPAA?
- Will you sign a business associate agreement?
- How do you perform and document a security risk analysis?
- How do you protect logins, devices and email?
- How are backups stored, encrypted and tested?
- How do you monitor for threats, and how quickly do you respond to incidents?
- What documentation will we receive to demonstrate our safeguards?
HIPAA compliance FAQs
What are the three HIPAA security safeguards?
Administrative, physical and technical safeguards. Together they cover policies and training, physical access to systems and the technology controls that protect electronic patient data.
Is a risk analysis required under HIPAA?
Yes. The Security Rule requires a documented security risk analysis. Covered entities and business associates must also manage the risks it identifies.
Does my IT provider need to sign a business associate agreement?
Yes, if your IT provider can access systems that store or transmit patient data. In that case it is a business associate and should sign a BAA with your practice.
How long do we have to report a HIPAA breach?
No later than 60 days after discovering a breach of unsecured patient information, and sooner when possible. Breaches affecting 500 or more people also require notice to HHS and local media.
How often should a small practice review HIPAA compliance?
Review your risk analysis and policies at least once a year. Review them again whenever you add new systems, change vendors or experience a security incident.
Do dental practices need to follow HIPAA?
Yes. Dental practices that send health information in electronic form, for example for insurance claims, are covered entities. They must follow the Privacy, Security and Breach Notification Rules.
What should be on a HIPAA compliance checklist for a small practice?
At minimum, include a documented risk analysis, written privacy and security policies, staff training, MFA and access controls, encrypted devices and tested backups, signed BAAs with vendors and an incident response plan.
How can CMIT Solutions of Bellevue help with HIPAA compliant IT services?
Working through a HIPAA compliance checklist can feel overwhelming for a busy practice.
CMIT Solutions of Bellevue works with medical and dental practices on Seattle’s Eastside. We help with security risk assessments and incident response planning. We also provide layered security, backup and 24/7 monitoring.
Call (425) 495-2214 to talk with our local team about HIPAA compliant IT services for your practice.
