HIPAA Compliance Checklist

Develop and maintain written policies covering use and disclosure of PHI.

Provide patients a clear NPP describing how their health information may be used.

Train all workforce members on privacy policies within a reasonable period after hiring.

Limit PHI use, disclosure, and requests to the minimum necessary for the purpose.

Designate an official responsible for developing and implementing privacy policies.

Patients can inspect and obtain a copy of their PHI within 30 days of request.

Patients can request amendments to their records. You must act within 60 days.

Patients can request a list of certain disclosures made in the past six years.

Patients can request restrictions on certain uses or disclosures of their PHI.

Obtain written authorization before using PHI outside treatment, payment, or operations.

Execute a signed BAA with every business associate before sharing PHI.

Each BAA must specify permitted uses, require safeguards, mandate breach reporting, and allow termination.

Keep a current list of all business associates with signed BAA copies and review dates.

Perform an accurate and thorough assessment of risks and vulnerabilities to ePHI.

Assign a specific individual responsible for developing and implementing security policies.

Implement policies ensuring only authorized personnel access ePHI based on role.

Provide ongoing training including phishing simulations, password management, and malware recognition.

Establish documented procedures for identifying, responding to, and mitigating security incidents.

Develop data backup, disaster recovery, and emergency operations plan for ePHI systems.

Limit physical access to facilities containing ePHI to authorized individuals only.

Define proper functions, physical attributes, and environment for workstations accessing ePHI.

Implement physical safeguards to restrict unauthorized access to workstations.

Govern the receipt, removal, and disposal of hardware and electronic media containing ePHI.

Assign unique user IDs, enable emergency access, implement automatic logoff, and use encryption.

Implement hardware, software, and procedural mechanisms to record and examine ePHI access.

Implement policies to protect ePHI from improper alteration or destruction.

Verify the identity of any person or entity seeking access to ePHI.

Protect ePHI transmitted over networks against unauthorized access using TLS/SSL encryption.

Notify affected individuals within 60 days of discovering a breach of unsecured PHI.

Report breaches affecting 500+ individuals to HHS immediately. Report smaller breaches annually.

For breaches affecting 500+ residents of a state, notify prominent media outlets within 60 days.

Evaluate each incident using the four-factor risk assessment to determine if notification is required.

Ensure business associates notify you of breaches within 60 days (or per BAA terms).