HIPAA Compliance Checklist for Small Medical and Dental Practices

What goes on a HIPAA compliance checklist?

A HIPAA compliance checklist has five parts: the Security Rule’s administrative, physical, and technical safeguards, the Privacy Rule basics, and breach notification. The Security Rule lives in 45 CFR Part 164, Subpart C. It only covers electronic PHI. The Privacy Rule (Subpart E) covers PHI in any form, paper included.

Each section links the regulation it comes from. The owner tag says who does the work: You (the practice), IT (whoever runs your systems), or Both.

One rule before you start. Some Security Rule items are “Required” and some are “Addressable.” Section 164.306(d) says addressable means you implement it if it’s reasonable and appropriate. If it isn’t, you document why and implement an equivalent alternative. Addressable is not a skip button.

The first item, the HIPAA risk assessment, is the foundation the rest hangs on.

What are the administrative safeguards?

Administrative safeguards are the policies, people, and planning side of the Security Rule, in 45 CFR 164.308. It’s the biggest group. The work is mostly decisions and paperwork, but the evidence comes from your systems.

• Risk analysis (Required). Done: a written assessment of where ePHI lives and what threatens it. Owner: Both.
• Risk management (Required). Done: a list of fixes from that assessment, with dates and who did them. Owner: Both.
• Sanction policy (Required). Done: a written policy for staff who break the rules, applied when they do. Owner: You.
• Activity review (Required). Done: someone regularly reviews audit logs, access reports, and incident reports. Owner: IT.
• Security official (Required standard). Done: one named person is responsible for the security policies. Owner: You.
• Workforce access and termination (Addressable). Done: access is approved before it’s granted and removed the day someone leaves. Owner: Both.
• Access authorization (Addressable). Done: each role gets only the systems it needs, documented and reviewed. Owner: IT.
• Security awareness training (Required standard). Done: all staff, including management, are trained, with records kept. Owner: Both.
• Malware protection, login monitoring, password management (Addressable). Done: endpoint protection on every machine, failed logins watched, a written password standard. Owner: IT.
• Incident response (Required). Done: a written procedure, and every incident logged with its outcome. Owner: Both.
• Backup, disaster recovery, emergency mode (Required). Done: retrievable copies of ePHI, a restore procedure, and a plan to keep seeing patients during an outage. Owner: IT.
• Contingency testing (Addressable). Done: a restore test on file, with the date. Owner: IT.
• Periodic evaluation (Required standard). Done: a recorded review of your safeguards, repeated when things change. Owner: Both.
• Business associate agreements (Required). Done: a signed BAA with every vendor that creates, receives, stores, or sends your ePHI. Owner: You.

That includes your IT provider, EHR host, and email provider. Our HIPAA-compliant email guide covers what a BAA does and doesn’t cover for email, and our HIPAA-compliant texting guide covers patient texts.

What are the physical safeguards?

Physical safeguards control who can touch the hardware and the building, in 45 CFR 164.310. For a small practice, that’s the front desk screen, the network closet, and every laptop that leaves.

• Facility access (Addressable). Done: locked server and network gear, visitor control, and a record of security repairs like lock changes. Owner: You.
• Workstation use (Required standard). Done: a written rule for how and where workstations that access ePHI are used. Owner: You.
• Workstation security (Required standard). Done: screens patients can’t read, machines that lock, and access limited to authorized users. Owner: IT.
• Disposal (Required). Done: drives wiped or destroyed before a device leaves for good, with a record. Owner: IT.
• Media re-use (Required). Done: ePHI removed before a device is reassigned. Owner: IT.
• Device tracking (Addressable). Done: an inventory showing which device is where and who has it. Owner: IT.

Laptops are where this fails loudest. Our stolen laptop remote wipe report shows what acting in minutes looks like.

What are the technical safeguards?

Technical safeguards are the controls built into your systems, in 45 CFR 164.312. IT owns this part outright. If your IT can’t show you each one, you don’t have it.

