A HIPAA IT compliance checklist covers the technical safeguards a medical practice must run to protect electronic protected health information: a current risk analysis, role-based access with multi-factor authentication, encryption at rest and in transit, audit logging, tested backups, workforce training, and business associate agreements. OCR data shows hacking caused 81% of large 2024 healthcare breaches, so these are the controls that matter.
A HIPAA IT compliance checklist is the set of technical and administrative safeguards a medical practice uses to protect electronic protected health information, or ePHI, under the HIPAA Security Rule. The essentials are a current risk analysis, role-based access control with multi-factor authentication, encryption of ePHI at rest and in transit, audit logging and monitoring, tested backups and disaster recovery, workforce training, and signed business associate agreements with every vendor that touches patient data. Get those in place and documented, and you have covered the requirements behind the overwhelming majority of enforcement actions.
The stakes are no longer abstract. In 2024, large healthcare data breaches exposed the protected health information of nearly 243 million individuals, the worst year on record, and hacking was behind the vast majority of it. Medical practices sit on some of the most valuable data an attacker can steal, and regulators now expect the technical controls to match that risk. This checklist walks through each safeguard, the current data behind why it matters, and what the proposed 2025 Security Rule changes mean for the year ahead. For practices that would rather hand the work to a specialist, layered healthcare IT services put every control below in place and keep it documented.
HIPAA requires three kinds of safeguards for ePHI, and IT owns most of them. The HIPAA Security Rule groups protections into administrative safeguards (policies, training, and risk management), physical safeguards (facility and device controls), and technical safeguards (the technology that guards the data itself). For a medical practice, the technical safeguards are where compliance is won or lost, and the Security Rule names five categories: access control, audit controls, integrity, person or entity authentication, and transmission security, per HHS guidance on the Security Rule.
Those five categories translate into concrete IT tasks. Access control means unique user IDs and least-privilege permissions. Audit controls mean logging who touched what. Integrity means detecting improper alteration of records. Authentication means verifying identity before granting access. Transmission security means protecting data as it crosses networks. The checklist below turns each of those into an action a practice can implement and document.
The checklist below groups the safeguards by function so a practice can work through them in order. Each item maps to a Security Rule standard and to a failure OCR has cited in real breach investigations.
Risk analysis and governance
Access control and authentication
Encryption and transmission security
Monitoring, backup, and response
People and vendors
A current risk analysis is the single most important item on this list, because it is the one OCR finds missing most often. In its 2024 breach investigations, OCR repeatedly identified an incomplete or absent risk analysis, along with weak information system activity review, inadequate audit controls, and poor authentication, as the recurring root causes. The risk analysis is not paperwork for its own sake. It is how a practice discovers which systems hold ePHI, where the gaps are, and which controls to prioritize, which is why every other safeguard depends on it.
The data on how breaches happen makes the case for getting this right. Hacking and IT incidents, not lost laptops or misdirected mail, now drive the losses, and they exploit exactly the gaps a risk analysis is meant to catch: unpatched systems, over-broad access, and single-factor logins.
Access control decides who can reach ePHI, and multi-factor authentication is the control that stops a stolen password from becoming a breach. OCR has explicitly flagged single-factor remote access and default passwords as breach causes, which is why MFA belongs on every system that touches patient data, starting with the EHR, email, and remote access. Pair it with unique user IDs, least-privilege permissions, and prompt deprovisioning when staff leave, and you close the lateral-movement path OCR found in so many investigations, where excessive privileges let an intruder roam once inside.
Multi-factor authentication is inexpensive and fast to deploy, and it neutralizes the most common outcome of a phishing attack. If your practice does only one thing from this checklist this quarter, turn on MFA everywhere it is available. Our guide to what MFA is and why your business needs it covers the setup in plain terms.
Encryption protects patient data even when a device or transmission is compromised, and it is the difference between a lost laptop and a reportable breach. Under the current Security Rule, encryption is an addressable specification, meaning a practice must either implement it or document an equally effective alternative. In practice, unencrypted ePHI is a leading cause of reportable incidents, and encrypting data both at rest and in transit is the expected standard. Encrypt everything that stores patient data, and protect it as it moves across email, file transfers, and remote connections.
Encryption is also where HIPAA is heading. The proposed 2025 Security Rule update, covered further below, would remove the addressable label and make encryption of ePHI at rest and in transit mandatory, with limited exceptions. Practices that encrypt now are simply ahead of a change that is coming.
Audit controls and tested backups turn a bad day into a recoverable one. Audit logging records who accessed which records and when, which the Security Rule requires and which lets you detect misuse and reconstruct an incident. Continuous monitoring for anomalous activity shortens the window an intruder has, and that window is long in healthcare. IBM found healthcare breaches took the longest of any industry to identify and contain, so the practices that log and monitor closely are the ones that catch an intrusion before it becomes a mass disclosure.
Backups are the other half of resilience. With ransomware driving so many healthcare incidents, isolated and restore-tested backups are what let a practice recover without paying, and without patient care stopping. Keep backups off the production network so an attacker cannot encrypt them alongside live data, and confirm restores work on a schedule. The proposed 2025 rule would go further and require restoration of certain critical systems within 72 hours, a good target to aim for now regardless of the rule's status.
