HIPAA compliance checklist for clinics: what it means and how to get there

Being HIPAA compliant means your practice follows the HIPAA Privacy, Security and Breach Notification Rules for every piece of protected health information (PHI) it handles, and can prove it with documentation. You can't buy compliance as a product or certificate. It is a program you run: assign owners, analyze risk, write policies, sign business associate agreements (BAAs), train staff, and repeat. The checklist below follows the rules HHS enforces. Every regulatory detail is marked for verification. Use this page as a working guide, not legal advice, and confirm decisions with your privacy officer or healthcare counsel.

What does HIPAA compliant mean?

A HIPAA-compliant organization follows the HIPAA Privacy Rule, Security Rule and Breach Notification Rule for the PHI it creates, receives, maintains or transmits. PHI is individually identifiable health information. It includes a patient's name next to an appointment type, a scanned insurance card, or a voicemail about lab results.

Compliance is an ongoing state. A practice that did a risk analysis three years ago, then added a second location, a new phone system and a new billing vendor, may no longer meet the requirements. You have to maintain compliance and document it as things change.

There is no official HIPAA certification. HHS does not certify organizations or products, and there is no "HIPAA approved" status. Some vendors and trainers sell "HIPAA certificates." These show that someone completed a course or a third-party assessment. They are not a government endorsement. When a software vendor says its product is "HIPAA compliant," it usually means two things:

• It will sign a BAA with you.
• It provides safeguards, such as access controls and encryption, that you can configure to meet your obligations.

The vendor's compliance and your practice's compliance are separate questions.

HIPAA and HITECH. The HITECH Act added the breach notification requirements and strengthened enforcement. That included higher penalties and making business associates directly liable for parts of HIPAA. "HIPAA HITECH compliant" generally means meeting HIPAA as amended by HITECH and the rules that followed.

Signs your practice is not compliant:

• No documented security risk analysis, or one that predates your current systems.
• Staff text patient names, schedule changes or photos of documents through personal phones and group chats.
• No signed BAAs with your IT provider, cloud storage, phone or billing vendors.
• Shared logins at the front desk ("everyone uses frontdesk1").
• New hires start work before they complete privacy and security training, or no one tracks who was trained.
• Former employees still have working accounts.

Who has to be HIPAA compliant?

HIPAA applies to two groups.

Covered entities. These are health plans, healthcare clearinghouses, and healthcare providers that conduct certain standard transactions electronically, such as submitting claims or checking eligibility. Most medical, dental, therapy and multi-location practices that bill insurance fall into this group.

Business associates. These are people or companies that create, receive, maintain or transmit PHI on behalf of a covered entity. Examples include billing companies, MSPs and IT contractors, cloud hosting providers, and SaaS companies whose products store PHI. Subcontractors of business associates are covered too. A SaaS company "becomes HIPAA compliant" by implementing the Security Rule safeguards, signing BAAs with its customers and its own subcontractors, and maintaining the same documentation a practice would.

Edge cases people ask about:

• Therapists and counselors. Coverage usually depends on whether the practice conducts standard electronic transactions, including transactions a billing service sends on its behalf. Many therapists who bill insurance are covered entities. For the details, see does HIPAA apply to therapists.
• Cash-only practices. A provider that never conducts standard electronic transactions may fall outside the covered entity definition. Coverage can change the first time you or a vendor submits an electronic claim. State privacy laws may still apply.
• Med spas and massage therapists. It depends on the services offered, whether licensed healthcare providers deliver care, and how billing works. A med spa that offers physician-supervised treatments and bills electronically looks different from a cash-only massage studio.
• Dental offices. These are treated the same as other providers. If you bill electronically, you are almost certainly a covered entity.

Ask counsel to confirm your status rather than assuming you are exempt.

When you need to comply: from the moment you create, receive, maintain or transmit PHI in a covered entity or business associate role. There is no grace period for new practices.

The HIPAA compliance checklist (step by step)

Work through these steps in order. Keep a dated record of each one.

1. Designate a privacy officer and a security officer. In a small office, one person can hold both roles. Write down who owns what: patient requests, vendor contracts, device management, incident response.

2. Run and document a security risk analysis. Identify where ePHI lives and moves: EHR, practice management system, email, phones, fax, laptops, backups, staff chat. Then record threats, vulnerabilities, likelihood and impact. HHS offers a free security risk assessment tool for smaller practices. Turn the findings into a risk management plan with owners and dates. Repeat the analysis on a set schedule and whenever systems change. Some practices use dedicated platforms for this work. See HIPAA compliance software compared.

