HIPAA security checklist for small practices

How to use this checklist

Go through the list with whoever handles your IT, whether that’s a staff member or an outside company. Check an item only when you can point to proof: a setting, a report, a signed agreement or a written policy.

Leave anything you’re unsure of unchecked. An honest “not yet” is more useful than a guess, especially if you’ll reuse the answers on a cyber insurance application.

The progress bar and group counters update as you go. The “What’s still open” list at the bottom becomes your to-do list. Use the Print button to save it as a PDF or print it for your files.

Nothing you check is stored or sent. If you close the page, your answers are gone, so print before you leave.

What each group covers

• Risk analysis and policies: the required risk analysis and risk management under 45 CFR 164.308(a)(1), a named security official, written policies kept 6 years, and a device inventory.
• Access and MFA: one login per person, MFA, separate admin accounts, same-day removal of departing staff, and password management.
• Email: a BAA with your email provider, a defined encryption method, and filtering. The HIPAA compliant email page explains each.
• Devices and EDR: endpoint protection, patching, disk encryption and screen locks. Windows 10 reached end of support on October 14, 2025, per Microsoft.
• Backups: a copy you can restore that ransomware can’t reach, a test restore, and a plan for working while systems are down.
• Training: awareness training for everyone, phishing simulations and a sanction policy.
• Vendors and BAAs: a list of every vendor that touches PHI, with BAAs and written expectations for your IT provider.
• Incident response: a written plan, breach notification steps and log review.
• Physical security: a locked space for equipment and safe disposal of old devices.

Where the items come from

Each item shows its source under the description:

• 45 CFR citations point to the HIPAA Security Rule and the business associate rules on eCFR. Items from required implementation specifications are legal requirements today. Items from addressable specifications must be implemented or documented with an alternative, under 164.306(d).
• HICP citations point to the small-organization sub-practices in HHS’s 405(d) Technical Volume 1, 2023 edition. They are voluntary guidance.
• CPG citations point to HHS’s voluntary healthcare Cybersecurity Performance Goals.

The checklist doesn’t include requirements from the Security Rule changes HHS proposed in January 2025, because that proposal isn’t law as of October 2026. The healthcare cybersecurity guide explains its status.

What this checklist is not

It is not an audit, a certification or legal advice. It doesn’t replace the written risk analysis the rule requires, which has to look at your actual systems, threats and vulnerabilities.

Thirty items can’t cover every practice. A practice with connected medical devices, several locations or its own data center has more to look at. Use this to find the obvious gaps, then do the full analysis described in the HIPAA risk assessment guide.

After you finish

Sort your open items into three piles: things you can fix this week yourself (like turning on MFA), things your IT provider can fix, and things that need a new service (like EDR, a password manager or cloud fax).

For the third pile, I can compare at least two providers for each open item, including options I don’t work with. Dental offices can also check the dental-specific notes on the dental office page.

If you’d like quotes for the services on your open list, send me your checklist results.