98% of Practice Managers Believe They're HIPAA-Compliant. The Data Says Otherwise.

The confidence-compliance gap in small medical practices is one of the clearest patterns in HIPAA enforcement research. Practice managers are not dishonest about their compliance status — they believe what they say. The problem is that what they believe has very little connection to what HIPAA actually requires.

The Confidence Gap

These two numbers cannot both be right. If 98% of managers believe they are compliant and only 35% have completed a required compliance element, then roughly 63% of managers have an incorrect picture of their own compliance status.

The gap is not explained by managers lying on surveys. It comes from a mismatch between what managers understand “HIPAA compliance” to mean and what HIPAA actually requires.

What Small Practices Are Actually Doing: The Data

<DataTableBlock caption=“HIPAA Compliance Activity in Small Practices (Paubox, 2025 / NueMD, 2014)” columns={[“Compliance Activity”, ”% Completed”, “Source”]} rows={[ [“Believe they are fully HIPAA-compliant”, “98%”, “Paubox 2025”], [“Have any compliance plan”, “55–58%”, “NueMD 2014 / Paubox 2025”], [“Have designated a Privacy Officer”, “~55%”, “NueMD 2014”], [“Have completed a security risk analysis”, “35%”, “Paubox 2025”], [“Have evaluated all BAA relationships”, “24%”, “Paubox 2025”], [“Have implemented secure email protocols”, “1%”, “Paubox 2025”], [“Have a comprehensive compliance program”, “20–34%”, “NueMD 2014”], ]} />

The data tells a consistent story. Most practices have done the most visible, once-at-setup steps — like signing a BAA with their EHR and knowing what HIPAA is. Far fewer have done the ongoing, documented, programmatic work that OCR actually checks: risk analysis updates, BAA inventories, training records, and written policies.

The 1% secure email implementation rate is particularly striking. Nearly every email used in clinical coordination goes through Gmail, Outlook consumer, or a similar non-HIPAA-configured provider. Practices using them believe their EHR handles email compliance. It doesn’t.

Why the Gap Exists

Three structural factors create the compliance confidence gap.

HIPAA’s complexity is real. HIPAA is not one rule — it is three rules (Privacy Rule, Security Rule, Breach Notification Rule) with multiple implementation specifications, each of which requires specific documentation. A practice manager without a compliance background cannot intuit the requirements from general HIPAA awareness. Most small practices never receive a formal explanation of what the program requirements actually are.

EHR vendors claim HIPAA coverage they don’t provide. Every major EHR markets itself as HIPAA-compliant. This is true in a narrow sense: the EHR vendor signs a BAA and operates its system with appropriate safeguards. But managers frequently interpret “our EHR is HIPAA-compliant” as “we are HIPAA-compliant because we use an EHR.” The EHR BAA covers the EHR relationship. It does not cover the 15 other tools clinical staff use to coordinate patient care.

There is no compliance deadline or certification. HIPAA has no annual compliance certification, no license renewal that requires documented compliance, and no routine audit trigger. The only external check is an OCR complaint or breach investigation. Practices operate for years without anyone asking to see their risk analysis, and assume that the absence of problems means compliance is fine.

The Consumer Tools Problem

The most pervasive compliance gap is also the most invisible: widespread use of consumer tools for PHI coordination.

Consumer SMS apps — iMessage, standard texting, WhatsApp — will not sign BAAs for consumer tiers. Using them for PHI creates a violation regardless of whether staff understand the risk. The practice is responsible, not the individual staff member’s tool choice.

The same applies to consumer Gmail, standard Microsoft accounts without HIPAA configuration, and consumer versions of collaboration tools like Slack (non-Enterprise) and Google Workspace (without BAA configuration). Many of these tools are actively marketed to healthcare organizations. Marketing language like “secure messaging for healthcare” does not mean the tool has a BAA available.

Practices that have signed a BAA with one communication vendor sometimes assume that covers their communication compliance broadly. It does not. Each tool category — email, task management, messaging, file storage — requires its own BAA.

What “HIPAA-Compliant” Actually Requires

The three HIPAA rules each impose distinct requirements on a small practice.

Privacy Rule. Designate a Privacy Officer. Write and post a Notice of Privacy Practices. Establish minimum necessary use policies (staff access only the PHI needed for their task). Handle patient access requests. Train all staff.

Security Rule. Conduct a documented security risk analysis. Implement technical safeguards (encryption, access controls, audit logs). Implement physical safeguards (workstation policies, device controls). Implement administrative safeguards (documented policies, designated Security Officer, workforce training). Sign BAAs with all vendors handling electronic PHI.

Breach Notification Rule. Know what constitutes a reportable breach. Notify affected individuals within 60 days of discovery. Report breaches affecting 500+ individuals to OCR within 60 days. Report smaller breaches in annual summaries.

Most practices that say “we’re HIPAA-compliant” have done pieces of this. Most have not done all of it in a documented, auditable way.

Closing the Gap Without a Compliance Department

The compliance gap is real but manageable. Four steps address the most common deficiencies in priority order.

Step 1: Complete a security risk analysis. This is OCR’s #1 enforcement target. Use HHS’s free Security Risk Assessment Tool at healthit.gov. Document every place PHI exists in your practice — EHR, email, task tools, phones, paper records. Assess threats. Record what you find. Update it annually.

Step 2: Conduct a BAA inventory. List every vendor your practice uses that touches PHI. Check whether a signed BAA exists for each one. Common gaps: email provider, task management tool, cloud storage, billing service, fax service, IT support vendor. Any gap is a violation. Fix it by either getting the BAA or switching to a vendor that will sign one.

Step 3: Run documented workforce training. Every staff member who touches PHI needs annual training. Use an e-learning platform that produces completion records. Keep records for 6 years — it’s the documentation OCR asks for.

Step 4: Replace consumer tools with HIPAA-compliant alternatives. This is the step most practices delay. Staff are used to their tools. But the compliance exposure from consumer SMS and non-BAA-covered messaging accumulates daily. HIPAA-native task and workflow tools that sign BAAs exist at every price point, including flat-rate options that don’t penalize practices for having more than a few staff.