A small clinic with no risk assessment and no HIPAA policies risks fines, and has nothing on paper to defend itself. Fines start at $145 per violation. They can reach $2,190,294 per violation for willful neglect that is not fixed within 30 days. Being small is no excuse: the Security Rule covers practices of every size.
HIPAA has no exemption for small practices. The Security Rule is the HIPAA rule that protects electronic patient data. It applies to every covered entity and business associate, which are the practices and vendors HIPAA covers.
Size does not matter. One thing the rule requires is a written Security Risk Assessment. The rule calls this a risk analysis. If you never did one, you have no record showing you looked for risks to patient data.
If your small clinic has no risk assessment and no HIPAA policies in place, you are not “flying under the radar.” You are one patient complaint away from an investigation where you have nothing to show.
What a Small Healthcare Practice Actually Risks Without Compliance
The Security Rule applies to every covered entity that handles electronic Protected Health Information (ePHI), as defined under 45 CFR 160.103. That includes solo practitioners, small clinics, group practices, health plans, covered entities of all sizes, and any business associate that touches patient data on their behalf. The rule applies regardless of whether you have 3 employees or 3,000.
Here’s what “no compliance” actually looks like from an enforcement perspective:
No Security Risk Assessment means:
- You cannot demonstrate the risk assessment process required under 45 CFR 164.308(a)(1)(ii)(A) (the rule calls it a risk analysis).
- You have no written list of the threats to your systems, workflows, or physical space.
- You have no way to choose safeguards (the protections you put in place), because you never figured out what you are protecting against.
- OCR (the Office for Civil Rights at HHS) enforces HIPAA. If OCR asks for your risk assessment and you have none, you have nothing to show.
No written HIPAA policies means:
- No evidence of administrative safeguards (the largest section of the Security Rule).
- No proof staff were trained on anything.
- No incident response plan for when a breach occurs.
- No documentation showing how you protect ePHI during day-to-day patient care.
No Business Associate Agreements means:
- Every vendor with access to patient data represents an unmanaged risk.
- Your EHR vendor, billing company, IT support, cloud storage, shredding service: each one needs a signed BAA if it handles patient data for you.
- One Guy Consulting helps small healthcare practices and business associates close exactly these gaps.
The Enforcement Math
HIPAA penalties come in tiers, starting at $145 per violation when a practice did not know it was breaking the rule. The top tier is $2,190,294 per violation for willful neglect that is not fixed within 30 days. Willful neglect means ignoring the rule on purpose, or recklessly. In that tier, the yearly cap for repeats of the same violation is also $2,190,294. A small clinic with no policies, no SRA, and no BAA management isn’t facing one violation. Each missing safeguard can be counted as a separate violation.
The level of risk compounds fast. A 4-provider behavioral health practice with 8 staff, 3 vendors, and no compliance program could have gaps in all three kinds of safeguards: administrative (policies and people), physical (rooms and devices), and technical (computer settings).
Identifying the Gaps: Where Small Clinics Typically Start
Small clinics with no compliance program often share the same starting point:
- No SRA ever conducted: They know the requirement exists but never completed the risk assessment process.
- Policies downloaded once, never implemented: A PDF sits in a folder that no employee has read.
- Vendors operating without BAAs: The EHR company probably has one, but IT support, the answering service, and the billing company do not.
- Training is informal: “We told everyone to be careful” does not meet the standard under 45 CFR 164.308(a)(5).
- No incident response: When something goes wrong, there’s no written plan for identifying, containing, or reporting it.
This isn’t negligence by intent. It’s what happens when a small clinic (whether a 2-provider dental office, a chiropractic practice, or a behavioral health group) lacks the internal bandwidth to build a compliance program from scratch. The type of risk isn’t technical. It’s organizational.
What “Getting Compliant” Actually Involves
The risk assessment process is the foundation. Everything else builds from it. A proper SRA identifies:
- Where ePHI lives in your environment (systems, devices, paper).
- What threats exist (external attacks, internal errors, physical theft).
- What weak spots (vulnerabilities) each threat could take advantage of.
- What safeguards are already in place and what is missing.
- The level of risk for each identified gap.
From there, written policies document how your practice handles each requirement. Training ensures staff understand their responsibilities. BAA management ensures every vendor relationship is covered. Ongoing monitoring ensures nothing drifts.
If you have not done a HIPAA risk assessment yet, start there first, document the gaps you find, and then write the policies and procedures needed to fix them. HHS says the Security Rule requires a risk analysis and written policies and procedures, with documentation maintained over time.
The Security Rule lets a small practice fit this work to its size, budget, and systems (45 CFR 164.306(b)). It is not a years-long, big-company project.
FAQs
Does state law require anything beyond federal HIPAA?
Yes. Many states have breach notification laws, patient privacy statutes, and health and safety requirements that exceed HIPAA minimums. Texas, California, and New York impose additional penalties for healthcare data exposure. Your compliance program should address both federal and applicable state requirements.
Can a small clinic handle HIPAA compliance without outside help?
Technically yes, but most small practices lack the bandwidth. The Department of Health and Human Services provides guidance, but translating regulations into operational policies, training materials, and documentation requires subject matter expertise that most 3-10 person offices don’t have in-house.
What’s the difference between a risk assessment and a gap analysis?
A Security Risk Assessment identifies threats and vulnerabilities to ePHI and assigns risk levels. A gap analysis compares your current safeguards against HIPAA requirements and identifies what’s missing. The Security Rule requires the SRA. A gap analysis is not required, but it shows you what to fix first.
How often does the risk assessment need to be updated?
The current Security Rule does not set a fixed schedule. It says to keep managing risk and to review your safeguards from time to time (45 CFR 164.308(a)(1) and (a)(8)). HHS guidance says some practices update the risk assessment every year, and others as needed. Either way, update it whenever something big changes (new systems, new locations, workforce changes, security incidents). A rule proposed in January 2025 would require a yearly review. It is only a proposal, not law.
A small clinic operating with no risk assessment and no HIPAA policies has no defensible position in an investigation. The fix is straightforward: conduct the SRA, implement policies, train staff, manage BAAs, and document everything. A practice that started and made mistakes has records to show. A practice that never started has none.
One Guy Consulting offers affordable HIPAA compliance packages for practices of all sizes. One Guy Consulting HIPAA compliance packages
Sources
- HHS OCR Enforcement Highlights.
- 45 CFR 160.103: Definitions.
- Security Rule Guidance on Risk Analysis.
- 45 CFR 164.308: Administrative Safeguards.
- OCR HIPAA Penalty Structure.