3. Write policies and procedures. At minimum, cover:

   • Access control and the minimum necessary standard.
   • Device and remote-work use.
   • Workforce sanctions.
   • Incident response.
   • Documentation retention for the period the rule requires.

   Policies should describe what your staff actually do. "Front desk confirms identity with two identifiers before discussing an account" is useful. "We protect privacy" is not.

4. Inventory every system and vendor that touches PHI. List each one with its owner, what PHI it holds, and whether a BAA is signed. Sign the BAA before any PHI is shared, not after the trial period. Phones and website chat count too: see HIPAA-compliant phone systems and HIPAA-compliant live chat for websites.

5. Train every workforce member. Train staff at onboarding and periodically after that. This includes part-time staff, students and temps. Keep sign-in sheets or completion records. For what to cover, see HIPAA training requirements.

6. Set up breach response. Define how staff report a suspected incident, how you assess it (including the risk assessment), who decides on notification, and where you log it. The rule sets deadlines and thresholds for notifying individuals, HHS and, for larger breaches, the media.

7. Publish a Notice of Privacy Practices and handle patient access requests. Post the notice, provide it to patients, and set up a process for access requests, with a log, so you meet the response deadline.

To skip drafting from a blank page, start from our free HIPAA templates.

The HIPAA Security Rule in plain terms

The Security Rule covers electronic PHI (ePHI). It requires you to protect the confidentiality, integrity and availability of that data. It groups requirements into three types of safeguards.

Safeguard type	What it covers	Clinic examples
Administrative	Risk analysis and management, workforce security, training, contingency planning	Documented risk analysis, onboarding and offboarding checklists, a backup and downtime plan for when the EHR is unavailable
Physical	Facility access, workstation use and security, device and media controls	Locked server closet, screens not visible from the waiting room, a process for wiping old laptops and copier drives
Technical	Access control, unique user IDs, audit controls, integrity, authentication, transmission security	Individual logins, automatic logoff, reviewed access logs, MFA, encrypted connections

Required vs. addressable. Each standard has implementation specifications. Some are "required." Others are "addressable." Addressable does not mean optional. For each addressable specification, you must:

• assess whether it is reasonable and appropriate for your practice, and
• either implement it, or document why not and what equivalent measure you chose instead.

HHS has proposed changes to the Security Rule. If finalized, the proposal would remove much of the required/addressable distinction and make several safeguards, including encryption, mandatory. Check the current status before you finalize policies.

HIPAA encryption requirements

Under the current rule, encryption of ePHI at rest and in transit are addressable implementation specifications. In practice, most organizations encrypt anyway. Few can document a reasonable alternative to encrypting a laptop that leaves the building.

There is also a strong practical reason to encrypt. If PHI is encrypted in line with HHS guidance, it may not count as "unsecured" PHI. A lost device may then fall under the breach notification safe harbor.

Encryption checklist:

• Full-disk encryption on every laptop, desktop and phone that can access PHI, including personal phones used for work.
• Encrypted email or a patient portal for sending PHI outside the practice.
• TLS for data in transit to web apps, cloud systems and between locations.
• Encrypted backups, both on-site and off-site.
• Key management: who holds the keys, where recovery keys are stored, and what happens when the person who set it up leaves.

What to ask encryption software and SaaS vendors:

• What is encrypted: data in transit, data at rest, uploaded files, backups?
• Which standards and protocols do you use?
• Who holds the encryption keys?
• Will you sign a BAA, and what does it cover?

Encryption alone does not make a tool or a practice compliant. An encrypted system with shared logins, no BAA and no access policy still fails the Security Rule.

Choosing HIPAA-compliant IT services and support

An MSP or IT provider that can access ePHI is a business associate. That includes remote access to workstations, servers or backups. The provider should sign a BAA before work starts.

Questions to ask an IT provider:

• Will you support our security risk analysis and help with the remediation plan?
• How and how often do you apply patches to workstations, servers and network devices?
• How do you handle backups, and when did you last test a full restore?
• Do you enforce full-disk encryption and MFA on every endpoint and account?
• What do you log, how long do you keep logs, and who reviews them?
• What is your offboarding process for our departing staff, and for your own technicians?
• What is your response time for a suspected security incident, and who calls us?
• Will you sign our BAA, or provide yours for counsel to review?

Is a penetration test required? The current Security Rule does not explicitly name penetration testing. Testing does support a credible risk analysis and evaluation of your safeguards. HHS's proposed Security Rule changes include vulnerability scanning and penetration testing requirements, so check their current status.

Local vs. remote providers. HIPAA rules are the same in every city. A provider's location matters less than a signed BAA, documented processes and references from other healthcare clients. On-site support can help with hardware. It does not replace the questions above. Your state may add its own requirements.

