A HIPAA compliance checklist for a medical practice covers naming privacy and security officials, completing a written security risk analysis, setting policies, training staff, applying technical and physical safeguards, signing Business Associate Agreements and having a breach response plan. The 2025 Security Rule overhaul is still only proposed, so today's rule governs.
This checklist is for practice owners and managers who must decide what to do first. Each item names the rule behind it, so you can see what is required, what is optional and what is only good practice. If you want the billing-side view, see our guide to HIPAA compliance in medical billing; this post covers the whole practice.
Key takeaways
- The risk analysis is a required first step; nothing in the rule requires an independent auditor.
- Encryption is addressable, not optional: assess it and document your decision.
- Notify individuals within 60 calendar days of discovery at the latest; for 500 or more people, tell HHS at the same time.
- Any vendor that handles your PHI generally needs a signed BAA before access.
- The 2025 Security Rule update is proposed, not final; today’s rule still applies.
What does HIPAA require of a medical practice?
HIPAA asks a practice to protect patient information in three linked ways: limit who may use or share it (the Privacy Rule), secure the electronic copies (the Security Rule) and tell people when it is exposed (the Breach Notification Rule). The Security Rule summary on HHS.gov states that it addresses the Security Rule currently in effect and cites the 2013 Omnibus Rule (78 FR 5566).
The Privacy Rule’s administrative duties are plain. A covered entity must name a privacy official, train its workforce, apply sanctions for violations, keep reasonable safeguards, run a complaint process and give patients a notice of privacy practices. It must also keep required documentation for six years, according to the HHS Privacy Rule summary. The Security Rule sets the same six-year period for its own documentation in 45 CFR 164.316(b)(2)(i).
One more point shapes the whole checklist. The Security Rule separates required specifications from addressable ones. Addressable does not mean optional. Under 45 CFR 164.306(d)(3) you assess whether the measure is reasonable and appropriate for your environment. If it is not, you document why and, where reasonable, use an equivalent measure.
The HIPAA compliance checklist: what to have in place
Work through these in order. The first group costs little and unlocks the rest.
1. Governance: name people and write things down
- Privacy official and contact person. Name them in writing, as the Privacy Rule requires.
- Security official. 45 CFR 164.308(a)(2) requires you to identify the person responsible for developing and implementing your security policies and procedures.
- Written policies and a complaint path. Policies should match how your front desk and billing team actually work.
- Six-year records. Keep policies, training records, risk analyses and complaint files for six years from creation or last effective date, whichever is later.
2. People: train, then enforce
- Training for the whole workforce, including management. 45 CFR 164.308(a)(5) requires a security awareness and training program. The rule text we reviewed does not set a number of hours or a refresher date, so choose a schedule you can document and keep.
- Sanctions. Have a written policy for workforce members who break your privacy rules, and apply it consistently.
- Access removal. Terminate system access when someone leaves or changes roles. Termination procedures are an addressable specification in 164.308(a)(3)(ii)(C).
3. Technology and physical safeguards
The table below lists a sample of safeguards and how the rule classifies each one, from the eCFR text of 45 CFR Part 164.
| Safeguard | Citation (45 CFR) | Classification today |
|---|---|---|
| Risk analysis | 164.308(a)(1)(ii)(A) | Required |
| Risk management | 164.308(a)(1)(ii)(B) | Required |
| Data backup, disaster recovery and emergency mode plans | 164.308(a)(7)(ii)(A)-(C) | Required |
| Unique user identification | 164.312(a)(2)(i) | Required |
| Audit controls | 164.312(b) | Required (standard) |
| Encryption of stored ePHI | 164.312(a)(2)(iv) | Addressable |
| Encryption of ePHI in transmission | 164.312(e) | Addressable |
| Disposal and media re-use of devices | 164.310(d)(1) | Required |
Source: eCFR, 45 CFR 164.308, 164.310 and 164.312 (read October 2026). Classification per the eCFR specification labels.
Physical safeguards follow the same logic. Facility access, workstation security and device and media controls (164.310) cover who can enter file rooms, how workstations are secured and what happens to old computers.
4. Vendors and incidents
The last two groups, Business Associate Agreements and breach response, get their own sections below because they cause the most surprises.
Why the risk analysis comes first
The risk analysis is the one item every other safeguard depends on. 45 CFR 164.308(a)(1)(ii)(A) requires an “accurate and thorough assessment” of the risks and vulnerabilities to the confidentiality, integrity and availability of your ePHI. Risk management, the step that acts on the findings, is a separate required specification.
OCR’s list of resolution agreements includes several settlements built around risk analysis, among them a $750,000 settlement announced in December 2015 that OCR said underscored the need for an organization-wide risk analysis. For a small practice the lesson is scope: list every place ePHI lives, including the EHR, billing system, portals, email, laptops and phones, then rate each risk and record your response.
