HIPAA compliance checklist
Sixteen core requirements for a small practice, each with the regulation that creates it, so you can check the source yourself. Completing a checklist is not the same as being compliant — it is a way to find gaps.
Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on .
Policies, people, and paperwork
- Designate a privacy official and a security official45 CFR 164.530(a); 164.308(a)(2). One person can hold both roles in a small practice.
- Write policies and procedures, and keep them six years164.530(i)–(j); 164.316.
- Train every workforce member, and document it164.530(b); 164.308(a)(5).
- Apply sanctions for workforce violations164.530(e); 164.308(a)(1)(ii)(C).
- Have a complaint process, with no retaliation164.530(d) and (g).
- Sign a business associate agreement with every vendor that handles PHI164.502(e); 164.504(e); 164.308(b).
Patients’ rights
- Give and post a notice of privacy practices164.520.
- Answer records requests within 30 days164.524. One 30-day extension is allowed with written notice.
- Handle amendment and accounting requests164.526; 164.528.
Security of electronic PHI
- Complete and document a risk analysis164.308(a)(1)(ii)(A). The foundation for everything below.
- Act on it with a risk management plan164.308(a)(1)(ii)(B).
- Give each user a unique login and limit access by role164.312(a); 164.308(a)(4).
- Log and review system activity164.312(b); 164.308(a)(1)(ii)(D).
- Assess encryption for data at rest and in transit164.312(a)(2)(iv) and (e)(2)(ii) — addressable, so document the decision.
- Back up data and plan for emergencies164.308(a)(7).
- Control devices and media, including disposal164.310(d).
And when something goes wrong
Have a written breach response procedure: how staff report an incident, who runs the four-factor risk assessment, and how you will meet the 60-day notification deadline (45 CFR 164.400–414). See the breach notification guide.
Common questions
- Is there an official HIPAA compliance checklist?
- No. HHS does not publish a single official checklist. It publishes guidance, the regulation itself, and tools such as the Security Risk Assessment Tool. Any checklist, including this one, is a summary.
- Can a vendor certify us as HIPAA compliant?
- There is no government HIPAA certification. A third party can assess your practices, but OCR does not recognise any certificate as proof of compliance.
- What should a small practice do first?
- The risk analysis. OCR enforcement repeatedly cites its absence, and the rest of the Security Rule is built on it.
Sources
- 45 CFR § 164.530 — Administrative requirements (opens in a new tab) — Electronic Code of Federal Regulations
- 45 CFR § 164.308 — Administrative safeguards (opens in a new tab) — Electronic Code of Federal Regulations
- 45 CFR § 164.312 — Technical safeguards (opens in a new tab) — Electronic Code of Federal Regulations
- 45 CFR § 164.524 — Access of individuals to PHI (opens in a new tab) — Electronic Code of Federal Regulations
- 45 CFR § 164.520 — Notice of privacy practices (opens in a new tab) — Electronic Code of Federal Regulations
- Guidance on Risk Analysis (opens in a new tab) — HHS Office for Civil Rights
- Security Risk Assessment Tool (opens in a new tab) — HHS Office of the National Coordinator for Health IT / OCR
Questions about this page
Ask about anything explained here, or tell us if a citation is out of date. We can point you to the HHS source; we cannot advise on your organisation’s obligations. Do not send protected health information through this form.
Get in touch
Last reviewed against the Code of Federal Regulations (45 CFR Parts 160 and 164) and HHS OCR guidance linked on this page on .
Every requirement on this page is cited to the regulation or to HHS guidance. If you find one that has changed, tell us and we will correct it.