HIPAA FAQ for Small Healthcare Practices

At minimum, small practices need policies covering the HIPAA Privacy Rule, Security Rule, and Breach Notification Rule. The essential policies include:

• Privacy Policy (Notice of Privacy Practices)
• Security Management Process policy
• Access Control and Authorization policy
• Workforce Training policy
• Device and Media Controls policy
• Incident Response and Breach Notification policy
• Business Associate Agreement policy
• Facility Access Controls policy
• Contingency and Disaster Recovery policy
• Sanctions Policy

These ten policies form the minimum foundation. Depending on practice complexity, additional policies may be needed for areas such as audit controls, information system activity review, and transmission security. View the full HIPAA policy template library.

Not necessarily. The number of policies you need depends on the complexity of your practice. A solo provider may need 15 to 20 core policies. A 10-person multi-location practice may need 30 to 40. The key is to adopt policies that match your actual operations and environment rather than using a generic set.

A HIPAA Gap Analysis identifies exactly which policies you are missing so you are not guessing or over-building.

The Privacy Rule requires training for each new workforce member "within a reasonable period of time after the person joins the covered entity's workforce" and for each member whose functions are affected by a material change in the policies or procedures (45 CFR 164.530(b)(2)(i)(B) and (C)). The Security Rule's training standard adds "Periodic security updates" as an addressable implementation specification (45 CFR 164.308(a)(5)(ii)(A)) and sets no interval. Neither section sets a yearly schedule; an annual refresher is a schedule a practice may choose.

Training should cover the Privacy Rule, Security Rule, Breach Notification procedures, phishing awareness, and your organization's specific policies.

Training completion should be documented with sign-off attestations proving each employee completed the required material. View HIPAA training requirements.

Effective HIPAA training covers:

• Privacy Rule basics: what PHI is, minimum necessary standard, patient rights
• Security Rule basics: password policies, workstation security, mobile device handling
• Breach Notification: how to recognize and report a potential breach internally
• Phishing and social engineering: recognizing suspicious emails, phone calls, and links
• Your practice-specific policies: where PHI is stored, who has access, disposal procedures

Training should be documented with sign-off attestations proving each employee completed it.

A breach is the acquisition, access, use, or disclosure of unsecured PHI in a manner not permitted by the Privacy Rule, as defined in 45 CFR 164.402.

Under the HIPAA Breach Notification Rule, if a breach of unsecured PHI occurs, you must:

1. Notify affected individuals within 60 days of discovering a breach, as required by 45 CFR 164.404(b)
2. Notify the HHS Secretary via the OCR Breach Portal
3. Notify prominent local media if the breach affects 500 or more individuals

For breaches affecting fewer than 500 people, you can submit an annual log to HHS. You must also document your risk assessment of the breach, the individuals affected, what PHI was involved, and your mitigation steps.

Having an incident response plan in place before a breach occurs is essential for meeting these notification deadlines.

HIPAA penalties are tiered based on the level of negligence:

• Tier 1 (Unknowing): $145 to $73,011 per violation
• Tier 2 (Reasonable cause): $1,461 to $73,011 per violation
• Tier 3 (Willful neglect, corrected): $14,602 to $73,011 per violation
• Tier 4 (Willful neglect, not corrected): $73,011 to $2,190,294 per violation

The annual cap per violation category is $2,190,294. Most small practice investigations result from a reported breach or patient complaint. The best defense is a documented compliance program.

You need a BAA with every vendor, contractor, or service provider that creates, receives, maintains, or transmits Protected Health Information on your behalf. Common examples include:

• EHR and practice management vendors
• Medical billing companies
• IT support and managed service providers
• Cloud storage services (Google Workspace, Microsoft 365, Dropbox)
• Email providers used for PHI
• Shredding and document destruction companies
• Answering services
• Telehealth platforms

Failure to execute BAAs is one of the most commonly cited HIPAA violations. Practices should maintain a current vendor inventory that identifies which vendors have access to PHI and tracks BAA execution status. Learn more about BAA management.

If a vendor handles PHI and refuses to sign a BAA, you cannot use that vendor for PHI-related services. HIPAA is clear: no BAA means no PHI access. You have three options:

1. Escalate the request: sometimes the initial contact does not know the company offers BAAs. Ask for their compliance or legal team.
2. Find an alternative vendor: many competitors in every category offer BAAs as standard.
3. Restructure the workflow: if the vendor does not need to touch PHI, remove PHI from the data they handle.

Evaluating vendor BAA readiness before signing a contract prevents compliance gaps later. Learn about vendor management.

One Guy Consulting offers flat-rate pricing for small practices: two plans, each with three ways to pay.

• Self-Guided Plan: $60 per month, $675 per 12 months, or $1,175 per 24 months. Platform only, no consulting time: compliance toolkit, policy templates, training modules, risk assessment tools, and vendor management features.
• Full-Scope Plan: $120 per month, $1,300 per 12 months, or $2,300 per 24 months. Everything in Self-Guided plus 4 hours per month of 1:1 implementation calls with Chuck Weiselberg, a Certified HIPAA Professional, including a guided SRA, gap analysis, staff training facilitation, incident response guidance, and CMS audit response support.

There are no per-user fees, no setup fees, and no hidden charges. Pricing is based on practice scope, not headcount. See the full pricing breakdown.

Yes, but it requires significant time and expertise. HIPAA compliance involves understanding the Privacy Rule, Security Rule, and Breach Notification Rule, then applying them to your specific environment. You need to complete a Security Risk Assessment, write or adopt policies, train your staff, execute Business Associate Agreements, and maintain documentation for at least six years.

Many small practices lack the bandwidth to manage this alongside patient care. Whether handled internally or with outside help, the key is a systematic, documented approach. Compare compliance plan options.

For small practices with 1 to 20 employees, reaching a compliant baseline typically takes weeks, not months with dedicated effort. This includes completing the Security Risk Assessment, gap analysis, policy adoption, initial staff training, and vendor BAA review.

Self-directed implementations typically take 3 to 6 months depending on how much time the team dedicates each week. A compliance tracker helps ensure no required steps are missed.

If the HHS Office for Civil Rights (OCR) investigates your practice and finds HIPAA violations, penalties range from $145 per violation up to $2,190,294 per violation category per year for willful neglect.

The best defense is a documented compliance program showing your Security Risk Assessment, policies, training records, and BAA inventory. Organizations that can demonstrate ongoing good-faith compliance efforts are treated more favorably during investigations.