The rule asks for a “periodic” technical and nontechnical evaluation under 164.308(a)(8), updated after environmental or operational changes that affect ePHI security. The rule text does not fix a calendar interval. We recommend reviewing it at least yearly and whenever you add a system, vendor or location. That is good practice, not a legal deadline.
Independent audits are not required today
The old version of this post told practices to “engage independent auditors.” Nothing in 164.308 requires an outside auditor. You must perform the analysis and evaluation; who performs it is up to you. An outside reviewer can still help when no one on staff has security expertise.
Business Associate Agreements: which vendors need one?
Any vendor that creates, receives, maintains or transmits PHI for your practice is generally a business associate and needs a signed Business Associate Agreement (BAA) before it touches the data. The HHS business associate guidance lists claims processing, billing, practice management and cloud services that handle ePHI among the activities that can make a vendor a business associate. Your own workforce members are not business associates.
HHS’s sample BAA provisions show what the contract must cover: permitted uses and disclosures, appropriate safeguards, reporting of unauthorized uses and breaches, support for patients’ access and amendment requests, access to records for HHS, return or destruction of PHI at termination where feasible, the same terms for subcontractors and the right to terminate for a material violation. HHS also notes that using its sample wording is not required and that a contract may need more to be binding under state law.
A BAA does not move your responsibility to the vendor. If you know of a pattern of activity that is a material breach by a business associate, you must take reasonable steps to cure it or end the contract, if feasible. Business associates are also directly liable under the HIPAA Rules for impermissible uses and disclosures and for failing to safeguard ePHI.
What to ask a billing or front-desk vendor
- Will you sign a BAA before you access any patient data, and may we review it first?
- Which of your staff and subcontractors can see our PHI, and are their BAAs in place?
- How do you control and log access to our records?
- How and when will you tell us about a security incident or breach, and how does that fit our 60-day clock?
- What happens to our data when the contract ends?
For our part, we put a Business Associate Agreement in place before accessing patient data. If you are comparing outsourced billing teams, our HIPAA billing guide and medical billing compliance guide go deeper on vendor questions.
Not sure which vendors touch your PHI?
Our free practice audit looks at how claims, remittances and patient data move through your billing workflow, so you can see which vendors and staff need a BAA or tighter access.
Breach notification: the 60-day clocks
If unsecured PHI is exposed in a way the Privacy Rule does not allow, you must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Sixty days is the outer limit, not a target. The old version of this post presented it as a deadline to aim for.
An impermissible use or disclosure is presumed to be a breach unless you can show a low probability that the PHI was compromised, based on at least four factors in 45 CFR 164.402: the nature and extent of the PHI involved, who used or received it, whether it was actually acquired or viewed, and how far the risk has been reduced. Keep that assessment in writing.
| Who is notified | Deadline | Citation |
|---|---|---|
| Affected individuals | Without unreasonable delay, no later than 60 calendar days after discovery | 164.404(b) |
| HHS, breach of 500 or more people | At the same time as individual notice, through the HHS breach portal | 164.408(b) |
| HHS, breach of fewer than 500 people | Log all year; report within 60 days after the end of the calendar year | 164.408(c) |
| Media, more than 500 residents of a state or jurisdiction | Without unreasonable delay, no later than 60 days after discovery | HHS breach notification page |
| You, from your business associate | Without unreasonable delay, no later than 60 calendar days after the associate discovers it | 164.410 |
Source: eCFR 45 CFR 164.404-164.410; HHS Breach Notification Rule and breach reporting pages (read October 2026). A law enforcement delay may apply under 164.412.
Individual notices must be in plain language and cover what happened, including dates, the types of PHI involved, steps people should take, what you are doing in response and how to reach you. Encryption can change your obligations. PHI counts as secured when it is rendered unusable, unreadable or indecipherable to unauthorized people, and HHS’s guidance on unsecured PHI points to NIST-consistent encryption for stored data and for data in transit. HHS also treats shredded paper and properly sanitized electronic media as secured.
For cyber incidents, OCR publishes a ransomware fact sheet and a cyber-attack checklist, linked from its cybersecurity guidance page. Print the checklist and put it with your breach plan.
What do HIPAA penalties actually look like?
HIPAA civil money penalties come in four tiers that depend on how culpable the practice was, and the amounts are adjusted for inflation each year. The old post said the “average cost of a HIPAA violation is $1.5 million.” That is wrong. The $1.5 million figure in 45 CFR 160.404 is the base annual cap for identical violations; the amounts in the regulation are updated annually and published in 45 CFR Part 102.
