What to Do First When Your Clinic Has No HIPAA Risk Assessment or Written Policies

Complete a Security Risk Assessment

This is where you start. Every covered entity and business associate must conduct a Security Risk Assessment regardless of size, as required by 45 CFR Section 164.308(a)(1)(ii)(A). There are no size-based exemptions.

The SRA identifies where electronic Protected Health Information (ePHI) lives in your practice - every system, device, and workflow that stores, transmits, or accesses patient data. You document the threats and vulnerabilities to each, rate the risk level, and create a plan to address the highest-risk items first.

If OCR investigates your practice, the SRA is the first document they ask for. Not having one is the single most common HIPAA violation found during audits and breach investigations.

Security Risk Assessment requirements and process

Write and Adopt Your Missing Policies

45 CFR Section 164.316(a) requires written policies and procedures that comply with the Security Rule. Generic templates you downloaded and never customized do not satisfy this requirement.

At minimum, a small practice needs these ten foundational policies:

• Privacy Policy (Notice of Privacy Practices)
• Security Management Process
• Access Control and Authorization
• Workforce Training
• Device and Media Controls
• Incident Response and Breach Notification
• Business Associate Agreement Policy
• Facility Access Controls
• Contingency and Disaster Recovery
• Sanctions Policy

These policies must reflect how your practice actually operates - not how a generic template assumes you operate. Not sure which ones you need? See the complete list of required HIPAA written policies.

HIPAA policy templates for small practices

Assign Ownership

HIPAA requires a designated Privacy Officer and Security Officer. In a small practice, one person can hold both roles. This person is responsible for maintaining your compliance program, responding to incidents, and serving as the point of contact for HIPAA-related questions from staff, patients, and - if it comes to it - OCR.

Without clear ownership, policies sit in a drawer, training does not happen, and vendor agreements go unsigned. Assigning a responsible person turns your compliance program from a stack of documents into an active, maintained system.

Train Your Staff

Every workforce member who handles PHI must receive HIPAA training before accessing patient information, as required by 45 CFR Section 164.308(a)(5)(i). Annual refresher training is the industry standard.

Training must cover the Privacy Rule, Security Rule, breach reporting procedures, phishing awareness, and your practice-specific policies. Completion must be documented with signed attestations - OCR does not accept "we trained them verbally."

HIPAA training requirements and program details

Document Everything

HIPAA requires you to retain all compliance documentation for at least six years under 45 CFR Section 164.530(j). This includes your completed SRA, written policies, training records with sign-off dates, your BAA inventory, and any incident reports.

If OCR investigates your practice, your documentation is your evidence that you took compliance seriously. A well-documented program - even an imperfect one - is treated far more favorably than no documentation at all.