Staying compliant: ongoing tasks for practice managers

Most compliance failures happen after the initial project ends. Put these on a shared calendar with a named owner. The cadence below is a common starting point. Your risk analysis and counsel should set the actual schedule.

Task	Suggested cadence	Owner
Review security risk analysis	Annually and after major system changes	Security officer
Refresh staff training	Annually, plus when policies change	Privacy officer
Review user access in each system	Quarterly	Practice administrator
Check BAA inventory against vendor list	Annually and when adding vendors	Practice administrator
Review policies and procedures	Annually	Privacy and security officers
Test backup restore and downtime plan	At least annually	IT provider

Offboarding. Revoke access to every system on the same day someone leaves. Cover the EHR, email, phone system, staff chat, shared drives and building access. Keep a single checklist so nothing is missed at a second location.

Watch for shadow IT. When official tools are slow or missing, staff improvise. A medical assistant texts a coworker that "Mrs. R in room 3 needs a callback about her biopsy." A group chat on personal phones becomes the place where schedule swaps and patient questions get sorted. Find out what staff actually use and give them an approved option. See HIPAA rules for texting.

Keep evidence. If OCR investigates, compliance work you didn't document is treated as if it wasn't done. Date and keep risk analyses, training records, signed BAAs, access reviews and incident logs.

For related topics, browse more HIPAA and healthcare communication guides.

Where staff communication fits in your checklist

Internal staff messaging belongs in your system inventory like any other tool. If messages, files or voice notes can contain PHI, the tool needs:

• a signed BAA,
• access controls such as individual accounts, roles and MFA, and
• a written policy on what staff may share there.

Chanty is one example. It is HIPAA-compliant internal team chat for clinic and practice staff, used for operational coordination alongside your EHR and clinical systems. It is not a patient messaging or clinical tool. Chanty supports HIPAA compliance with a signed BAA on the Business and Enterprise plans, covering messages, files, voice notes, tasks and Teambook in the team space. The Free plan has no BAA and should not hold PHI. Third-party integrations are outside Chanty's BAA scope, so evaluate each one separately. See Chanty security, HIPAA and BAA details.

Signing a BAA with a chat vendor does not complete your obligations. The practice still configures roles and permissions, manages access and same-day offboarding, secures devices, and trains staff on what belongs in chat. To check other options, see which team chat tools sign a BAA.

FAQ

What does it mean to be HIPAA compliant?

It means your organization follows the HIPAA Privacy, Security and Breach Notification Rules for the PHI it handles, and keeps documentation that shows it. That includes a current risk analysis, written policies, signed BAAs, staff training and a breach response process. You maintain it continuously. It is not a one-time project.

Is there an official HIPAA certification or "HIPAA approved" label?

No. HHS does not certify organizations or products. Third-party certificates or assessments can show effort. They do not mean HHS has approved anything.

How do I become HIPAA compliant as a small medical office?

Start with the seven steps above:

1. Name a privacy and security officer.
2. Complete a risk analysis, for example with the free HHS security risk assessment tool.
3. Write policies.
4. Sign BAAs with every vendor that touches PHI.
5. Train staff.
6. Set up breach response.
7. Publish your Notice of Privacy Practices.

A small office can do this with one owner and an IT provider. Have counsel review the result.

Does HIPAA apply to therapists and med spas?

It often does, but it depends on whether the practice conducts standard electronic transactions and what services it provides. Therapists who bill insurance are usually covered entities. Confirm your status with counsel.

Does HIPAA require encryption?

Under the current Security Rule, encryption at rest and in transit are addressable specifications. You must implement encryption, or document why not and what equivalent measure you use. Proposed Security Rule changes would make encryption mandatory if finalized, so check their current status. Encryption that meets HHS guidance may also keep a lost device out of breach notification.

Do you need a penetration test to be HIPAA compliant?

The current rule does not explicitly require one. A penetration test does strengthen your risk analysis and evaluation. The proposed rule changes would add penetration testing and vulnerability scanning requirements if finalized.

Does my IT provider need to sign a BAA?

Yes, if the provider can access ePHI, including through remote support, managed backups or server administration. That makes it a business associate. Get the BAA signed before the provider starts work.

Can a software product make my practice HIPAA compliant?

No. Software can provide safeguards and a vendor can sign a BAA, but compliance depends on your own program. That means your risk analysis, policies, access management, training and documentation. Be cautious of any product that claims to make you compliant on its own.

How often should we do a HIPAA risk analysis?

The rule requires an accurate and thorough risk analysis and ongoing review, without fixing a single interval. Many practices review it annually. Update it whenever you add a location, change major systems or onboard a new vendor that handles PHI.