HIPAA IT Compliance Checklist for Small Medical and Dental Practices

A HIPAA IT compliance checklist gives a small medical or dental practice a concrete path through the HIPAA Security Rule: run a risk analysis, control access, turn on MFA, encrypt patient data, test backups, sign BAAs, train staff, plan for incidents, and keep audit logs. Work those nine controls and you cover the Rule's technical core.

The Security Rule is the part of HIPAA that requires administrative, physical, and technical safeguards for electronic protected health information (ePHI), and it applies to practices of every size. The stakes are not abstract: 276,775,457 healthcare records were breached in 2024 across 725 large reported incidents, per HIPAA Journal's 2024 Healthcare Data Breach Report, including roughly 190 million people affected by the Change Healthcare ransomware attack alone, the largest healthcare breach on record. Healthcare also remained the most expensive industry for breaches at $6.64 million per incident, per IBM's 2026 Cost of a Data Breach report.

What does the HIPAA Security Rule require right now?

Today's Rule requires a documented risk analysis, a designated security official, workforce training, access and audit controls, integrity and transmission security measures, contingency planning with data backup, incident response procedures, and written business associate agreements, per HHS's Security Rule summary. Our HIPAA compliance consulting covers the risk analysis, the safeguards and the documentation behind them.

Some specifications, including encryption, are labeled "addressable." HHS is blunt that addressable does not mean optional: a practice must implement the measure if it is reasonable and appropriate, and otherwise must document why not and adopt an equivalent alternative. For a small practice with modern hardware, it is very hard to argue that encryption is not reasonable and appropriate.

What belongs on a HIPAA IT compliance checklist?

1. Security risk analysis, done and dated. The foundation of the Rule and the first thing investigators request. Assess where ePHI lives, what threatens it, and what you are doing about each risk; refresh it annually and after major changes like a new EHR. HHS's Office for Civil Rights launched a Risk Analysis Initiative in October 2024 specifically to enforce this requirement.
2. Access controls with unique user IDs. Every staff member gets their own login, scoped to their role. Shared front-desk accounts destroy accountability, and departed employees should lose access the day they leave.
3. Multifactor authentication (MFA). Enable it on email, the EHR, VPN, and anything reachable from the internet. The current Rule requires authentication procedures without naming MFA; the proposed update would require MFA explicitly, and insurers already expect it.
4. Encryption at rest and in transit. Full-disk encryption on every laptop and workstation (BitLocker, FileVault), encrypted transmission for anything carrying ePHI, and no patient data over plain personal texting apps.
5. Tested, separated backups. The Rule's contingency planning standard requires retrievable copies of ePHI. Keep at least one backup copy isolated from your network, and prove restores actually work before ransomware runs the test for you.
6. Business associate agreements (BAAs). A signed BAA for every vendor touching ePHI: EHR, billing service, clearinghouse, email platform, cloud storage, and your IT provider. Keep an inventory so nothing is missed.
7. Security awareness training. Required for the whole workforce, including physicians. Cover phishing, password handling, and PHI hygiene, and document who completed it and when.
8. Incident response plan. Written procedures for who isolates systems, who gets called, and how breach notification duties get met, printed somewhere reachable when systems are down.
9. Audit logs, kept and reviewed. The Rule's audit controls standard requires mechanisms that record activity in systems containing ePHI. Keep EHR and Microsoft 365 logging enabled and review it, since logs nobody reads only tell the story after the damage.

What would change under the proposed Security Rule update?

In December 2024, HHS proposed a sweeping overhaul of the Security Rule; the notice of proposed rulemaking (NPRM) was published in the Federal Register on January 6, 2025, and its comment period closed March 7, 2025. It remains a proposed rule, not law: as of October 10, 2026 no final rule has been issued, and HHS's entry in the federal Unified Agenda (RIN 0945-AA22) lists the rule among long-term actions, with final action projected for July 2027. The current Security Rule stays fully in effect in the meantime.

Control area	Current Security Rule (in force)	Proposed update (not final)
Encryption of ePHI	Addressable: implement if reasonable and appropriate, or document an equivalent alternative	Required at rest and in transit, with limited exceptions
Multifactor authentication	Not named; authentication procedures required	Required, with limited exceptions
Asset inventory and network map	Not an explicit standard	Required, reviewed at least every 12 months and after changes
Backup and recovery	Backup and contingency procedures required	Written procedures to restore certain systems and data within 72 hours
Security testing	Periodic evaluation required	Penetration testing at least annually; vulnerability scans every six months
Required vs. addressable	Distinction exists	Distinction removed; specifications required with limited exceptions

Details above are from HHS's NPRM fact sheet. The practical read for a small practice: everything in the proposal is already best practice, so building toward it now means the eventual final rule, whatever its exact shape, arrives as a formality rather than a scramble. An annual penetration test is a sensible head start, since the proposal would make one mandatory.

