HIPAA Compliance Checklist

How the HIPAA Security Rule is organized

The HIPAA Security Rule sits at 45 CFR 164.302 through 164.318, and a compliance checklist should follow its structure: administrative safeguards (164.308), physical safeguards (164.310), technical safeguards (164.312), organizational requirements such as business associate contracts (164.314), and policies and documentation (164.316) ¹.

Each safeguard is a standard, and most standards have implementation specifications marked either required or addressable ¹. Required means do it. Addressable means assess whether it is reasonable and appropriate for your practice; if it is not, write down why and adopt an equivalent measure where reasonable ¹. An addressable item you skip without a written reason is a gap.

The rule protects electronic PHI only. Paper charts and conversations fall under the Privacy Rule, which this checklist does not cover. For help choosing someone to carry this out, see HIPAA compliance services.

Administrative safeguards checklist (164.308)

Administrative safeguards are the management side of HIPAA security, and they hold the most required items ¹. Check each:

• Risk analysis (required). An accurate and thorough written assessment of risks to all ePHI ¹. Our cybersecurity risk assessment guide explains what a good one contains.
• Risk management (required). A plan that reduces the risks found to a reasonable level, with owners and dates ¹.
• Sanction policy (required). Written consequences for staff who break security policy ¹.
• Information system activity review (required). Regular review of audit logs, access reports and incident reports ¹.
• Assigned security responsibility. One named security official ¹.
• Workforce security (addressable items). Authorization or supervision, clearance procedures, and termination procedures that cut access on the last day ¹.
• Information access management. Access granted by role, and changed when roles change ¹.
• Security awareness and training (addressable items). Security reminders, protection from malicious software, log-in monitoring and password management ¹.
• Security incident procedures (required). Identify, respond to, mitigate and document incidents ¹. See incident response.
• Contingency plan. Data backup, disaster recovery and emergency mode operation plans are required; testing and an applications criticality analysis are addressable ¹.
• Evaluation. Periodic technical and nontechnical evaluation, including after operational or environmental changes ¹.
• Business associate contracts (required). A written contract or other arrangement with each business associate ¹.

Physical safeguards checklist (164.310)

Physical safeguards protect the rooms, workstations and devices where ePHI lives ¹. For a small office:

• Facility access controls. Addressable items: contingency operations, a facility security plan, access control and validation procedures, and maintenance records for repairs to doors and locks ¹. A locked server closet with a key log is a common answer.
• Workstation use. Written rules for what staff may do on computers that reach ePHI ¹.
• Workstation security. Physical protections such as screen placement away from waiting rooms and cable locks where needed ¹.
• Device and media controls. Disposal and media re-use are required: wipe or destroy drives, copiers and phones before they leave ¹. Accountability tracking and a backup copy before moving equipment are addressable ¹.

Old copiers and scanners with hard drives are a frequent blind spot. Put them on the device inventory and the disposal procedure.

Technical safeguards checklist (164.312)

Technical safeguards are the controls your IT provider configures, and each one should leave evidence you can show ¹:

• Unique user identification (required). No shared front-desk logins ¹.
• Emergency access procedure (required). A documented way to reach ePHI when normal systems are down ¹.
• Automatic logoff (addressable). Screen locks and session timeouts ¹.
• Encryption and decryption (addressable). Encrypt laptops, phones, servers and backups, or document an equivalent ¹.
• Audit controls. Logging that records activity in systems holding ePHI ¹.
• Integrity. Measures that show ePHI has not been altered or destroyed improperly ¹.
• Person or entity authentication. Proof that users are who they claim to be ¹. Multi-factor authentication is the usual answer, and in Microsoft's research it cut the risk of account compromise by 99.22% ⁹.
• Transmission security. Integrity controls and encryption for ePHI sent over networks, including email and remote access ¹.

The proposed 2025 rule would make encryption and MFA mandatory with limited exceptions, but it is not final ³⁴. Encrypted devices also matter for breaches: the notification rules apply to unsecured PHI ², so a lost laptop that is properly encrypted is a very different event from an unencrypted one. If your email runs on Microsoft 365, see Microsoft 365 support for the relevant settings.

Breach notification thresholds and deadlines

Under the Breach Notification Rule (45 CFR 164.400 to 164.414), the 500-person mark decides who else you must notify and when ²⁵:

The 60 days is an outer limit; the rule says "without unreasonable delay" ². OCR investigates all reported breaches of 500 or more individuals and may investigate smaller ones ⁷. HIPAA Journal's analysis of OCR data counts more than 700 large healthcare breaches in 2025 (772 by its main method) ⁶. State breach laws may add their own deadlines.

If a breach is happening now, call your cyber insurer's hotline first if you have a policy, report to the FBI at ic3.gov, and do not wipe or rebuild systems before evidence is preserved ⁸. Our incident response page covers the first hours.

HIPAA audit preparation

Preparing for a HIPAA audit or OCR investigation mostly means being able to produce documents quickly. The rule requires written policies, procedures and records of required actions, kept for 6 years from creation or the date last in effect, whichever is later ¹. Have these ready in one folder:

1. Your current risk analysis and the one before it, so you can show the analysis is periodic.
2. The risk management plan with completion dates.
3. Security policies and procedures, with version dates.
4. A list of business associates and their signed agreements.
5. Training records and security reminders sent.
6. Audit log review notes and access reports.
7. Incident and breach logs, including small breaches reported annually.
8. Backup and restore test results and the contingency plan.
9. Your reasoning for each addressable specification you met another way.

Recent settlements show what investigators look for. OCR cited the lack of an accurate and thorough risk analysis in its July 2026 ransomware settlement for $552,250 and its September 2026 phishing settlement for $700,000 ¹⁰¹¹. If your file has gaps, fix the risk analysis first. Practices that want a dry run often hire an outside review; see HIPAA compliance services, our healthcare IT page and our dental office IT page.

Proposed changes to watch (not yet law)

The January 2025 Security Rule proposal is still only proposed; HHS says the current rule remains in effect ⁴. If finalized as written, it would add items to this checklist ³:

• a written technology asset inventory and network map
• no more addressable category, so every specification becomes required
• mandatory encryption and MFA, with limited exceptions
• vulnerability scans every six months and a penetration test every 12 months
• a compliance audit every 12 months
• written procedures to restore certain systems and data within 72 hours

Compliance would be due 180 days after a final rule takes effect ¹². Building the inventory and network map now also speeds up any penetration test or backup and disaster recovery project. Confirm your own obligations with counsel when a final rule is published.