In the Part 102 table we read in October 2026, the per-violation minimum rises from $145 where the entity did not know of the violation, to $1,461 for reasonable cause, to $14,602 for willful neglect corrected in the required period and $73,011 for willful neglect not corrected. The calendar-year cap shown for identical violations is $2,190,294. The table is revised every year, so check it before quoting a figure.
Under 45 CFR 160.404, the lowest tier applies when the entity did not know, and with reasonable diligence would not have known, of the violation. Willful neglect sits at the top. A current risk analysis, training records and signed BAAs are how a practice shows it was paying attention.
Is the 2025 HIPAA Security Rule update in effect?
No. As of October 2026, the Security Rule overhaul is a proposed rule, not a final rule, and the current Security Rule remains in effect. HHS published the proposal in the Federal Register on January 6, 2025 (90 FR 898), with comments due March 7, 2025, according to the Federal Register notice. HHS’s proposal page says the current Security Rule remains in effect while rulemaking continues, and we found no final rule.
Do not tell staff or auditors that the new requirements already apply. Under the proposal, a final rule would take effect 60 days after publication and regulated entities would then have 180 days to comply, with a separate transition period for updating business associate agreements. HHS said it would not enforce the new changes before the compliance date.
On timing, trade coverage by the HIPAA Journal (January 2026) and Pact-One (September 2026) reports that OCR’s regulatory agenda target slipped from May 2026 to about July 2027, and that provider groups have asked HHS to withdraw the proposal. We could not confirm the agenda entry on a government site, so treat it as a press report.
| Topic | In force today | Proposed in the NPRM (not final) |
|---|---|---|
| Required vs addressable | Some specifications are addressable (assess, then implement or document why not) | All implementation specifications would become required, with narrow exceptions |
| Authentication | Person or entity authentication is a required standard (164.312(d)) | Multi-factor authentication required, with limited exceptions |
| Encryption | Encryption of stored and transmitted ePHI is addressable | Encryption at rest and in transit required, with limited exceptions |
| Evaluation | Periodic technical and nontechnical evaluation (164.308(a)(8)) | Compliance audit at least every 12 months |
| Restoring systems | Data backup, disaster recovery and emergency mode plans are required | Written procedures to restore certain systems and data within 72 hours |
| Business associates | BAA must require Security Rule compliance (164.314(a)) | Business associates would verify safeguards and certify at least every 12 months |
Source: HHS OCR, HIPAA Security Rule NPRM fact sheet; Federal Register, 90 FR 898 (January 6, 2025); eCFR 45 CFR Part 164. Proposed items may change before any final rule.
How to use the proposal without over-claiming
The proposal would also require a technology asset inventory and network map, reviewed at least every 12 months. Multi-factor authentication, encryption, an asset inventory and a tested restore plan are sensible controls today, whatever happens to the rule. Adopt them as good practice and label them that way in your policies. For a billing-side reading of the proposal, see our post on the 2025 HIPAA Security Rule and revenue cycle management.
Where HIPAA meets billing, and when to get help
Billing is where a lot of PHI moves: claims, remittances, statements and appeals. The front desk shares that exposure, so our posts on HIPAA at the front desk and patient privacy in the revenue cycle turn the checklist into daily habits.
Specialty changes the details: a pain management clinic, a behavioral health practice and a radiology group handle different records and vendors. Our specialty billing pages show how each is set up, and your counsel or compliance advisor should decide which extra rules apply to you.
A billing partner can reduce the load, but it cannot make your practice compliant for you. If you outsource, the end-to-end revenue cycle management team still works under your policies, your BAA and your oversight. If you want to see how much cash is tied up in your A/R before you plan the extra staff time, try the revenue calculator.
Want a second pair of eyes on your billing workflow?
Our free practice audit shows where claims and patient data move through your practice, so you can decide what to fix first and what to hand off.
Our recommendations
- Name both officials this week. We would put the privacy official and the security official on one signed page, with a backup for each. It takes an hour and fixes the most common gap.
- Scope the risk analysis to every system with ePHI. List the EHR, billing software, portals, email, shared drives, laptops and phones first. A narrow analysis that skips billing tools leaves the biggest blind spot.
- Match every vendor to a signed BAA. Build one list of vendors, what PHI each sees and the BAA date. Anything with PHI and no signed BAA is your first fix.
- Put the breach clocks on one page. Write the 60-day individual deadline, the 500-person HHS rule and the annual small-breach log on one page, with the name of who decides. Keep the OCR cyber-attack checklist beside it.
- Train on real workflows and keep the proof. We would train front desk and billing on the situations they meet, such as callers asking for records and misdirected faxes, then keep dated attendance records for six years.