Where do small practices fall short on HIPAA IT compliance?

Overwhelmingly, on the first checkbox. When OCR audited covered entities in 2016 and 2017, only 14% were substantially fulfilling their risk analysis obligations, per OCR's published audit findings, and the Risk Analysis Initiative has produced a steady stream of settlements since its October 2024 launch. The pattern in those enforcement actions is consistent: a breach happens, OCR investigates, and the practice cannot produce a current, thorough risk analysis. It can be done: in a published engagement, a seven-location medical practice had zero findings on the infrastructure portion of its next compliance review.

The fix is unglamorous: schedule the risk analysis, remediate what it finds, and keep the paper trail. Most small practices get there fastest with help, because nobody on staff owns security full time. The NetSys Group has supported medical and dental practices across the New York metro area since 1998, and its security assessments map directly to the risk analysis and safeguard documentation OCR asks for.

HIPAA IT compliance checklist: the records to keep

Print this table or copy it into the practice's compliance binder. Each line is one control and the record that shows it is in place.

Control	Record to keep on file	Done
Security risk analysis	The dated analysis and a remediation plan with an owner for each item	☐
Unique logins and role-based access	A user list with each person's role, and dated removals for leavers	☐
Multifactor authentication	An MFA report covering email, the EHR, VPN and remote access	☐
Encryption at rest and in transit	BitLocker or FileVault status for every device, and your email encryption settings	☐
Tested, separated backups	Backup job reports and the date and result of the last test restore	☐
Business associate agreements	A signed BAA for every vendor that touches ePHI, listed in one inventory	☐
Security awareness training	Completion records by person and date, physicians included	☐
Incident response plan	The written plan, the call list and a printed copy kept off the network	☐
Audit logs	Proof that EHR and Microsoft 365 logging is on, and notes from each review	☐

This is general information, not legal advice. A HIPAA compliance audit checks each line against your actual systems.

HIPAA compliance paperwork: the documents a practice keeps

The Security Rule asks for more paper than most practices expect. It requires written policies and procedures, a written record of every action, activity or assessment the Rule says to document, and retention of that documentation for six years from the date it was created or the date it was last in effect, whichever is later (45 CFR 164.316(b)(2)). A practice should be able to produce each of these on request:

Document	What it shows	Where the Rule asks for it
Security policies and procedures	How the practice meets each standard, with changes documented as they happen	164.316(a) and (b)(1)
Risk analysis and risk management plan	The dated assessment of risks to ePHI and the measures chosen to reduce them	164.308(a)(1)(ii)(A) and (B)
Sanction policy	What happens to workforce members who do not follow the security policies	164.308(a)(1)(ii)(C)
Information system activity review	The procedure for regularly reviewing audit logs, access reports and security incident tracking reports, and a record of each review	164.308(a)(1)(ii)(D)
Security official designation	The named person responsible for the security policies and procedures	164.308(a)(2)
Security incident procedures and incident log	How incidents are identified, answered and mitigated, and each incident with its outcome	164.308(a)(6)
Contingency plan	The data backup plan, disaster recovery plan and emergency mode operation plan, and the procedures for testing and revising them	164.308(a)(7)
Business associate agreements	A signed agreement with each vendor that creates, receives, maintains or transmits ePHI for you	164.308(b) and 164.314(a)
Training records	The awareness and training program for the whole workforce, management included, and who completed it when	164.308(a)(5); the Privacy Rule also requires documenting that training was provided (164.530(b))
Device and media disposal records	How ePHI is removed before media is reused or disposed of, and a record of where hardware and media went	164.310(d)
Periodic evaluation	The technical and nontechnical review of whether the policies still meet the Rule	164.308(a)(8)

Keep each version, not only the current one. The six-year clock runs from the date a document was last in effect, so a policy you replaced last year still has to be on file. The Rule also requires that the documentation be available to the people who carry it out and that it be reviewed periodically and updated when your environment changes.

Frequently asked questions

Is encryption mandatory under HIPAA right now?

Under the current Security Rule, encryption is an addressable specification: you must implement it if reasonable and appropriate, or document why not and use an equivalent measure, per HHS. The 2025 proposed rule would make encryption of ePHI mandatory with limited exceptions, but as of October 2026 that proposal has not been finalized.

Does HIPAA require multifactor authentication today?

