HIPAA Readiness Checklist

If your IT provider accesses, maintains, or stores Protected Health Information, they are a Business Associate under HIPAA and need a signed BAA. That is a legal requirement, not optional paperwork. Running without a signed BAA is a compliance problem even if every other control looks fine. Many small practices have never been offered one.

Covered entities must conduct and document a thorough Security Risk Analysis — not once forever, but on an ongoing basis and when the environment changes in a meaningful way. OCR keeps citing missing or weak risk analyses in enforcement actions. This is not a casual internal chat; it needs written risks and remediation decisions.

Phishing and social engineering still cause more healthcare breaches than exotic technical flaws. Training that covers phishing recognition, password hygiene, device security, and proper PHI handling is required under HIPAA and remains one of the strongest controls against credential compromise. Keep attendance documented.

MFA is a common cyber insurance requirement and a baseline expectation from HHS guidance. It should cover the EHR, practice management, Microsoft 365 or Google Workspace, remote access, and any cloud platform that handles PHI. One account without MFA is enough for a credential-based attack — still a leading path into healthcare environments.

HIPAA’s Minimum Necessary standard limits PHI access to what each job requires. A front-desk coordinator does not need clinical notes. A billing specialist does not need charts outside assigned work. Role-based access shrinks the blast radius of a compromised account and narrows breach scope.

A lost or stolen unencrypted laptop with PHI can trigger breach analysis and patient notification even if nobody ever opened the files. Encryption at rest is how a lost device stays an IT problem instead of a reportable incident. It is an addressable HIPAA specification — and in practice, encryption is expected on devices that store PHI, with documented justification if you skip it.

Untested backups are a liability. Confirm that the EHR, practice management system, and patient files back up automatically, that jobs complete successfully, and that someone has restored from them on purpose — not just assumed a restore would work. A backup you cannot restore is not a backup.

Ransomware often tries to encrypt or delete reachable backups before it locks live systems. A healthcare practice needs at least one copy that is off-network, immutable, or both, so an attack does not wipe both the charts and the recovery path. Cloud backup alone is not enough if a compromised workstation can rewrite or delete it.

Covered entities generally must notify affected patients within 60 days of discovering a breach, and notify HHS. Larger incidents can also trigger local media notice. When something happens, the first hours shape your compliance posture. A written plan covers containment, forensic preservation, scope assessment, and notification timelines — so staff isn't inventing the process under stress.

More practices carry cyber liability insurance, and most policies spell out technical expectations — MFA, endpoint protection, backup architecture, staff training, incident response. Insurers do dispute claims when paperwork claims controls that cannot be shown. Know what your policy requires, confirm it is implemented, and keep evidence before you need to file.