Complete Process

The Complete HIPAA Compliance Process

Eight steps from discovery through annual sustainment, with CFR citations and realistic timelines for small healthcare practices. This is the systematic approach OCR expects to see.

See the Eight Steps Book Your Free 30-Minute Intro Call
8steps, discovery through annual sustainment
6 yrsrecords kept, per 45 CFR 164.530(j)
1/yrminimum program review
1–25staff, the small practices this is written for
Diagram: the eight-step HIPAA compliance process in order: scope and risk assessment, policies and training, BAAs and incident response, evidence and documentation, annual review.
Why This Matters

Why a Defined Compliance Process Matters

OCR does not just check whether you have individual safeguards in place. They evaluate whether your organization follows a systematic, documented approach to protecting patient information. The Security Rule under 45 CFR 164.306(a) requires covered entities and business associates to ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit.

A defined process turns compliance from a guessing game into an operational system.

Each step builds on the previous one. Skipping steps or addressing them out of order creates gaps that OCR specifically looks for during investigations.

If you are starting from scratch or unsure where your practice stands, our HIPAA starting point guide covers the first priorities. For a phased checklist approach, see the HIPAA starter checklist.

The Process

Eight Steps to HIPAA Compliance

  1. 01

    Discovery & Scope Assessment

    Identify the boundaries of your compliance program: which locations, systems, and workforce members handle PHI. Document your current state against the requirements of 45 CFR 164.306(a). This determines what the remaining seven steps need to cover.

    HIPAA gap analysis services
    164.306(a)
    Key deliverablesPHI inventory, system inventory, workforce roster, scope document.
  2. 02

    Security Risk Assessment

    Conduct a thorough SRA as required by 45 CFR 164.308(a)(1)(ii)(A). Identify every system, device, and workflow that stores, transmits, or accesses ePHI. Document threats and vulnerabilities, rate risk levels, and create a prioritized remediation plan. This is the most commonly cited deficiency in OCR enforcement actions. See how the gap analysis and remediation plan are built from the SRA.

    Security Risk Assessment requirements and process
    164.308(a)(1)(ii)(A)
    Key deliverablesCompleted SRA report, risk register, remediation plan with timelines.
  3. 03

    Policy & Procedure Development

    Develop written policies and procedures that comply with the Security Rule as required by 45 CFR 164.316(a). Policies must reflect how your practice actually operates, not how a generic template assumes you operate. At minimum, cover privacy, security management, access control, training, device controls, incident response, BAA management, facility access, contingency planning, and sanctions.

    HIPAA policy templates for small practices
    164.316(a)
    Key deliverablesCustomized policy manual, procedure documents, adoption records.
  4. 04

    Workforce Training

    Train every workforce member who handles PHI before they access patient information, as required by 45 CFR 164.308(a)(5)(i). Training must cover the Privacy Rule, Security Rule, breach reporting, phishing awareness, and your practice-specific policies. Document completion with signed attestations and schedule annual refresher training.

    HIPAA training requirements and program details
    164.308(a)(5)(i)
    Key deliverablesTraining curriculum, completion records, signed attestations, refresher schedule.
  5. 05

    BAA Management

    Identify every vendor and subcontractor that creates, receives, maintains, or transmits PHI on your behalf. Execute Business Associate Agreements as required by 45 CFR 164.502(e) and 164.308(b)(1). Maintain a current BAA inventory and review vendor compliance annually.

    BAA management and vendor compliance
    164.502(e)164.308(b)(1)
    Key deliverablesVendor inventory, executed BAAs, annual review schedule.
  6. 06

    Incident Response & Breach Preparedness

    Establish an incident response plan covering breach identification, containment, risk assessment, notification timelines, and documentation. Meet the notification requirements of 45 CFR 164.404(b), 164.406, and 164.408. Conduct tabletop exercises so your team knows what to do before a breach occurs.

    Incident response and breach management
    164.404(b)164.406164.408
    Key deliverablesIncident response plan, notification procedures, tabletop exercise records.
  7. 07

    Evidence Packaging & Documentation

    Organize and retain all compliance documentation for at least six years as required by 45 CFR 164.530(j). This includes your completed SRA, written policies, training records, BAA inventory, incident reports, and remediation evidence. If OCR investigates, this documentation is your evidence of a systematic compliance effort.

    Documentation requirements and starting point
    164.530(j)
    Key deliverablesOrganized compliance binder, document retention schedule, evidence index.
  8. 08

    Annual Review & Sustainment

    Review and update your entire compliance program at least annually, as required by 45 CFR 164.530(a)(1) and 164.308(a)(2). Reassess risks when systems or workflows change, update policies accordingly, retrain staff, verify BAA currency, and test your incident response plan. Compliance is not a one-time project.

