HIPAA Security Rule checklist for small practices
Twenty-four plain-language questions drawn from the Security Rule's safeguards. Answer online in about six minutes, see your rating and fix list straight away, and get a scored PDF if you want one.
Five sections, in the order an investigator asks
- 01
Risk analysis & policies
The risk analysis is the first document an investigator asks for. Mark each line honestly: “Partial” tells you exactly what to finish.
- 02
Access & sign-in
Access controls make every look at a record traceable to a person, and keep a stolen password from opening everything.
- 03
Devices & data
Lost laptops, unpatched computers and old drives are where many small-practice breaches begin.
- 04
Backups & incidents
The rule requires a plan for getting data back and for handling incidents. Ransomware has made both urgent.
- 05
People & vendors
Training, vendor agreements and physical security cover the risks technology alone does not.
What the Security Rule asks of a small practice
The HIPAA Security Rule covers electronic protected health information: the EHR, email, billing, backups and every device that touches them. It is written to scale, so a three-provider clinic is not held to a hospital's budget, but it is held to the same list of safeguards. Most of them come down to evidence: a risk analysis, written policies, training records and agreements with vendors.
This checklist follows those safeguards in the order they tend to come up. Start with the risk analysis, because everything else should flow from it, then check access, devices, backups and vendors. Wherever you answer Partial or No, the report lists the evidence that would let you answer Yes.
If you want help closing the gaps, our HIPAA compliance support covers the technical safeguards, documentation and evidence, and we sign a business associate agreement with every practice we support. See also managed IT for medical and dental practices.
References
Standards referenced
About the HIPAA Security Checklist
Is this a HIPAA risk analysis?
No. A risk analysis looks at your specific systems, the threats to them and how likely and serious each one is. This checklist shows which safeguards are in place and where documentation is missing, which makes it a useful starting point for the analysis itself, not a replacement.
Who should fill it in?
Your security official, practice manager or whoever runs IT. Some answers, such as backups, encryption and audit logs, may need your IT provider or your EHR vendor. “Not sure” is a fine answer: the report lists those items separately so you know who to ask.
What does “critical” mean?
Six safeguards count double: the risk analysis, individual logins, multi-factor authentication, encryption, backups and business associate agreements. A No or Not sure on any of them caps the rating, because gaps there carry the most risk for a small practice.
What happens to my answers?
They stay in your browser until you ask for the PDF. If you do, we store your answers with your name, company and email so we can build the report, and the only email you get is the copy of your report.
Want help closing
the gaps?
Tell us what you found and we'll tell you what we'd fix first. No obligation.