Use this practical technology and security checklist to identify what to review, document, and discuss with your practice’s privacy and security leaders. It is designed for medical practices across Virginia and West Virginia, including Winchester, Frederick County, Martinsburg, and Charles Town.
CMIT Solutions Northern Shenandoah Valley is a locally-owned, nationally-supported managed IT provider delivering enterprise-class IT and cybersecurity that proactively protects growing businesses.
Network proof point: CMIT Solutions has 250+ locations across North America.
Take the corporate AI Readiness Self-Assessment
The assessment is a corporate AI Readiness Self-Assessment, not a HIPAA risk analysis. Responses are qualified at the corporate level and may be passed to the appropriate franchise.
Start with scope: what systems and information are in play?
HIPAA’s Security Rule applies to covered entities and business associates in specified circumstances. Whether it applies to your organization depends on its role and situation; other privacy or security obligations may also be relevant. Confirm applicability with qualified counsel.
The Security Rule is flexible and risk-based. It does not prescribe one universal technology stack or checklist that fits every practice. Use these prompts to help organize a review, not to determine compliance.
- Confirm which practice entity, locations, and business functions are in scope for your review.
- Identify where electronic protected health information (ePHI) is created, received, maintained, or transmitted.
- Map the systems involved in patient scheduling, billing, records, imaging, remote access, email, and third-party applications.
- Note how staff, clinicians, vendors, and business associates access those systems.
- Record where ePHI moves between systems, locations, devices, and organizations.
Why this matters: A safeguard can only be evaluated against the systems and data it is meant to protect. A current map helps your team see gaps that may otherwise remain hidden between departments or vendors.
Risk analysis and risk response
The HIPAA Security Rule describes risk analysis as an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Risk management means taking appropriate steps to address identified risks. A review should reflect your practice’s actual environment, not simply copy a generic template.
- Confirm whether your practice has a documented risk analysis covering the ePHI and systems identified above.
- Check whether it considers plausible threats, vulnerabilities, likelihood, and potential impact.
- Verify that identified risks have a recorded priority, response, and accountable owner.
- Track remediation actions, target dates, and any decisions to accept or defer risk.
- Revisit the analysis when systems, operations, staffing, or threats change, and after relevant incidents.
Why this matters: A risk analysis is not a one-time paperwork exercise. Connecting findings to owners and follow-up actions helps leadership see whether important security work is moving forward.
Security responsibility and workforce access
Access controls should reflect what people need to do their jobs and the risks identified by the organization. Workforce processes matter because access can become outdated when roles change or employment ends.
- Confirm who is assigned responsibility for coordinating security activities.
- Review whether access is based on role and limited to what each user needs.
- Check that each person has a unique user ID; avoid shared accounts that obscure who took an action.
- Review whether authentication safeguards, including multifactor authentication (MFA), are appropriate to your risk analysis and systems.
- Confirm how access changes when staff responsibilities change.
- Verify that access is promptly reviewed and disabled when it is no longer needed, including at termination.
- Identify and separately control privileged or administrator accounts.
Why this matters: Individual accounts and timely access changes improve accountability and reduce the chance that an old or over-permissioned account becomes an easy route into sensitive systems.
Endpoints, email, and transmission security
A medical practice’s security picture includes more than its central records system. Laptops, mobile devices, imaging workstations, email, and remote connections may all touch sensitive information.
- Inventory computers, mobile devices, servers, network equipment, and clinical or imaging workstations that may access ePHI.
- Review whether endpoint protections and security settings are appropriate for the organization’s risks.
- Confirm that operating systems and applications are supported and patched through a managed process.
- Check how lost or stolen devices are reported, secured, and handled.
- Review email protections and how employees report suspicious messages.
- Assess how ePHI is protected when sent over electronic networks, including remote access and connections to third-party applications.
- Confirm that staff know which tools and approved channels to use for sensitive information.
Why this matters: Attackers often target everyday entry points, such as email accounts and unpatched devices. Reviewing these controls helps reduce exposure without assuming that one product or setting is right for every practice.
Audit visibility and monitoring
Audit controls are intended to help record and examine activity in systems that contain or use ePHI. Logging alone is not the whole process: your practice should understand what activity is visible and who reviews it.
- Confirm whether systems handling ePHI record relevant user and security activity.
- Identify who reviews logs or alerts, how often, and how concerns are escalated.
- Check whether the practice can investigate unusual sign-ins, access, or changes to accounts.
- Review whether monitoring covers important cloud services, remote access, and third-party applications.
- Document any visibility gaps and assess them against the organization’s risks.
Why this matters: If unusual activity is not visible or reviewed, a practice may not recognize an account compromise or inappropriate access promptly.
