A HIPAA security checklist for a small practice

The HIPAA Security Rule applies to every covered practice that stores or transmits patient records electronically, regardless of size. It is written as a set of standards with required and addressable pieces, and the Department of Health and Human Services expects a small practice to meet them in a way that fits a small practice. Below is the practical version. The free Security Risk Assessment Tool from HHS and the Office of the National Coordinator is built for small and medium providers and is the right place to document most of it.

1. A written risk analysis

This is the one requirement enforcement actions cite most. Write down where patient data lives (practice software, email, imaging, backups, laptops, paper), who can reach each one, what could go wrong, and what you have done about it. Update it every year and whenever something changes. The HHS SRA Tool walks through it question by question.

2. Access controls

• Every person has their own login. No shared front desk account.
• Access is limited to what the role needs.
• Screens lock automatically when someone walks away.
• Former staff are removed the same day they leave, and a list of who has access is reviewed on a schedule.

3. Encryption

Encryption is addressable, which in practice means you do it or you document a very good reason not to. Encrypt every laptop and workstation, encrypt backups, and send patient information through the practice portal or encrypted email rather than plain attachments. An encrypted laptop that is stolen is a hardware loss. An unencrypted one is presumed to be a breach unless a documented risk assessment shows otherwise.

4. Backups and recovery

The rule asks for a data backup plan, a disaster recovery plan, and an emergency mode operation plan. For a small practice that means copies of records kept off-site, a test restore on a schedule with the date written down, and a short written note on how the office would see patients if the server died tomorrow.

5. Workforce training

Staff are trained on security awareness and on what to do when something looks wrong, with a record of who attended and when. Fake insurance portal logins and fake vendor invoices are the emails that hit practices.

6. Device and media controls

A list of every device that holds patient data, what happens when one is retired or reused, and how drives are wiped. Include phones if staff read email on them.

7. Business associate agreements

Any vendor that touches patient data on your behalf signs a BAA. The practice software company, the backup provider, the IT provider, and the billing service. Keep the signed copies.

8. Audit logs and review

The practice software logs who opened which record. Someone looks at those logs on a schedule, and the review is noted. Camera and door access logs for a records room help here too.

9. Physical safeguards

Workstations positioned so screens are not visible from the waiting room, a locked records room or cabinet, and a log of who can get in. A badge reader with an entry log is a clean way to meet this.

10. Policies and documentation

Everything above written down, dated, and kept for six years. It does not need to be long. It needs to match what the office actually does.

What this costs a small practice

Most of this list is fixed-price work. Separate logins, encrypted devices, a tested backup, a password manager, and a staff session with a sign-in sheet. The risk analysis is paperwork done with someone who knows the office. See our dental, medical, chiropractic, and therapy page for how we usually set this up, and the pricing page for the numbers.

This checklist summarizes the Security Rule and HHS guidance in plain words. It is not legal or compliance advice.