Is My Practice HIPAA Compliant? A Practical Checklist

“Is my practice HIPAA compliant?” is one of the most common questions we hear from small outpatient practices — and usually the honest answer is: partially, with gaps nobody’s gotten around to closing. HIPAA compliance isn’t a single certificate you earn once; it’s an ongoing set of administrative, physical, and technical safeguards. This checklist covers the technical and IT-related side, which is where we see the most gaps in practices that haven’t had a dedicated IT partner.

This is a practical starting point, not legal advice — a full HIPAA risk assessment should be done with a qualified compliance professional.

IT and technical safeguards checklist

• Risk assessment completed in the last 12 months — HIPAA requires an ongoing risk analysis, not a one-time exercise.

• Multi-factor authentication (MFA) enabled on email, EHR access, and any system that touches patient data.

• Role-based access controls — staff can only access the patient data their job actually requires.

• Data encrypted at rest and in transit — on servers, workstations, laptops, and backups.

• Backups tested, not just scheduled — a backup you haven’t tried restoring isn’t a backup you can rely on during a ransomware incident.

• A documented incident response plan — who does what in the first hour of a breach or ransomware attack.

• Business Associate Agreements (BAAs) signed with every vendor that touches PHI — your EHR vendor, your IT provider, your cloud storage, your answering service.

• Email security and phishing protection in place — phishing remains the most common way healthcare breaches start.

• Device management for laptops and mobile devices — remote wipe capability if a device is lost or stolen.

• Audit logs reviewed periodically — who accessed what patient record, and when.

• Staff security awareness training, done at least annually, not just at onboarding.

• A current inventory of where PHI lives — EHR, email, billing software, backups, any third-party portal.

Where small practices usually fall short

In our experience, the most common gaps aren’t exotic — they’re basic things nobody assigned ownership of: backups that were set up once and never tested, a BAA that was never actually signed with a long-standing vendor, or MFA that’s enabled for the practice’s main system but not for email, which is often the easiest way in for an attacker.

How this connects to your EHR choice

If your practice is evaluating or switching EHR systems, HIPAA compliance should be part of that decision, not an afterthought bolted on later. See our EHR selection guide for small outpatient practices for what to look for.

Want an actual answer, not just a checklist?

A checklist tells you what to look for; it doesn’t tell you where your practice actually stands. UpsiteGroup offers a straightforward HIPAA-focused IT risk assessment for small practices — contact us or try our HIPAA risk assessment tool.