A practical HIPAA compliance checklist covering risk analysis, safeguards, business associate agreements and breach response.
HIPAA applies to covered entities and their business associates, including many software and cloud vendors that handle protected health information (PHI). There is no official HIPAA certification, so compliance means demonstrating safeguards and documentation.
Core checklist
- Perform a security risk analysis. Identify where ePHI lives, threats, vulnerabilities and risk levels, and document it.
- Implement administrative safeguards. Assign a security official, define policies, train the workforce and manage access.
- Implement physical safeguards. Facility access, workstation security and device and media controls.
- Implement technical safeguards. Unique user IDs, MFA, access controls, audit logging, integrity controls and encryption in transit and at rest.
- Sign business associate agreements (BAAs) with vendors that touch PHI.
- Create an incident and breach response plan aligned with the Breach Notification Rule.
- Plan for contingency: backups, disaster recovery and emergency operations.
- Review regularly. Update the risk analysis when systems or processes change.
Cloud considerations
Running on Azure, AWS or Google Cloud does not make you compliant by itself. You share responsibility: configure access, logging, encryption and network controls correctly, and use services covered under the provider’s BAA.
Documentation matters
Regulators and customers expect written policies, risk analyses, training records and evidence that controls operate. Keep them current and accessible.
Our HIPAA compliance consulting supports healthcare organizations and their vendors with risk analysis, safeguards and readiness. We provide guidance, not legal advice.
business associate agreementhealthcare complianceHIPAA compliance checklistHIPAA security rule