Backups, recovery, and contingency planning
The Security Rule addresses contingency planning for emergencies that affect systems containing ePHI. Backups help, but recovery also depends on knowing what is critical and testing whether data and services can be restored.
- Confirm whether retrievable backup copies are created for important ePHI and systems.
- Review how backup access is protected and whether copies are appropriately isolated from routine accounts and systems.
- Identify the applications and data that are most critical to patient care and business operations.
- Document how the practice would restore data and resume essential operations after a disruption.
- Test restoration and recovery procedures, then record results and follow-up actions.
- Review and update contingency procedures as systems or operations change.
Why this matters: A backup that has not been restored in a test may not meet your recovery needs. Testing can reveal practical issues before an outage affects scheduling, records, billing, or imaging workflows.
Vendors, business associates, and third-party applications
Third parties may host, process, transmit, or access sensitive information. Technology review should include the connections and services on which your practice depends.
- List vendors and applications that may create, receive, maintain, or transmit ePHI.
- Confirm who can access each service and whether access is still needed.
- Review how security responsibilities and safeguards are evaluated with relevant vendors.
- Confirm whether required business associate arrangements are in place with your privacy or compliance lead and qualified counsel.
- Review vendor access when services change or end.
- Identify dependencies that could affect recovery or access to practice data.
Why this matters: Your practice’s risk can extend beyond its own devices. Knowing which vendors connect to ePHI helps you manage access and understand where to focus follow-up.
Workforce awareness, incident response, and review cadence
People need a clear way to recognize and report security concerns. Your practice also needs a process for responding to incidents and learning from them. The appropriate steps depend on your organization and should be coordinated with designated privacy, security, and legal advisors.
- Confirm that workforce members receive security awareness information relevant to their roles.
- Make sure staff know how to report a suspected phishing message, lost device, or unusual account activity.
- Identify who receives and coordinates incident reports.
- Review whether response procedures cover containment, investigation, recovery, and appropriate internal escalation.
- Document and review incidents, near misses, and corrective actions.
- Set a review cadence for risk analysis, access, safeguards, vendors, and recovery plans that reflects your environment and changes.
Why this matters: A clear reporting path can help your team act sooner, while periodic review keeps security decisions connected to current technology and operations.
The Issues, the Results, and the Key Success Factors
The Issues
- Important ePHI flows may be undocumented.
- Accounts or permissions may remain after a job or vendor relationship changes.
- Monitoring may be enabled without a clear review process.
- Backups may exist without tested recovery steps.
- New systems and vendors may not be reflected in the latest risk review.
The Results
- A clearer picture of systems, ePHI, and dependencies.
- Better visibility into risks, owners, and open actions.
- More intentional access and vendor reviews.
- Greater confidence in recovery procedures after testing.
- A practical basis for prioritizing security work.
Key Success Factors
- Assign owners and follow-up dates to meaningful findings.
- Involve the people who understand clinical, administrative, and technology workflows.
- Reassess safeguards in light of your organization’s risk analysis.
- Keep records of decisions, tests, and remediation.
- Coordinate technology questions with the privacy or security officer and qualified counsel.
For practices without an internal IT department, organized technical support can help maintain visibility across systems, access, monitoring, patching, and recovery. The important first step is to understand your current environment and prioritize improvements based on your practice’s risks, not to assume a checklist alone establishes compliance.
Frequently Asked Questions
Does completing this checklist make a practice HIPAA compliant?
No. This is an educational technology and security readiness tool. Completing it does not establish compliance, certify a practice, or replace a risk analysis or professional review.
Is the HIPAA Security Rule the same for every medical practice?
The Security Rule is designed to be flexible and scalable. Safeguards should be appropriate to the organization’s size, complexity, capabilities, and risks. The checklist is a starting point for discussion, not a universal configuration requirement.
Does every item here apply to every practice?
Not necessarily. Requirements and appropriate safeguards depend on your organization’s role, circumstances, and risk analysis. Confirm applicability and obligations with your privacy or security officer and qualified counsel.
What is a HIPAA Security Rule risk analysis?
It is an assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. It helps an organization understand what it needs to protect and informs its risk-management decisions.
Can this checklist help practices in West Virginia as well as Virginia?
Yes. Although the title focuses on Virginia practices, the technology and security review prompts are also useful for practices in West Virginia, including Martinsburg and Charles Town. Applicability and obligations depend on each organization’s role and circumstances.
Disclaimer
This checklist is an educational planning aid, not legal advice, a HIPAA compliance certification, or a guarantee of compliance. Organizations should confirm applicable requirements with their privacy or security officer and qualified counsel.
Sources
- HHS Summary of the HIPAA Security Rule
- HHS Guidance on Risk Analysis
- HHS Security Rule Guidance Material