• Unique user IDs (Required). Done: no shared logins on the EHR, email, or workstations. Owner: IT.
• Emergency access (Required). Done: a written way to reach ePHI when normal access is down. Owner: IT.
• Automatic logoff (Addressable). Done: sessions lock after a set idle time. Owner: IT.
• Encryption at rest (Addressable). Done: full-disk encryption on every laptop and desktop, with recovery keys stored safely. Owner: IT.
• Audit controls (Required standard). Done: logs that record activity in systems holding ePHI, kept and reviewed. Owner: IT.
• Integrity (Required standard). Done: protections against ePHI being altered or deleted without authorization. Owner: IT.
• Authentication (Required standard). Done: proof that each user is who they claim to be. MFA is the practical answer. Owner: IT.
• Transmission security (Required standard). Done: ePHI encrypted when it travels over a network. Owner: IT.

Encryption deserves its own line. We rolled out BitLocker across 127 endpoints with recovery keys escrowed, without touching each machine by hand.

Finally, 45 CFR 164.316 requires all of the above to be written down. Keep that documentation 6 years from when it was created or last in effect, whichever is later.

What are the Privacy Rule basics?

The Privacy Rule covers how you use, share, and protect PHI in every form. The administrative pieces are in 45 CFR 164.530.

• Privacy official and contact person. Done: named in writing. Owner: You.
• Privacy training. Done: every new hire trained within a reasonable time, and training documented. Owner: You.
• Complaint process. Done: a way for patients to complain, and a log of complaints and outcomes. Owner: You.
• Notice of Privacy Practices. Done: given at the first visit, acknowledgment requested, posted in the office, and on your website if you have one (164.520). Owner: You, with IT for the website.
• Patient right of access. Done: record requests answered within 30 days, with one 30-day extension allowed (164.524). Owner: You.

What does breach notification require?

If unsecured PHI is breached, you notify each affected patient without unreasonable delay and no later than 60 days after you discover it. The rules are in 45 CFR 164.400 to 164.414. An impermissible use or disclosure is presumed a breach unless a documented risk assessment shows low probability of compromise.

• Patients. Done: written notice, by first-class mail or email if they agreed to it. Owner: You.
• HHS. Done: reported with the patient notices if 500 or more people are affected. Smaller breaches go in a log and are reported within 60 days of the end of the calendar year. Owner: You.
• Media. Done: notice to prominent media outlets when more than 500 residents of one state or jurisdiction are affected. Owner: You.
• Business associates. Done: your BAAs require vendors to tell you about breaches. Owner: You.
• Proof. Done: records showing every notice went out on time. The burden of proof is yours. Owner: Both.

HHS guidance says ePHI encrypted to its standard, with the key not compromised, is not “unsecured.” A stolen encrypted laptop is a bad day, not a mailing to every patient.

Is the HIPAA Security Rule changing?

Maybe, but not yet. HHS published a proposed rule on January 6, 2025. As of this writing, no final rule has been published in the Federal Register. Per the HHS fact sheet, the proposal would remove the addressable category, require encryption of ePHI at rest and in transit and MFA (both with limited exceptions), and require an asset inventory, a network map, and a compliance audit at least every 12 months. None of it is law today.

Key takeaways

What this looks like when we do it

On our medical practice IT baseline, we work the technical list first: MFA enforced, full-disk encryption with escrowed keys, endpoint protection, patching, monitoring, and backups we’ve restored on purpose. We sign a BAA with every medical practice client. The evidence comes out of the same tools: user lists, encryption status per machine, restore test dates.

Your policies, training, and breach decisions stay yours. Our job is to make the IT half of this checklist true and hand you the proof when someone asks. Our HIPAA compliant IT support page covers the rest of how we work with practices.

Want a second set of eyes on your checklist? Book a call and we’ll go through it with you.