⚡ Limited Availability — Accepting 3–4 New Clients This Quarter  |  Schedule Your Free Risk Review →

Healthcare · Free Resource

HIPAA IT Compliance Checklist

The 12 Security Rule safeguards every NYC medical practice needs in place — administrative, physical, and technical — with a plain-English score guide. Save this page or print it (Ctrl/Cmd+P).

1
Administrative
Written risk assessment on file, updated within 12 months
A formal HIPAA Security Risk Assessment — not a memory of "we checked this once" — covering every system that touches PHI.
2
Administrative
Security Officer designated in writing
HIPAA requires a named individual accountable for the security program — this can't be an implied responsibility.
3
Administrative
Business Associate Agreements (BAAs) signed with every vendor touching PHI
EHR vendor, billing service, cloud storage, IT provider, and any AI tool staff use — each needs a signed BAA before PHI reaches it.
4
Technical
Unique login per staff member — no shared credentials
Shared logins make it impossible to know who accessed what, which is the first thing an auditor checks.
5
Technical
Multi-factor authentication (MFA) on every system touching PHI
Email, EHR, remote access — MFA is the single highest-leverage control against the credential-theft attacks that lead to most breaches.
6
Physical
Automatic session timeout / screen lock on all workstations
An unattended, unlocked screen in a shared clinical space is a walk-up PHI exposure.
7
Technical
Encryption at rest for all PHI
EHR database, backups, and any laptop or device that stores patient data — encrypted, not just password-protected.
8
Technical
Encryption in transit
Email containing PHI and patient-portal traffic both need to be encrypted end to end, not sent as plain text.
9
Technical
Audit logging enabled and actually reviewed
Logging who accessed what, when, only matters if someone periodically looks at it — not just that the feature is switched on.
10
Administrative
Documented backup and disaster recovery plan, tested at least annually
A backup that has never been test-restored is a hope, not a plan.
11
Administrative
Annual security awareness training, documented
Every staff member, every year, with a record of who completed it — this is standard evidence requested in an HHS review.
12
Administrative
Written incident response / breach notification plan
Including who does what in the first 24 hours, and the 60-day clock for HHS notification if PHI is exposed.

Score Yourself

10–12 checked Strong postureMinor gaps — worth a second look, not an emergency.
6–9 checked Moderate exposureReal gaps — plan to close these this quarter.
0–5 checked High riskAct now — this is the profile of a practice an audit or a breach would go badly for.

This page is yours to keep — bookmark it, print it, or share it with your practice administrator.

Free Consultation

Want Wlad to Score This For You?

Book a free 30-minute Risk Review. Wlad will walk your actual environment against this exact checklist and give you a written report within 24 hours — at no charge.

Schedule My Free Risk Review →

Questions first? Send us a message or call (516) 734-1515