Small Clinic HIPAA Starter Checklist

• Inventory all systems, devices, and workflows that store, transmit, or access ePHI Document
• Identify threats and vulnerabilities to each system (unauthorized access, malware, theft, natural disaster, human error) Document
• Rate likelihood and impact of each identified threat (High / Medium / Low) Document
• Create prioritized risk mitigation plan with assigned owners and target dates Document
• Compile written SRA report with date completed and assessor signature Retain 6 years

Required by 45 CFR 164.308(a)(1)(ii)(A). Most commonly cited deficiency in OCR enforcement actions.

• Write Access Control and Authorization policy — who can access what ePHI and under what circumstances
• Write Security Management Process policy — how your practice prevents, detects, contains, and corrects security violations
• Write Workforce Training policy — when and how staff are trained, topics covered, attestation requirements
• Write Device and Media Controls policy — disposal, re-use, and movement of devices containing ePHI
• Write Incident Response and Breach Notification policy — detection, reporting, investigation, and HHS notification timelines
• Write Facility Access Controls policy — physical safeguards for areas where ePHI is accessible
• Write Contingency and Disaster Recovery policy — data backup, emergency operations, and recovery procedures
• Write Sanctions policy — consequences for workforce members who violate HIPAA policies
• Write Business Associate Agreement policy — when BAAs are required and how they are executed and tracked
• Write Notice of Privacy Practices — patient-facing document describing PHI uses and individual rights
• Formally adopt all policies with dated leadership signature Retain 6 years

Required by 45 CFR 164.316(a). Policies must reflect your actual operations — generic templates do not satisfy the requirement without customization.

• Designate a Privacy Officer responsible for Privacy Rule compliance Document
• Designate a Security Officer responsible for Security Rule compliance (may be same person in small practices) Document
• Document both designations with effective date and signed acknowledgment Retain 6 years

Privacy Officer required by 45 CFR 164.530(a)(1). Security Officer required by 45 CFR 164.308(a)(2).

• Deliver initial HIPAA training to all workforce members before they access PHI
• Cover: Privacy Rule, Security Rule, breach reporting, phishing awareness, and your practice-specific procedures
• Collect signed training attestation from each workforce member Retain 6 years
• Schedule annual refresher training and set calendar reminder Document
• Record training dates, topics covered, and attendee names in training log Retain 6 years

Required by 45 CFR 164.308(a)(5)(i). OCR does not accept verbal-only training — signed attestations are the minimum standard.

• Assemble compliance binder (physical or digital): SRA report, adopted policies, training records, BAA inventory, incident log Retain 6 years
• Set 6-year retention schedule and document destruction procedures for expired records
• Inventory all Business Associate Agreements — confirm each is signed, dated, and on file Retain 6 years
• Create incident log template for tracking potential breaches, investigations, and outcomes Retain 6 years

Retention required by 45 CFR 164.530(j). Six years from date of creation or date last in effect, whichever is later.