HIPAA IT Compliance Checklist for Small Medical Practices (2026)

If your practice creates, stores, or sends patient information electronically, the HIPAA Security Rule applies to you — whether you’re a three-provider family clinic or a multi-location specialty group. And enforcement doesn’t only target large hospitals: small practices regularly face investigations after a lost laptop, a phishing email, or a ransomware attack.

The challenge is that HIPAA is written to be flexible. It tells you what to protect, not which products to buy. This checklist translates the Security Rule into the concrete IT work a small practice should have in place, and explains what’s changing.

First, the basics: what the Security Rule covers

The HIPAA Security Rule protects electronic protected health information (ePHI) — any patient data your practice handles digitally, from your EHR and billing system to emails, scanned documents, and voicemail transcriptions. It requires three kinds of safeguards:

• Administrative safeguards — risk analysis, policies, training, and vendor agreements
• Physical safeguards — controlling access to facilities, workstations, and devices
• Technical safeguards — access controls, audit logs, integrity controls, and transmission security

The HIPAA IT compliance checklist

1. Risk analysis and planning

• Complete a security risk analysisIdentify where ePHI lives, how it moves, and what threatens it. This is the single most-cited gap in enforcement actions — and it must be repeated, not done once.
• Keep a technology asset inventoryList every device, server, application, and cloud service that touches patient data.
• Write a risk management planDocument how you’ll reduce each identified risk, who owns it, and by when.
• Assign a security officialName the person responsible for HIPAA security — even in a small office, someone must own it.

2. Business associate agreements (BAAs)

• Sign BAAs with every vendor that touches ePHIYour EHR, billing service, cloud backup, email provider, and IT provider all need one.
• Confirm your email and file storage are coveredConsumer email accounts and free file-sharing tools typically won’t sign a BAA. Business plans of Microsoft 365 and Google Workspace can be configured for HIPAA.
• Review vendor security annuallyA BAA is a contract, not a guarantee. Ask vendors how they protect your data.

3. Access control and identity

• Give every user a unique loginNo shared front-desk accounts. Audit trails only work if each action ties to a person.
• Turn on multi-factor authentication (MFA)Prioritize email, remote access, and your EHR. MFA blocks the large majority of account-takeover attacks.
• Apply least-privilege accessStaff should only reach the records their role requires.
• Offboard the same dayDisable accounts immediately when someone leaves, and review access whenever roles change.
• Enable automatic logoffWorkstations in shared areas should lock after a short period of inactivity.

4. Device and data protection

• Encrypt laptops, desktops, and mobile devicesUnder the Breach Notification Rule, a lost device that is properly encrypted is generally not a reportable breach. An unencrypted one often is.
• Encrypt data in transitUse secure email for ePHI, and make sure your EHR, portals, and remote access use modern encryption.
• Run endpoint detection and response (EDR)Traditional antivirus misses much of modern ransomware. EDR detects and isolates suspicious behavior.
• Patch on a scheduleOperating systems, browsers, and third-party apps — unpatched software is a leading way attackers get in.
• Manage mobile devicesIf staff use phones for clinical messaging, use mobile device management so you can wipe a lost device.

5. Backups and disaster recovery

• Back up ePHI automaticallyFollow the 3-2-1 rule: three copies, two types of media, one offsite or in the cloud.
• Keep at least one backup immutable or offlineRansomware actively hunts for backups and tries to encrypt or delete them.
• Test restores regularlyA backup you’ve never restored is a guess. Prove you can recover, and time it.
• Document a contingency planWrite down how the practice keeps seeing patients if systems are down for a day — or a week.

6. Monitoring, logging, and incident response

• Collect and review audit logsTrack who accessed patient records and when, and review the logs — not just store them.
• Monitor systems around the clockAttacks often start at night or on weekends, when no one is watching.
• Have an incident response planKnow who to call, how to contain an incident, and how breach notification timelines work.

7. People and policies

• Train staff at hire and at least annuallyCover phishing, password hygiene, and how to report a suspected incident.
• Run phishing simulationsShort, regular simulations change behavior far more than a yearly slideshow.
• Keep written policies — and follow themRegulators look for documented policies and evidence they’re actually in use.
• Retain documentation for six yearsHIPAA requires you to keep required policies and records for six years.

What’s changing: the proposed Security Rule update

In January 2025, HHS proposed the most significant update to the HIPAA Security Rule since it was written. As of October 2026, it is still a proposal — no final rule has been published, and the current rule remains in force. Reported timelines point to a possible final rule in 2027, with a compliance window after that.

If finalized as proposed, it would make several of the items above explicitly mandatory rather than “addressable,” including:

• Encryption of ePHI at rest and in transit, with limited exceptions
• Multi-factor authentication across systems that handle ePHI
• A written technology asset inventory and network map, reviewed regularly
• Vulnerability scanning at least twice a year and penetration testing annually
• The ability to restore critical systems within 72 hours

The final version may differ. But every one of these is already a best practice — and most cyber insurers already ask for MFA, EDR, and tested backups. Practices that implement them now won’t be scrambling later.

Where small practices most often fall short

1. No current risk analysis — or one done years ago and never revisited.
2. Missing BAAs with IT providers, cloud backup, or email services.
3. Unencrypted laptops that turn a simple theft into a reportable breach.
4. Backups that have never been restored, discovered only during a ransomware attack.
5. Shared logins that make audit trails meaningless.

Getting help

Most small practices don’t have a full-time IT security person — and they shouldn’t need one to stay compliant. Cyborpixel’s HIPAA-ready managed IT plan includes a signed Business Associate Agreement, annual risk assessments, encryption, EDR, tested backups, and a compliance documentation pack, alongside 24/7 monitoring and help desk support.

Not sure where your practice stands? Request a free IT assessment and we’ll map your current setup against this checklist. You can also read how managed IT compares to hiring in-house.

Last updated October 12, 2026