A practical HIPAA Security Rule checklist for small medical, dental, and therapy practices: risk analysis, encryption, MFA, backups, BAAs, and breach response.
Small medical, dental, chiropractic, and behavioral health practices are attractive targets for cybercriminals. Patient records are valuable, practices depend on their systems to see patients, and most do not have dedicated IT staff. The HIPAA Security Rule requires every covered entity, regardless of size, to protect electronic protected health information (ePHI) with administrative, physical, and technical safeguards. The good news is that most of what HIPAA requires is simply good IT practice, and a small practice can meet it with the right setup and documentation.
Start With a Documented Risk Analysis
The security risk analysis is the foundation of HIPAA compliance and an item regulators frequently cite in enforcement actions. You must identify where ePHI is created, stored, and transmitted, including the EHR or practice management system, email, scanned documents, imaging equipment, laptops, phones, and backups. Then evaluate the threats to each, the safeguards in place, and the remaining risk. Document the results and a plan to address the gaps, and repeat the analysis at least annually and whenever you make a major change such as a new EHR or a new office.
The HHS Security Risk Assessment Tool is free and designed for small practices, and a qualified IT provider can complete the technical portions with you. A risk analysis that exists only in someone's head does not count; if it is not written down, regulators treat it as not done.
Technical Safeguards Every Practice Needs
Encrypt every device that could hold patient data. Turn on BitLocker for Windows computers and FileVault for Macs, require encryption on phones used for work email, and use encrypted backups. HHS guidance treats properly encrypted data differently from unencrypted data when a device is lost or stolen, which makes encryption one of the most valuable safeguards a practice can have. Ask your compliance advisor how it applies to your breach response obligations.
Require unique user accounts and multi-factor authentication. Shared logins at the front desk make it impossible to audit who viewed a record. Give each staff member their own account with automatic screen lock after a few minutes of inactivity, and enforce MFA on email, the EHR where supported, and remote access. HHS has proposed updates to the Security Rule that would place more emphasis on encryption and MFA; whatever the final rules say, both are widely considered standard practice and are commonly expected by cyber insurers.
Secure email and messaging. Use an email service that supports encryption and will sign a business associate agreement, such as Microsoft 365 or Google Workspace with the correct configuration. Train staff to send patient information only through encrypted email or the patient portal, never personal email or standard text messages. Our Microsoft 365 security guide covers the settings that matter most.
Keep systems patched and protected. Run supported operating systems, which means retiring Windows 10 machines as discussed in our Windows 10 ESU article, apply updates promptly, and deploy endpoint detection and response on every computer and server. Segment imaging equipment and other medical devices that cannot be easily updated onto their own network behind a business firewall.
Backups and Contingency Planning
HIPAA requires a data backup plan, a disaster recovery plan, and an emergency mode operations plan. In practical terms, that means encrypted backups of all ePHI with at least one copy offsite and protected from ransomware, regular restore testing, and a written plan for seeing patients if systems are down. Ransomware attacks on healthcare often target backups first, so immutable or offline copies are essential. Our backup and disaster recovery guide explains how to build this.
Business Associate Agreements
Any vendor that creates, receives, stores, or transmits ePHI on your behalf is a business associate, and you need a signed business associate agreement (BAA) with them. This includes your EHR vendor, cloud email provider, backup provider, IT support company, billing service, shredding company, and any cloud storage service where patient data might be saved. Keep a list of business associates and their BAAs. Using a consumer cloud service that will not sign a BAA for patient data is a common and avoidable violation.
Train Staff and Document Everything
Security awareness training for the workforce is part of the Security Rule, and many breaches in small practices still start with a phishing email or a misdirected message. Train staff at hire and on a regular schedule, run simulated phishing tests, and keep completion records. Our security awareness training guide offers a practical approach. Maintain written policies covering access control, device use, incident response, and sanctions, and ask your compliance advisor how long documentation must be retained.
Breach Response
Have a written incident response plan before you need it. HIPAA and New Mexico law both include breach notification requirements with specific deadlines for notifying patients, regulators, and in some cases the media. Because those obligations depend on the details of each incident, involve qualified legal counsel and your cyber insurer as early as possible, and keep their contact information in your plan.
Frequently Asked Questions
Do small medical practices have to comply with HIPAA?
Generally, yes. Healthcare providers that conduct standard electronic transactions, such as billing insurance electronically, are typically covered entities under HIPAA regardless of practice size. Confirm your status with a qualified compliance advisor.
How often should a HIPAA risk assessment be done?
Perform a security risk analysis at least once a year and whenever there is a significant change, such as a new EHR, a new office, a move to the cloud, or a security incident. Document each analysis and the remediation plan.
Is Microsoft 365 HIPAA compliant?
Microsoft 365 can be configured to support HIPAA compliance. Microsoft offers a business associate agreement for eligible services, but the practice remains responsible for configuring security settings correctly, including MFA, encryption, retention, and audit logging. Confirm the agreement and configuration with your compliance advisor.
Is a lost encrypted laptop a HIPAA breach?
It depends on the circumstances, including whether the device was encrypted to HHS guidance standards and whether the encryption key was also compromised. Encryption significantly reduces risk, but whether notification is required is a legal determination, so document the incident and consult qualified legal counsel.
HIPAA compliance is a shared effort between practice leadership, a qualified compliance advisor, legal counsel, and the people who manage your technology. The safeguards in this article are a starting point for that conversation, not legal advice. For general IT questions, contact HelpTek.