- Adopt the proposed controls as good practice, not as law. Multi-factor authentication and encryption cost little. Add them now, but describe them in your policies as your choice until a final rule exists.
Two items on the checklist are access control and activity logging.
The portal has role-based permissions and an audit log. No software makes a practice compliant by itself; policies and training still apply.
See how the RCM Finder portal works · Create a portal account
Disclosure: RCM Finder builds and sells this portal. It is a practice management system, not an EHR.
Bottom line
A solid HIPAA compliance checklist starts with named officials, a real risk analysis, trained staff, signed BAAs and a written breach plan, and it treats the 2025 Security Rule proposal as pending, not law. If your billing or front desk work is outsourced, check the contract first. For billing support under your own policies, see our medical billing services and end-to-end revenue cycle management, or contact us to talk through your workflow.
Frequently asked questions
Is there an official HIPAA certification for my practice?
No government body issues a HIPAA certificate. Compliance means meeting the Privacy, Security and Breach Notification Rules and being able to show it with documents such as a risk analysis, policies, training records and BAAs. Be wary of vendors that sell a certificate as proof.
How often must we do a security risk analysis?
The Security Rule requires an accurate and thorough risk analysis and a periodic evaluation, updated after changes that affect ePHI security. It does not give a calendar interval in the text we reviewed. Many practices review yearly and after any new system, vendor or location. The 2025 proposal would add annual requirements, but it is not final.
Do we need a BAA with our billing company and cloud EHR?
Generally yes. HHS lists billing, claims processing, practice management and cloud services that handle ePHI among activities that can make a vendor a business associate. Sign the agreement before the vendor accesses PHI, and keep a copy. Your own employees are workforce members, not business associates.
How long do we have to report a breach?
Notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. For 500 or more people, tell HHS at the same time. For fewer than 500, log them and report to HHS within 60 days after the end of the calendar year. Media notice applies above 500 residents of a state.
Is the new HIPAA Security Rule final?
No. As of October 2026 it is a proposed rule published January 6, 2025, and HHS says the current Security Rule remains in effect. A final rule would take effect 60 days after publication, with a proposed 180-day compliance period. Trade press reports a target around July 2027, which is unconfirmed.
What are the HIPAA penalties for a small practice?
Penalties follow four culpability tiers and are adjusted yearly in 45 CFR Part 102. In the table we read, the per-violation minimum ranged from $145 to $73,011, with a calendar-year cap of $2,190,294 for identical violations. Documented diligence matters. Check the current table before quoting figures.
Get your free practice audit
Tell us about your practice. We will contact you using the details you give.
- A review of your recent claims, denials and A/R aging
- Where your front desk and prior authorizations slow payment
- A prioritized fix list you keep, whether or not you hire us
Pricing is quoted after the audit, based on your volume and the services you choose. Prefer to talk? Call +1 (302) 556-2288.
Sources
- 45 CFR Part 164 (HIPAA Security, Breach Notification and Privacy Rules) — eCFR / U.S. Government Publishing Office (2026)
- 45 CFR 160.404 Amount of a civil money penalty — eCFR (2026)
- 45 CFR Part 102 Adjustment of Civil Monetary Penalties for Inflation — eCFR (2026)
- The HIPAA Security Rule — HHS Office for Civil Rights (2026)
- HIPAA Security Rule NPRM — HHS Office for Civil Rights (2026)
- HIPAA Security Rule NPRM Fact Sheet — HHS Office for Civil Rights (2025)
- HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information (90 FR 898) — Federal Register (2025)
- Breach Notification Rule — HHS Office for Civil Rights (2026)
- Breach Reporting — HHS Office for Civil Rights (2026)
- Guidance to Render Unsecured PHI Unusable, Unreadable or Indecipherable — HHS Office for Civil Rights (2026)
- Business Associates — HHS Office for Civil Rights (2026)
- Sample Business Associate Agreement Provisions — HHS Office for Civil Rights (2026)
- Summary of the HIPAA Privacy Rule — HHS Office for Civil Rights (2026)
- Cybersecurity guidance — HHS Office for Civil Rights (2026)
- Resolution agreements and civil money penalties — HHS Office for Civil Rights (2026)
- HIPAA Updates and HIPAA Changes in 2026 — HIPAA Journal (secondary source) (2026)
- Is the HIPAA Security Rule Final in 2026? — Pact-One (secondary source) (2026)
Disclaimer: This article is general educational information about HIPAA operations for medical practices. It is not legal, compliance, security or coding advice, and no one can certify a practice as HIPAA compliant from a checklist. State laws, payer contracts and federal rules change. Confirm requirements with the HHS Office for Civil Rights, your counsel or a qualified compliance or security advisor before acting.
