A HIPAA Security Checklist for a Five-Person Practice

Small practices often assume HIPAA’s Security Rule is written for hospitals. It is not. It applies to every covered entity and business associate, and it is deliberately scalable. You are not expected to build what a health system builds. You are expected to think carefully, act reasonably, and write it down.

1. Complete a Risk Analysis

This is the foundation, and it is the item investigators ask about first. Identify where electronic protected health information lives (the EHR, email, laptops, phones, scanners, cloud storage, backups), what could go wrong, and how likely and damaging each risk is. Repeat it when something significant changes, such as a new system, vendor, or location.

2. Act on the Results

A risk analysis that sits in a drawer is a liability. The rule also requires risk management: measures that reduce risks to a reasonable and appropriate level. Keep a dated list of what you decided to fix, what you accepted, and why.

3. Designate a Security Official

Someone must be responsible for the security program. In a small practice it is often the practice manager or the physician-owner. Name the person in writing.

4. Control Access and Require MFA

Give each person their own account, limit access to what their role needs, remove access promptly when someone leaves, and require multi-factor authentication for email and remote access.

5. Encrypt Laptops, Phones, and Email Where Appropriate

Encryption is an “addressable” specification, which does not mean optional. It means you must implement it or document why an equivalent alternative is reasonable. For laptops and phones, encryption is inexpensive and removes much of your breach exposure if a device is lost.

6. Back Up and Plan for Recovery

Keep encrypted, offsite backups, and test restoring them. Write down how you would operate and recover if your systems went down, including ransomware.

7. Get Business Associate Agreements in Place

Vendors that create, receive, maintain, or transmit PHI for you generally need a business associate agreement. That often includes your IT provider, cloud storage, billing company, and shredding service.

8. Train Your Workforce

Train every new hire and refresh regularly, with a record of who completed what. Phishing is the most common way small practices get breached, so cover it specifically.

9. Have an Incident Response Plan

Decide in advance who to call, how to contain a problem, and how to assess whether a breach occurred. Breach notification to affected individuals is required without unreasonable delay and no later than 60 days after discovery, with additional requirements depending on the size of the breach.

10. Keep Your Documentation for Six Years

Policies, risk analyses, training records, and decisions must be retained for six years from creation or last effective date. Documentation is how you prove the other nine.

This guide is general information, not legal advice, and requirements change. If you want help applying it to your practice, see our healthcare services or get in touch.