Your compliance now extends to every vendor that touches patient data. HIPAA requires a business associate agreement with each cloud provider, billing service, IT vendor, and software platform that creates, receives, stores, or transmits ePHI on your behalf. The agreement binds the vendor to protect the data, but it does not remove your obligation to vet them. Review what each connected tool can actually reach, grant the minimum access needed, and keep an inventory of who touches your systems. A vendor breach can become your reportable breach, so third-party risk is squarely part of the checklist. Practices weighing formal frameworks for their vendors can start with our guide to SOC 2 for small business.
The cost of a healthcare breach dwarfs the cost of the controls that prevent it. Healthcare has been the most expensive industry for data breaches for 14 consecutive years, and the 2025 average was 7.42 million dollars per incident in IBM's analysis. Small practices rarely absorb the full enterprise figure, but they have far less cushion, and the mix of downtime, recovery, patient loss, and regulatory exposure can exceed years of security spending in a single event.
Regulatory penalties come on top of the breach itself. HIPAA civil monetary penalties are tiered by culpability, and the top tier for willful neglect that is not corrected reaches 2,190,294 dollars per violation category per year, per current OCR penalty schedules. OCR also imposes corrective action plans and monitoring. Against those numbers, the safeguards on this checklist are inexpensive, and every one of them blocks an entry point the data shows attackers actually use.
The biggest HIPAA change in over a decade is on the table, and it makes many best practices mandatory. On January 6, 2025, HHS published a Notice of Proposed Rulemaking to modernize the Security Rule, the first major overhaul since 2013. As detailed in the Federal Register notice and the HHS fact sheet, the proposal would remove the distinction between addressable and required specifications, making them all mandatory, and would require encryption of ePHI at rest and in transit, multi-factor authentication across systems, network segmentation, a written technology asset inventory and network map, and regular vulnerability scanning and penetration testing.
As of mid-2026 the rule is still proposed, not final, after a comment period that closed in March 2025. That does not make it safe to wait. The proposed controls mirror the failures OCR already cites in enforcement, so a practice that adopts them now is both hardening its defenses and getting ahead of a rule that is likely coming. The direction is clear even if the timeline is not, and the same measures that satisfy the proposal also stop the breaches happening today. State laws add another layer, and businesses in New York should also review our guide to the NY SHIELD Act.
HIPAA compliance is continuous work, not a project you finish, and that is where a specialist earns its keep. The controls on this checklist have to be run and documented every day: patches applied, logs reviewed, backups tested, access rights pruned, training refreshed, and the risk analysis kept current. Most small and mid-sized practices do not have the staff to do that consistently while also seeing patients, which is exactly the gap a managed partner fills. Compeint delivers healthcare IT services that implement every safeguard above, keep the documentation audit-ready, and adapt as the rules tighten, so compliance is something your practice maintains rather than scrambles to prove.
The HIPAA Security Rule requires five categories of technical safeguards for electronic protected health information: access control, audit controls, integrity controls, person or entity authentication, and transmission security. In practice these translate to unique user IDs, activity logging, tamper detection, verified identity before access, and protection of data as it moves across networks. A medical practice meets them with role-based access, multi-factor authentication, encryption, audit logs, and a documented risk analysis behind all of it.
Under the current HIPAA Security Rule, encryption of ePHI is an addressable specification, which means a practice must either implement it or document a reasonable alternative that provides equivalent protection. In practice, encryption at rest and in transit is the expected control, and unencrypted data is a leading cause of reportable breaches. The January 2025 HIPAA Security Rule NPRM proposes to make encryption of ePHI at rest and in transit mandatory, so encrypting patient data now is the safe path either way.
The current HIPAA Security Rule does not name multi-factor authentication explicitly, but it requires access controls and authentication that are reasonable and appropriate, and OCR has repeatedly cited single-factor remote access as a breach cause. The January 2025 NPRM would make multi-factor authentication mandatory across all systems that access ePHI. Because MFA blocks the stolen-password attacks behind most healthcare breaches, practices should treat it as required today.
A HIPAA risk analysis is not a one-time task. HHS expects it to be an ongoing process, reviewed and updated whenever the practice adds systems, changes vendors, or faces new threats, and at least once a year in practice. OCR consistently identifies an incomplete or missing risk analysis as the single most common compliance failure in breach investigations, so a current, documented risk analysis is the foundation the rest of the checklist sits on.
HIPAA civil monetary penalties are tiered by culpability, from a lack of knowledge up to willful neglect that is not corrected, with the top tier reaching 2,190,294 dollars per violation category per year. OCR also imposes corrective action plans and, in 2024, resolved hundreds of breach investigations. Beyond fines, the larger cost is the breach itself: IBM put the 2025 average healthcare breach at 7.42 million dollars.
Yes. HIPAA applies to every covered entity that handles protected health information, regardless of size, including solo practices and small clinics, along with the business associates that serve them. Small practices face the same Security Rule requirements as large health systems, and they are frequent breach targets because attackers assume their defenses are lighter. The safeguards scale to the size of the practice, but none of them are optional.
Compliance you maintain, not scramble to prove
We map your systems against the HIPAA Security Rule, flag the gaps OCR looks for, and show you exactly what to fix first, with no obligation.
Book Your Assessment