    Vendor management and annual review services
    164.530(a)(1)164.308(a)(2)
    Key deliverablesAnnual review report, updated SRA, policy revision log, training refresher records.
Realistic Timeline

How Long Does This Take?

For a small practice with 1 to 25 staff members, the initial compliance process takes weeks, not months, when working with a consultant. Here is the order the work happens in:

First

Steps 1 & 2

Discovery, scoping, and Security Risk Assessment

Next

Steps 3 & 4

Policy development and workforce training

Then

Steps 5 & 6

BAA management and incident response planning

After that

Step 7

Evidence packaging and documentation organization

Ongoing

Step 8

Annual review and continuous sustainment

Timelines vary based on practice size, complexity, and existing documentation. Larger organizations or those with multiple locations may need additional time.

Your Options

Two Ways to Work Through This

Two plans, six ways to pay. No per-user fees.

For advanced users
Self-Guided
$675 / yr
or $60 / month, or $1,175 / 24 months

Portal access with templates, training modules, and guided workflows. You work through each step at your own pace with built-in checklists and documentation tools.

View Plan Details
Most popular
Full-Scope Consulting
$1,300 / yr
or $120 / month, or $2,300 / 24 months

A Certified HIPAA Professional walks you through every step. Includes your SRA, custom policies, staff training, BAA review, and ongoing support, with 4 hours a month of 1:1 implementation calls with Chuck.

View Plan Details

Secure checkout by Stripe. Your payment details go straight to Stripe and never touch our servers.

Common Questions

HIPAA Compliance Process FAQ

What are the steps to HIPAA compliance?+
HIPAA compliance generally follows eight steps: (1) Discovery and scope assessment under 45 CFR 164.306(a), (2) Security Risk Assessment under 45 CFR 164.308(a)(1)(ii)(A), (3) Policy and procedure development under 45 CFR 164.316(a), (4) Workforce training under 45 CFR 164.308(a)(5)(i), (5) BAA management under 45 CFR 164.502(e) and 164.308(b)(1), (6) Incident response and breach preparedness under 45 CFR 164.404(b), 164.406, and 164.408, (7) Evidence packaging and documentation under 45 CFR 164.530(j), and (8) Annual review and sustainment under 45 CFR 164.530(a)(1) and 164.308(a)(2). Each step builds on the previous one. Organizations should consult legal counsel for guidance specific to their situation.
How long does HIPAA compliance take?+
For a small practice with 1 to 25 staff members, the initial compliance process takes weeks, not months, when working with a consultant. Discovery and the Security Risk Assessment under 45 CFR 164.308(a)(1)(ii)(A) come first. Policy development under 45 CFR 164.316(a) and training under 45 CFR 164.308(a)(5)(i) follow. BAA management and incident response planning come next, then documentation packaging. Annual sustainment under 45 CFR 164.530(a)(1) is then ongoing. Timelines vary based on practice size, complexity, and existing documentation.
What is the first step toward HIPAA compliance?+
The first step is a discovery and scope assessment: identifying which locations, systems, workforce members, and vendors handle protected health information in your organization. This is grounded in the general requirements of 45 CFR 164.306(a), which require covered entities to ensure the confidentiality, integrity, and availability of all ePHI they create, receive, maintain, or transmit. Without understanding the boundaries of your compliance program, subsequent steps like the Security Risk Assessment under 45 CFR 164.308(a)(1)(ii)(A) cannot be scoped accurately.
Can a small practice achieve HIPAA compliance without a consultant?+
A small practice can work through the compliance process independently using self-guided tools and templates. The regulatory requirements under 45 CFR Parts 160 and 164 apply regardless of whether a consultant is involved. Self-guided approaches work best for practices that have someone on staff with time to manage the process and familiarity with the Security Rule under 45 CFR 164.308 and the Privacy Rule under 45 CFR 164.530. Practices with limited internal resources or no prior compliance documentation may benefit from professional guidance to avoid common gaps in their Security Risk Assessment and policy development.
Start here

Ready to Start Your Compliance Journey?

One Guy Consulting works directly with small practices to build HIPAA compliance programs from scratch. A Certified HIPAA Professional walks you through every step.

Book Your Free 30-Minute Intro Call See plans and pricing
Related Reading

Learn More About HIPAA Compliance

What to do first when your clinic has no HIPAA risk assessment HIPAA starter checklist for small practices HIPAA compliance consulting services Security Risk Assessment requirements and process HIPAA compliance frequently asked questions Full pricing comparison with plan details
One Guy Consulting

Explore Our Other HIPAA Services

Security Risk Assessment HIPAA Gap Analysis Policy Templates HIPAA Staff Training BAA Management Vendor Management

This content is for educational and informational purposes only and should not be construed as legal advice.

OGC-BotHi! What can I help you with?