Not by name. The current Rule requires procedures to verify that people seeking access to ePHI are who they claim to be, and MFA is the accepted modern way to meet that bar. HHS's proposed Security Rule update would require MFA explicitly, with limited exceptions, with final action now projected for July 2027.

How often does a practice need a HIPAA risk analysis?

The Security Rule requires an accurate and thorough assessment and expects it to stay current, without naming a calendar interval. In practice, most practices run one annually and after significant changes such as a new EHR, a new location, or a merger. Documented remediation of what the analysis finds matters as much as the analysis itself.

What HIPAA forms does a small practice need?

The patient-facing forms are legal documents, so we point practices to HHS and their attorney rather than publish templates. The two most practices use are the Notice of Privacy Practices and the authorization form. A provider gives the notice to each patient no later than the first service, posts it in the office and on the practice website if it has one, makes a good-faith effort to get a written acknowledgment, and keeps copies of the notices and acknowledgments (45 CFR 164.520). HHS publishes model notices of privacy practices that a practice adapts with its own details. An authorization must contain the core elements and statements listed in 45 CFR 164.508(c), be written in plain language, and be given to the patient as a signed copy. Have your attorney or EHR vendor review whichever versions you adopt; our part is the Security Rule paperwork above.

What are the HIPAA compliance requirements?

Three rules do most of the work for a practice. The Privacy Rule governs how patient information may be used and shared, which is mostly policy for your privacy officer and counsel. The Security Rule requires administrative, physical and technical safeguards for ePHI, starting with the risk analysis; the checklist above covers its IT side. The Breach Notification Rule requires notice to affected patients without unreasonable delay and no later than 60 calendar days after a breach is discovered, notice to HHS (at the same time for breaches of 500 or more people, and within 60 days after year end for smaller ones), and notice to prominent media when more than 500 residents of a state are affected, per 45 CFR 164.404 to 164.408. Business associate agreements tie your vendors into the same obligations.

Can HIPAA compliance software replace this checklist?

No. Compliance software can track policies, training, BAAs and evidence, and that saves time, but it can't turn on MFA, encrypt a laptop or decide which risks matter in your practice. For the risk analysis itself, ONC and OCR publish a downloadable Security Risk Assessment Tool for small and medium providers, version 3.7 as of September 2026, as a Windows application or an Excel workbook; the agency notes that using it neither is required nor guarantees compliance. The two tables on this page print cleanly if you want a paper checklist.

Does HIPAA require vulnerability scans?

Not on a fixed schedule today. The current Rule requires an accurate and thorough assessment of the risks and vulnerabilities to ePHI (45 CFR 164.308(a)(1)(ii)(A)) and a periodic technical and nontechnical evaluation (164.308(a)(8)), and scanning is the practical way to find the technical vulnerabilities. The proposed update would require vulnerability scans at least every six months and a penetration test at least once a year.

What does NetSys do for a practice's HIPAA compliance?

The technical side, alongside your privacy and security officer: an inventory of the systems, devices and vendors that touch ePHI, a technical risk analysis that follows NIST SP 800-66 Rev. 2 with a dated remediation plan, unique accounts with MFA and conditional access in Entra ID, full-disk encryption through Intune, email encryption, audit logging that is reviewed, monitored endpoint detection, tested backups and a BAA register. We sign a business associate agreement with the practice before our work reaches systems that hold ePHI. We don't certify anyone, and no government-recognized HIPAA certification exists.

How does an engagement start, and what affects the cost?

You can start with our free remote external penetration test, within an agreed external scope; the inventory, risk analysis and remediation are scoped separately. Cost depends on the number of users, devices, locations and systems that hold ePHI, and on how much of the control set is already in place. Ongoing managed IT is a flat monthly fee per user, and we don't publish prices.

Who handles support and escalations?

NetSys engineers. The help desk is staffed seven days a week from 4 a.m. to 11 p.m. Eastern, and monitoring and emergency service run 24/7. In a suspected breach, we supply the facts from logs and forensic evidence; your security officer and counsel make the breach determination and notification decisions.

Book a call with a NetSys engineer to walk through this checklist against your practice's systems, or read how our HIPAA compliance services work.

Sources and further reading

• Unified Agenda entry for the proposed HIPAA Security Rule update (RIN 0945-AA22), with the projected date for final action.
• 45 CFR 164.316, policies, procedures and documentation, including the six-year retention rule.
• 45 CFR 164.520, the notice of privacy practices, and HHS's model notices.
• 45 CFR 164.508, uses and disclosures that require an authorization, and the core elements of a valid one.
• 45 CFR Part 164 (2024 edition), including the breach notification rule in 164.400 to 164.414.
• ONC and OCR Security Risk Assessment Tool for small and medium providers.