How to Become HIPAA Compliant: A Step-by-Step Guide for Small Practices

Step 1: Designate a Privacy Officer and Security Officer

Every covered entity needs a named Privacy Officer and a named Security Officer. The Privacy Officer owns your privacy policies and handles patient rights requests. The Security Officer owns your technical and physical security safeguards.

In small practices, one person holds both roles. That’s fine and common. What’s not optional: documenting it. Write down the name and the date they took on the role. If that person leaves, update the documentation immediately and designate a replacement before their last day.

OCR auditors ask for this documentation early. “We all kind of handle it together” is not an answer that satisfies an audit.

Step 2: Conduct a risk analysis

A risk analysis identifies every place your practice creates, stores, or transmits electronic protected health information (ePHI), then evaluates the threats to each location.

Start by listing every system: your EHR, scheduling software, billing platform, email, task management tool, cloud file storage, laptops, workstations, tablets, smartphones, and any fax machines that handle PHI. For each one, document what threats exist (ransomware, device theft, employee error, vendor breach), what vulnerabilities are present (weak passwords, no encryption, outdated software), and what safeguards you currently have in place.

Rate each risk as high, medium, or low based on likelihood and potential impact. Write a remediation plan for anything rated high or medium.

HHS provides a free Security Risk Assessment (SRA) tool that structures this process. A 10-person practice can complete an initial assessment in 4-8 hours. Update it annually, and whenever something significant changes: a new software tool, an office move, a major staff change.

Step 3: Write your policies

Your practice needs four written policies at minimum:

A privacy policy covering how staff access and handle PHI, including the minimum necessary standard (staff should access only the PHI they need for their specific job function).

A security policy covering technical safeguards (encryption, access controls, audit logging) and physical safeguards (workstation placement, screen locks, locked file cabinets for paper records).

A breach notification policy describing how your practice identifies, contains, and reports a breach, including your 60-day notification window to affected patients.

A workforce training policy covering when training happens, what it covers, and how you document it.

Template policies are available from multiple sources and work fine as starting points. The key step is customizing them to your actual workflows, not filing away a template that describes a practice that doesn’t resemble yours.

Step 4: Train all staff

Training applies to everyone in your workforce: full-time staff, part-time staff, contractors, temps, and volunteers. It must happen at onboarding and annually after that.

Document each training session with a date, the topics covered, and a list of who attended. A sign-in sheet works. A learning management system works better if you have staff turnover, because it keeps records automatically.

The content doesn’t need to be elaborate. Staff need to understand what PHI is, how your practice handles it, what they are and aren’t allowed to do with patient information, how to recognize a phishing attempt, and what to do if they think a breach occurred.

Step 5: Sign BAAs with every vendor that touches PHI

A Business Associate Agreement (BAA) is a contract that makes a vendor legally responsible for protecting any PHI they handle on your behalf. If a vendor stores or transmits PHI and won’t sign a BAA, you cannot legally use them with patient data.

Work through your tool stack: EHR, scheduling software, billing platform, task management, email provider, file storage, texting service, analytics tools. For each one, confirm whether PHI flows through it, and whether you have a signed BAA on file.

Common gap: personal Gmail or Google Drive. Consumer Google accounts don’t come with BAA coverage. Google Workspace (paid) can be HIPAA-configured and includes a BAA. Consumer accounts cannot.

Keep copies of every executed BAA in your compliance files.

Step 6: Document everything

Compliance is documentation. An audit doesn’t test whether you did the right things. It tests whether you can prove you did.

Keep records of your risk assessments (including the date and who conducted them), your policy documents (with version dates each time you update them), staff training (attendee names, dates, topics), signed BAAs, and any incidents or breaches.

HIPAA requires retaining most compliance records for six years from creation or last effective date, whichever is later. Use a folder structure that makes these records easy to pull: auditors ask for them, and scrambling to find a two-year-old training sign-in sheet is not a situation you want to be in.

Compliance software (including PHIGuard) automates this record-keeping. Shared drives and spreadsheets work too, as long as someone is maintaining them consistently.

The practices that get into trouble with OCR audits usually didn’t skip the actual compliance work. They just couldn’t prove they did it.