HIPAA compliance checklist for clinics

A practical HIPAA checklist for clinics that need to organize safeguards, vendors, training, access reviews, risk analysis, and audit evidence.

Start free Browse resources

Start with the three safeguard families

The HIPAA Security Rule is easiest to operationalize when the clinic maps work into administrative, physical, and technical safeguards. That keeps policy, building access, device security, user access, vendors, and workforce behavior from living in separate spreadsheets.

Administrative: risk analysis, policies, workforce training, vendor oversight, incident response.
Physical: facility access, workstation placement, device disposal, media controls.
Technical: MFA, access controls, audit logs, encryption, backups, endpoint protection.

Turn each checklist item into evidence

A checklist only helps if every item has a current owner, a status, and a place where evidence lives. For example, MFA is not just a policy statement; it needs an export, screenshot, connector observation, or access review that proves the control is operating.

Review the list after real changes

A clinic should revisit the checklist after onboarding a new EHR, changing billing vendors, opening a new location, adding remote staff, or responding to an incident. Those are the moments when old assumptions drift from reality.

Clinic HIPAA readiness checklist

Assign privacy and security responsibility.

Complete and document a security risk analysis.

Maintain a remediation plan for high-priority gaps.

Document HIPAA and security awareness training completion.

Keep business associate agreements current for PHI-handling vendors.

Run recurring access reviews for core systems.

Require MFA for email, EHR-adjacent systems, remote access, and admin accounts.

Document backup success and restore testing.

Track incidents, investigation notes, and corrective actions.

Store audit evidence in a consistent, searchable location.