A HIPAA compliance checklist is only useful if it covers the systems where patient data actually lives. For most practices, that means email, the EHR, laptops, phones, backups, and the vendors who touch all of it. Policies matter, but the IT controls behind them are what auditors, insurers, and investigators look at first.
This checklist walks through the technology side of HIPAA for small and mid-sized healthcare organizations. It isn’t legal advice, and it doesn’t replace a formal risk analysis. It is a practical starting point for owners, practice administrators, and operations leaders who want to know where they stand.
What HIPAA Actually Requires From Your IT
HIPAA has three rules that shape day-to-day technology decisions. The Privacy Rule governs how protected health information (PHI) can be used and shared. The Security Rule sets standards for protecting electronic PHI (ePHI). The Breach Notification Rule spells out who you have to tell, and how fast, when something goes wrong.
The Security Rule is where IT lives. It groups its requirements into administrative, physical, and technical safeguards. Some are “required,” and others are “addressable,” which means you must implement them or document why an equivalent alternative is reasonable for your organization. Addressable does not mean optional.
A Note on the Proposed Security Rule Update
HHS has proposed a significant overhaul of the Security Rule that would tighten many of today’s addressable items, including encryption and multi-factor authentication. As of late 2026, it is still a proposal, and HHS’s regulatory agenda points to a final rule around mid-2027. Practices that build the controls below now will be in a much better position if and when it becomes final.
The HIPAA Compliance Checklist: Administrative Safeguards
Administrative safeguards are the decisions, documents, and routines that keep everything else working.
Complete a Security Risk Analysis
A documented risk analysis is required, and it is the first thing regulators ask for after a breach. It should identify where ePHI is stored, received, and transmitted, the threats to each system, and how likely and damaging each would be. HHS offers a free Security Risk Assessment Tool for smaller practices. Repeat the analysis at least annually and after major changes, such as a new EHR or an office move.
Assign a Security Official
Someone has to own HIPAA security. In a small practice, it is often the practice administrator, supported by an IT partner. What matters is that the role is named, documented, and has the authority to act.
Train Your Workforce
Staff need security awareness training when they are hired and regularly afterward. Phishing is the most common way attackers get into healthcare organizations, so training should include realistic examples and simulated phishing tests. Keep records of who completed what and when.
Sign Business Associate Agreements
Any vendor that creates, receives, stores, or transmits ePHI on your behalf is a business associate. That includes your IT provider, cloud backup service, email platform, and billing company. Each one needs a signed business associate agreement (BAA) before they touch patient data. Keep a current list and review it when vendors change.
Plan for Incidents and Outages
Document how you will respond to a security incident, and how you will keep seeing patients if systems go down. That means a written incident response plan, a data backup plan, a disaster recovery plan, and an emergency mode operations plan. Test them, even with a simple tabletop exercise.
Physical Safeguards
Physical safeguards protect the devices and spaces where ePHI is accessed.
- Facility access: Server closets and network equipment should be locked, with access limited to authorized staff.
- Workstation security: Screens in patient-facing areas should auto-lock and be positioned away from public view.
- Device and media controls: Track every laptop, tablet, and drive that holds ePHI. Wipe or destroy devices properly before disposal or reuse, and document it.
Technical Safeguards
Technical safeguards are the controls inside your systems. This is where most practices have the biggest gaps.
Access Controls
Every user needs a unique login. No shared accounts at the front desk. Give people access only to what their role requires, and remove access the same day someone leaves. Turn on automatic logoff for systems that handle ePHI.
Multi-Factor Authentication
Require multi-factor authentication (MFA) on email, remote access, the EHR, and any cloud app that holds patient data. Stolen and phished passwords are one of the most common ways attackers get in, and MFA stops most of those attempts cold. It is also one of the first things cyber insurance carriers ask about.
Encryption
Encrypt laptops, phones, and backups that hold ePHI, and use encrypted connections for email and file sharing that include patient information. Encryption is currently addressable, but it carries a major benefit: if a properly encrypted device is lost or stolen, it generally isn’t considered a reportable breach.
Audit Logs and Monitoring
HIPAA requires mechanisms to record and examine activity in systems that contain ePHI. Logging only helps if someone reviews it. Continuous monitoring, whether in-house or through a managed security provider, catches suspicious logins and unusual data access before they turn into a breach.
Patching and Endpoint Protection
Keep operating systems, applications, and medical-adjacent devices patched. Run modern endpoint protection on every workstation and server. Retire unsupported systems, or isolate them on the network if a clinical application still depends on them.
Backups You Can Actually Restore
Keep backups of ePHI offsite or in the cloud, with at least one copy protected from ransomware. Test restores on a schedule. A backup you have never restored is a hope, not a plan.
Breach Notification: Know the Clock
If unsecured PHI is breached, you must notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more people also require notice to HHS and, in many cases, the media within that same window. Smaller breaches are logged and reported to HHS annually. Details are on the HHS Breach Notification Rule page. Knowing the clock in advance is part of your incident response plan.
Documentation Ties It All Together
HIPAA requires you to keep your security policies, procedures, and related records for six years. If a control isn’t documented, regulators will assume it doesn’t exist. Store your risk analysis, training logs, BAAs, and incident records somewhere organized and easy to produce.
How Aldridge Helps Healthcare Organizations
Most practices don’t fall short on HIPAA because they don’t care. They fall short because the IT work is ongoing and nobody has time to own it. Aldridge works with healthcare organizations to handle the technical safeguards, from MFA and encryption to monitoring, patching, and tested backups, through our cybersecurity services. An IT audit and assessment is a good place to find the gaps on this checklist before someone else does.
If you’d like a second set of eyes on where your practice stands, the Aldridge team is happy to talk it through.