HIPAA compliance isn't optional — it's federal law. And with penalties ranging from $100 to $50,000 per violation (up to $1.5 million per year per violation category), small practices can't afford to get it wrong. Here's your complete checklist.
Privacy Rule Checklist
Patient Rights
- Provide Notice of Privacy Practices to every patient
- Post Notice in a prominent location
- Post Notice on your website
- Acknowledge patient receipt of Notice
- Honor patient right to access their records (within 30 days)
- Honor patient right to amend their records
- Honor patient right to an accounting of disclosures
- Honor patient right to request restrictions on disclosures
- Honor patient right to confidential communications
Uses and Disclosures
- Only share PHI for treatment, payment, and operations (TPO)
- Obtain written authorization for non-TPO disclosures
- Minimum necessary standard applied to all disclosures
- Track all disclosures outside of TPO
Security Rule Checklist
Administrative Safeguards
- Designate a HIPAA Security Officer (can be the owner)
- Conduct annual risk analysis
- Implement risk management plan
- Sanction policy for workforce violations
- Information access management procedure
- Workforce security training (annual)
- Contingency plan (disaster recovery)
- Emergency access procedure
- Periodic evaluation of security measures
Physical Safeguards
- Facility access controls (locked doors, badge access)
- Workstation use policies (screen positioning, lock screens)
- Workstation security (physical locks for laptops)
- Device and media controls (inventory, disposal)
- Secure disposal of PHI (shredding, wiping)
- Backup storage off-site
Technical Safeguards
- Access control (unique user IDs)
- Automatic logoff after inactivity (15 minutes max)
- Encryption of PHI at rest (EBS, database, backups)
- Encryption of PHI in transit (HTTPS/TLS)
- Audit controls (log all access to PHI)
- Integrity controls (detect unauthorized alterations)
- Transmission security (VPN, encrypted email)
Breach Notification Checklist
If a Breach Occurs
- Contain the breach immediately
- Conduct risk assessment (is it reportable?)
- Notify affected patients within 60 days
- Include required content in notification
- Notify HHS Secretary
- If 500+ individuals affected, notify media
- Document the breach and response
- Implement corrective action plan
Breach Response Kit
- Breach response plan documented
- Breach assessment template ready
- Patient notification letter template ready
- HHS reporting portal bookmarked
- Legal counsel identified
Business Associate Agreement (BAA) Checklist
- Signed BAA with EHR vendor
- Signed BAA with billing service
- Signed BAA with cloud provider (AWS, Google, Microsoft)
- Signed BAA with email provider (if handling PHI)
- Signed BAA with transcription service
- Signed BAA with any vendor who touches PHI
- Review BAAs annually
- Terminate BAA if vendor relationship ends
Training Checklist
- New hire HIPAA training (before accessing PHI)
- Annual refresher training for all staff
- Training documentation (who, when, what)
- Sanction policy for training non-completion
- Specialized training for IT/security staff
Documentation Checklist
- HIPAA policies and procedures documented
- Risk analysis documented (annual)
- Risk management plan documented
- Sanction policy documented
- Training records retained (6 years)
- BAA records retained (6 years)
- Breach documentation retained (6 years)
- Notice of Privacy Practices retained (6 years)
Technology Checklist
- EHR is HIPAA-compliant (BAA signed)
- Email is encrypted
- Text messages to patients are encrypted or consented
- Remote access uses VPN or encrypted connection
- Mobile devices have remote wipe capability
- Backups are encrypted and tested
- Antivirus and malware protection on all devices
- Firewall installed and configured
- Software updates applied regularly
- Password policy enforced (complexity, rotation)
Common Small Practice Mistakes
- No risk analysis — the #1 OCR audit finding
- Verbal passwords — staff sharing login credentials
- Unencrypted laptops — easy to steal, easy to breach
- No BAA with vendors — you're liable for your vendors
- Texting PHI — unencrypted SMS is a breach waiting to happen
- No training documentation — "we trained them" isn't enough
- Stale risk analysis — must be updated when circumstances change
Conclusion
HIPAA compliance is ongoing, not a one-time project. Use this checklist quarterly, document everything, and don't cut corners on training or risk analysis. The cost of compliance is always less than the cost of a breach.
Neuraline EHR is HIPAA-compliant with encryption at rest and in transit, audit logging, and BAA available. Learn more.