HIPAA checklist for small medical practices
Three questions tell you most of what you need to know. Have you done a written security risk analysis recently? Do you have current policies and staff training records? Do you have business associate agreements with every vendor that touches patient data? A "no" to any of them is a gap worth closing.
Here is the fuller list.
1. A written security risk analysis
This is the foundation, and the item most often missing. It is a documented review of where patient data lives in your practice, what could expose it, and what you are doing about each risk.
It must be written down, and it must be current. Most practices update it every year and after any significant change: a new EMR, a new office, a new vendor with access to records, or a security incident.
"We talked about it" is not a risk analysis. If an auditor asks and you cannot hand over a document, you do not have one.
2. Policies and procedures that match reality
Written policies covering access control, passwords, device use, remote work, breach response, patient rights and record retention.
The common failure is a binder bought years ago that describes a practice nobody works at any more. Policies that contradict daily reality are worse than none, because they document that you knew the standard and did not meet it.
3. Business associate agreements
Every vendor that creates, receives, maintains or transmits patient data on your behalf needs a signed BAA. That includes your EMR, billing company, IT provider, shredding service, cloud backup, secure messaging platform and answering service.
Keep them in one place with renewal dates. The question "do we have a BAA with them?" should take thirty seconds to answer.
4. Training, with records
Train staff on HIPAA when they join and at least annually. The training itself matters less than the record that it happened: who attended, what was covered, what date.
Cover the things that actually cause breaches. Phishing emails. Discussing patients where others can hear. Texting health details. Leaving screens unlocked. Taking records home.
5. Access control
People should see what their job requires and no more. Review who has access to what at least annually.
The one that bites practices: offboarding. When someone leaves, their EMR, email and building access should be revoked the same day. Dormant accounts belonging to former staff turn up constantly in risk assessments.
6. Encryption and devices
Encrypt laptops, phones and tablets that touch patient data. Know which devices those are. A lost encrypted laptop is an inconvenience; a lost unencrypted one may be a reportable breach.
7. Backups you have actually tested
Backups that have never been restored are a hope, not a safeguard. Test a restore on a schedule and write down that you did.
8. A breach response plan
Decide in advance who gets called, who assesses the scope, who notifies, and against what deadlines. Nobody makes good decisions about notification timelines while the practice is in the middle of an incident.
9. Patient rights
Patients can request their records, request amendments, and get an accounting of disclosures. Know your response timelines and who handles the requests.
Where to start
If all of this is open, start with the risk analysis. It is the required item, and it tells you which of the rest matters most in your practice rather than in general.