HIPAA compliance checklist for a small practice

The core of a small practice's HIPAA program is a required risk analysis (45 CFR 164.308(a)(1)(ii)(A)), written policies (164.316), workforce training (164.308(a)(5)), and a business associate agreement with each vendor that handles protected health information, or PHI (164.502(e)).

What does a small practice need to be HIPAA compliant?

Under the Privacy Rule, a small practice needs administrative, technical and physical safeguards in place to protect the privacy of PHI (45 CFR 164.530). The Security Rule adds reasonable and appropriate administrative, physical and technical safeguards for electronic PHI, in the groups set out at 45 CFR 164.308, 164.310 and 164.312. A small practice's compliance work is the set of items those groups require, each with a documented step.

The HIPAA fax requirements checklist covers the same items as they apply to faxing. The table below lists each requirement, its citation and what a small practice does.

Is a HIPAA risk analysis required for a small practice?

A HIPAA risk analysis is required for a small practice. Under 45 CFR 164.308(a)(1)(ii)(A), the practice must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of ePHI. The rule marks that step as required, not addressable, so the practice cannot treat it as an optional safeguard.

The rule text sets no fixed yearly interval for repeating the analysis. The next step, risk management, requires security measures that reduce the risks it finds to a reasonable and appropriate level (164.308(a)(1)(ii)(B)).

Do small practices need written HIPAA policies?

Yes, a small practice must implement reasonable and appropriate policies and procedures that comply with the Security Rule's standards and implementation specifications (45 CFR 164.316(a)). The practice must also keep that documentation for six years from its creation or from when it last was in effect, whichever is later (164.316(b)(2)(i)).

Fax records have their own retention question, covered in how long to keep fax records under HIPAA. The six-year period above applies to the Security Rule documentation itself.

How often is HIPAA training required?

HIPAA sets no fixed frequency for training. The rule requires a security awareness and training program for all members of the workforce, including management (45 CFR 164.308(a)(5)(i)). The program must reach every workforce member, from the newest hire to the practice owner. Training is a standing duty under 164.308(a)(5)(i), so a practice that adds staff must train them too.

Which vendors need a business associate agreement?

An outside vendor needs a business associate agreement when it creates, receives, maintains or transmits PHI on the practice's behalf (45 CFR 160.103). The practice may give PHI to that vendor only after it obtains satisfactory assurance that the vendor will safeguard it (164.502(e)(1)(i)). The assurance goes into a written contract that meets 164.504(e) (164.502(e)(2)).

A fax service is one such vendor, and a billing service that handles patient records for the practice is another. Every Fax Pigeon plan includes a signed BAA from signup, and whether a fax service needs a BAA has its own page.

Which HIPAA items are required and which are addressable?

HIPAA marks each Security Rule implementation specification as required or addressable. A required one must be implemented, and an addressable one must first be assessed for whether it is a reasonable and appropriate safeguard in the practice's environment (45 CFR 164.306(d)(1) and (d)(3)(i)). The risk analysis and risk management specifications are required (164.308(a)(1)(ii)(A) and (B)), and encryption of ePHI in transmission is addressable. The encryption standard says to implement a mechanism to encrypt ePHI "whenever deemed appropriate" (164.312(e)(2)(ii)), so the assessment decides whether that encryption is reasonable for the practice.

What do the technical safeguards require for a small practice?

Under 45 CFR 164.312, the technical safeguards cover access control, audit controls, integrity, person or entity authentication and transmission security. Access control allows ePHI access only to persons or programs granted access rights under 164.308(a)(4) (164.312(a)(1)). Audit controls require mechanisms that record and examine activity in systems that contain or use ePHI (164.312(b)). Integrity policies protect ePHI from improper alteration or destruction (164.312(c)(1)).

Person or entity authentication verifies that a person or entity seeking ePHI access is the one claimed (164.312(d)). Transmission security guards against unauthorized access to ePHI sent over an electronic communications network (164.312(e)(1)).

What do the physical safeguards require for a small practice?

Under 164.310, a practice must govern the receipt and removal of hardware and electronic media that contain ePHI (45 CFR 164.310(d)(1)). They also limit facility access (164.310(a)(1)) and secure workstations that access ePHI (164.310(c)). Because the rule requires all three types, a practice needs a physical control and an administrative control for the same records.

What must a practice do when a breach happens?

After a breach of unsecured PHI, the practice must notify each affected individual without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.404(b)). A breach counts as discovered on the first day it is known, or would have been known with reasonable diligence (164.404(a)(2)). The breach notification rule sets out the details of who must be told and how. The duty to notify each individual applies to every breach of unsecured PHI, whatever the number of people affected.

* The regulation text was read at law.cornell.edu and HHS guidance at hhs.gov on October 13, 2026.