HIPAA compliance checklist for small practices

What is a HIPAA compliance checklist?

Each line comes from 45 CFR Part 164 or from Florida’s breach statute; record retention has its own section below.

Source: eCFR, 45 CFR Part 164 (current as of Oct 19, 2026); HHS model notices (February 2026); s. 501.171, Florida Statutes (2026).

What belongs on a HIPAA Privacy Rule checklist?

• The notice of privacy practices. Each use and disclosure it describes must reflect a stricter law, “such as 42 CFR part 2” (164.520(b)(1)(ii)(C)–(D)). HHS’s revised February 2026 model notices come in three versions: health care provider, health plan and Part 2 patient notice; a Part 2 program that is also a covered entity may combine them (substance use programs).
• Every revision, posted again. A revised notice must be available on request from its effective date and promptly re-posted in the office and online (164.520(c)(2)(iv), (c)(3)).
• Who counts as workforce. Training covers every workforce member (164.530(b)), and OCR’s audit protocol counts on-site contractors, students and volunteers (compliance training).

What’s on a HIPAA Security Rule compliance checklist for IT?

The three safeguard sections hold 18 standards: 9 administrative (164.308), 4 physical (164.310) and 5 technical (164.312). Under them sit 36 implementation specifications: 21 administrative (10 required), 8 physical (2 required) and 7 technical (2 required), which leaves 22, or 61%, “Addressable”.

The 14 required ones: risk analysis; risk management; a sanction policy; information system activity review; security incident response and reporting; data backup, disaster recovery and emergency mode operation plans; a written business associate contract; media disposal and re-use; unique user identification; an emergency access procedure; and, for clearinghouses only, isolating clearinghouse functions.

Beyond unique user IDs and emergency access, the technical list your IT vendor works from (164.312) is addressable: automatic logoff, encryption, a mechanism showing ePHI wasn’t altered or destroyed, and integrity controls and encryption for ePHI sent over a network. Audit controls and person or entity authentication have no separate specifications: you meet each standard as written (164.306(c)).

“If implementing the implementation specification is not reasonable and appropriate— (1) Document why it would not be reasonable and appropriate to implement the implementation specification; and (2) Implement an equivalent alternative measure if reasonable and appropriate.”

A one-neurologist practice with five staff paid $25,000 and took on a corrective action plan (listed April 25, 2025) after a ransomware attack that may have affected 6,800 people; OCR’s finding was no “accurate and thorough risk analysis”.

Which breach notification requirements go on a HIPAA compliance checklist?

The four factors behind the breach presumption (164.402) and what each notice must say are on our HIPAA compliance services page. The clocks:

Florida’s statute also says:

• Health data it protects: a name with any medical history, condition, treatment or diagnosis, or with a health insurance policy or subscriber number (s. 501.171(1)(g)).
• 15 more days for the patient notice, on written good cause given to the Department within the first 30 (s. 501.171(3)(a)).
• Federal rules: notice that follows your primary or functional federal regulator’s rules is deemed to meet the patient notice, and a copy timely sent to the Department is deemed to meet the Department notice (s. 501.171(4)(g)); whether that covers your breach is your attorney’s call.
• Credit bureaus: notifying more than 1,000 people at a single time also means notifying the nationwide consumer reporting agencies (s. 501.171(5)).
• Agents: a contractor may send the notices for you, but “an agent’s failure to provide proper notice shall be deemed a violation of this section against the covered entity” (s. 501.171(6)(b)).

How long do you keep the records on a checklist for HIPAA compliance?

• HIPAA documents: 6 years from creation or the date last in effect, whichever is later (164.530(j)(2); 164.316(b)(2)(i)). A policy retired on March 1, 2027 stays on file until March 1, 2033.
• Physicians’ charts: “at least five years from the last patient contact” (Rule 64B8-10.002(2)).
• Therapists’ charts: LCSWs, LMFTs and LMHCs, interns included, keep “A full record of services” for 7 years after the last contact (Rule 64B4-9.001(2); therapy practices).

How do you run an internal HIPAA compliance audit checklist?

OCR’s own audit protocol (updated July 2018) lists 180 audit inquiries.

Its instructions: send only the documents requested (“The auditor will not search for relevant documentation” in a binder of every policy); send the versions in use on the date of the audit notice; and replace a missing sample with instances from an equivalent earlier period, or a statement that none exist.

Test first what complaints allege most often, in OCR’s order since 2003: impermissible uses and disclosures, missing safeguards for PHI, lack of patient access, missing administrative safeguards for ePHI, and more than the minimum necessary (as of Oct 31, 2024). For access, compare each request’s date received with its date answered; an extension needs a written reason and a completion date sent within the first 30 days (164.524(b)(2)(ii)). Related: your compliance program and audit readiness.

What would the proposed rule add to a HIPAA security requirements checklist?

Nothing until it is final: the January 6, 2025 proposal (90 FR 898) is the only document under its number in the Federal Register, the federal agenda lists the final rule for July 2027, and HHS says “the current Security Rule remains in effect”. As proposed, it would add:

• every implementation specification required, with limited exceptions, and written documentation of all policies, plans and analyses;
• a technology asset inventory and a network map, updated at least every 12 months;
• written procedures to restore certain systems and data within 72 hours;
• a compliance audit at least every 12 months;
• encryption of ePHI at rest and in transit, and multi-factor authentication, each with limited exceptions;
• vulnerability scans at least every 6 months and penetration tests at least every 12 months;
• notice to certain regulated entities within 24 hours when a workforce member’s access changes or ends.

What you can do today with this HIPAA checklist

1. Name your privacy official, complaint contact and security official in a dated memo (164.530(a)(2); 164.308(a)(2)).
2. Download HHS’s February 2026 health care provider model notice, fill in your details, and replace the copies at the front desk and on your website; keep the old one for 6 years.
3. Install HHS’s Security Risk Assessment Tool v3.7 for Windows, or open its Excel workbook, and list where ePHI lives: EHR, billing, email, phones and backups. The tool keeps your entries on your computer.
4. Write one line for each of the 22 addressable specifications: implemented, or why not and the equivalent.
5. Start an access-request log with three dates: received, due (30 days later) and answered.
6. Collect a signed agreement from every vendor that holds PHI, and check its breach-notice deadline against the chart.

If you’d rather hand it off, we develop, review and update HIPAA policies and procedures, develop and review patient notices, and coordinate HIPAA training: see our HIPAA compliance services.