HIPAA compliance checklist for small practices, including your website

People: privacy and security officials

• Designate a privacy official responsible for your policies (164.530(a) (opens in a new tab)). Why it matters: without an owner, records requests and complaints fall through the cracks.
• Designate a contact for complaints who can answer questions about your privacy notice (164.530(a)(1)(ii)). Why: patients need somewhere to go besides OCR.
• Designate a security official for the Security Rule (164.308(a)(2) (opens in a new tab)). Why: one person can hold both roles, but someone must own passwords, devices and vendors.
• Put the designations in writing. Why: the rule requires documentation, and a new hire needs to know who to ask.

Risk analysis and risk management

• Complete a written risk analysis of every system holding electronic PHI, website and marketing tools included (164.308(a)(1)(ii)(A)). Why: HHS's own 2016–2017 audits (opens in a new tab) found most covered entities falling short on it.
• Write a risk management plan with owners and dates for each fix (164.308(a)(1)(ii)(B)). Why: finding risks without reducing them doesn't meet the rule.
• Review system activity regularly: audit logs, access reports, incident reports (164.308(a)(1)(ii)(D)). Why: this is how you spot snooping and compromised accounts.

The HIPAA risk assessment guide walks through each step with the free federal SRA Tool (opens in a new tab), built by ONC and HHS's Office for Civil Rights for small and medium providers.

Policies, procedures and the Notice of Privacy Practices

• Adopt written privacy policies sized to your practice (164.530(i)) and security policies (164.316 (opens in a new tab)). Why: written policies are the first thing an investigator can check.
• Give the Notice of Privacy Practices at first service and make a good-faith effort to get a written acknowledgment (164.520(c)(2) (opens in a new tab)). Why: it's the patient's first view of your rules.
• Post the notice in the office in a clear and prominent location (164.520(c)(2)(iii)).
• Post the notice prominently on your website if it describes your services, and make it available electronically there (164.520(c)(3)(i)). Why: this website requirement is easy to miss in a redesign.
• Have a records-request process that meets the 30-day deadline and cost-based fee limits (164.524 (opens in a new tab)). Why: unanswered requests generate complaints.

Training and sanctions

• Train every workforce member on your policies, and new hires within a reasonable period (164.530(b)). Why: staff can't follow policies nobody showed them.
• Run a security awareness program with reminders, malware and phishing guidance, log-in monitoring and password rules (164.308(a)(5)). Why: email protection is the first practice in HHS's cybersecurity guide for small organizations.
• Document every session with date, attendees and topics. Why: undocumented training counts as no training.
• Adopt and apply a sanctions policy (164.530(e); 164.308(a)(1)(ii)(C)). Why: the rule requires consequences, applied consistently.

Vendors and BAAs

• List every vendor that creates, receives, maintains or transmits PHI: EHR, billing, IT, email, cloud storage, shredding, answering service, website host, form tool, CRM, chat, any agency handling leads.
• Get a signed BAA from each before data flows (164.308(b); 164.502(e)). Why: a missing BAA is a violation the moment PHI moves.
• Check the BAA covers the plan you're on. Why: some vendors sign only for higher tiers.
• File BAAs where you can find them, with renewal and termination dates. See BAA requirements for what each must say.

Your website and marketing

• Use HIPAA-compliant forms for appointment requests and contact forms, with a BAA, encryption in transit and at rest, and notifications that don't paste PHI into email.
• Remove tracking pixels from form, booking, portal and condition pages. Why: pixels can send identifiers tied to care to ad platforms with no BAA.
• Never upload patient lists to ad platforms for custom or lookalike audiences without authorization. Why: it discloses who your patients are, for marketing.
• Script review replies that never confirm someone is a patient. Why: the reply is your disclosure, not theirs.
• Get written authorization before using testimonials or patient photos (164.508(a)(3) (opens in a new tab)). Why: marketing use of PHI requires it.
• Confirm BAAs with your host, form tool, CRM, chat widget and any analytics tool that could receive PHI.

The HIPAA website checklist goes page by page, and HIPAA marketing rules covers authorizations and exceptions. A free marketing audit checks your current site for privacy risks such as pixels on patient forms. Medfy's website includes HIPAA-compliant forms and a patient CRM and inbox; patient data is stored in separate, encrypted HIPAA databases in the US or Canada, Medfy signs a BAA with every practice, and ad platforms never receive patient data (how Medfy handles patient data).

Devices, access and backups

• Give every user a unique login (164.312(a)(2)(i) (opens in a new tab)). Why: shared logins make audit logs useless.
• Set automatic logoff on workstations and apps (addressable, 164.312(a)(2)(iii)).
• Encrypt laptops, phones and stored data, or document an equivalent alternative (addressable, 164.312(a)(2)(iv) and (e)(2)(ii)). Why: encrypted devices can stay out of breach notification when lost.
• Remove access the day someone leaves (164.308(a)(3)(ii)(C)).
• Lock down workstations and dispose of devices properly (164.310 (opens in a new tab)(c)–(d)).
• Back up ePHI, and test the restore (164.308(a)(7)(ii)(A)–(B)). Why: ransomware recovery depends on it.

For practical controls, HHS's 405(d) program publishes Cybersecurity Practices for Small Healthcare Organizations (opens in a new tab) (2023 edition), covering email protection, endpoint protection, access management and seven more practices.

Breach response and documentation

• Write a one-page breach plan: who investigates, who calls counsel, who runs the four-factor risk assessment. See breach notification.
• Know the clock: individual notice without unreasonable delay and within 60 calendar days of discovery (164.404 (opens in a new tab)).
• Keep a breach log for incidents affecting fewer than 500 people, reported to HHS annually.
• Keep all HIPAA documentation for six years from creation or last effective date (164.530(j); 164.316(b)(2)(i)).

Copy this tracker into a document or spreadsheet and fill it in:

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Frequently asked questions

What does a small practice need for HIPAA compliance?

At minimum: a named privacy and security official, a written risk analysis with a plan to fix what it finds, written policies, documented staff training, a signed BAA with every vendor that handles patient data, a Notice of Privacy Practices posted in the office and on the website, a process for records requests, and a breach response plan. Keep the paperwork for six years. Confirm your gaps with your compliance officer or attorney.

How often should the HIPAA checklist be reviewed?

Walk through the whole list at least once a year, and reopen the relevant section whenever something changes: a new EHR or website vendor, a move, a new hire or departure, or any security incident. The Security Rule ties reviews to environmental and operational changes rather than a calendar date. A short quarterly check of vendors, user accounts and backups catches most drift between full reviews.

Does my practice website need to be HIPAA compliant?

The parts that touch patient information do. Forms, chat, booking and portals that collect PHI need vendors under a BAA, encryption and access controls, and tracking pixels should stay off those pages. A covered entity with a website about its services must also post its Notice of Privacy Practices there. Purely informational pages carry less risk. Confirm your site's setup with your compliance officer or attorney.

Who should be the privacy officer in a small practice?

Usually the practice manager or office manager, because they already run the front desk, vendors and records requests. HIPAA requires a designated privacy official and a security official; one person can hold both if they have the time and authority to act. Document the designation in writing and name a backup. Confirm the choice suits your practice with your compliance officer or attorney.