HIPAA Compliance Checklist for Small Medical Practices

Why This Checklist Exists

There are roughly 800,000 medical practices in the United States. 47.4% of physicians work in practices of 10 or fewer. These practices are subject to the same HIPAA requirements as hospital systems with dedicated compliance departments.

Most small practices don’t ignore compliance. They just don’t have a clear picture of what “compliance” actually requires. The regulations are dense, the guidance is vague, and the consulting industry profits from making it seem more complicated than it is.

This checklist covers the practical requirements. No jargon, no fear-mongering, just the steps your practice needs to take and maintain.

Step 1: Designate a Privacy and Security Officer

HIPAA requires a designated Privacy Officer (responsible for PHI privacy policies) and a Security Officer (responsible for ePHI security measures). In a 5-person practice, one person typically fills both roles.

This is a documented designation. Put it in writing, date it, and file it. If the person leaves, document the new designee. Auditors check for this.

Step 2: Conduct a Risk Assessment

The risk assessment sits at the base of your HIPAA compliance program. It’s also the most common deficiency found in enforcement actions.

A risk assessment identifies every place your practice creates, receives, stores, or transmits protected health information. Then it evaluates the threats and vulnerabilities associated with each one. Then it documents what you’re doing to mitigate those risks.

For a small practice, this covers: your EHR system, paper records, email, fax machines, phones, task management tools, cloud storage, messaging apps, and any vendor who touches patient data.

You don’t need a consultant to do this. You need a structured format (software like PHIGuard, a template from HHS.gov, or even a detailed spreadsheet) and 4-8 hours to work through it honestly.

Step 3: Write and Implement Policies

Your practice needs written policies. Not a binder you bought from a consultant that sits on a shelf. Actual policies that reflect how your practice operates.

At minimum: a privacy policy (who accesses PHI and under what circumstances), a security policy (passwords, encryption, device management), a breach notification policy (what to do when something goes wrong), and a minimum necessary policy (staff only access the PHI they need for their specific task).

Template policies are fine as a starting point. Customize them to match your practice’s actual workflows.

Step 4: Train All Staff

Every person in your practice who handles PHI needs HIPAA training. This includes the physicians, nurses, medical assistants, receptionists, billing staff, cleaning crew (if they can access areas with PHI), and any contractors or volunteers.

Training must happen at hire and annually thereafter. Document who attended, what was covered, and when it occurred. A sign-in sheet with the training date and topics covered is the minimum documentation.

Step 5: Set Up Compliant Tools

Audit every tool your practice uses. If it touches PHI, you need a BAA from that vendor. Common tools that require BAAs: EHR systems, task management software, email providers, cloud storage, fax services, messaging platforms, appointment scheduling tools, and billing systems.

If a vendor won’t sign a BAA, you can’t use that tool with PHI. That includes popular consumer tools like standard Gmail, Slack (without Enterprise), Trello (without Enterprise), and most free collaboration tools.

Step 6: Document Everything

The documentation requirement is where most small practices fall short. You might be doing everything right (training staff, conducting risk assessments, maintaining policies) but if you can’t produce the records during an audit, it doesn’t count.

Keep records of every risk assessment (current and historical), every policy version and update date, every training session and attendee list, every BAA, and every incident or near-miss. HIPAA requires retaining these records for six years.

This is where compliance software pays for itself. PHIGuard’s compliance dashboard tracks all of these requirements in one place, so when an auditor asks for your risk assessment history or training records, you pull them up in seconds instead of digging through filing cabinets.