HIPAA Compliance Checklist

Appoint a Privacy Officer who is responsible for developing, implementing, and maintaining HIPAA privacy policies and procedures, serving as the point of contact for privacy inquiries, and overseeing the organization's compliance with the HIPAA Privacy Rule.

Create comprehensive written policies governing the use and disclosure of protected health information (PHI), including the minimum necessary standard, individual rights (access, amendment, accounting of disclosures), and permissible disclosures for treatment, payment, and health care operations.

Provide the Notice of Privacy Practices to all health plan participants at enrollment, within 60 days of a material revision, and at least once every three years as a reminder, describing how PHI may be used and disclosed and the individual's privacy rights.

Establish policies ensuring that workforce members access, use, and disclose only the minimum amount of PHI necessary to accomplish the intended purpose, and apply role-based access controls to limit PHI exposure to authorized personnel.

Ensure that any use or disclosure of PHI not permitted or required by the Privacy Rule is supported by a valid, signed authorization from the individual that includes all required elements (description of PHI, purpose, expiration, right to revoke).

Create processes for individuals to access their PHI, request amendments, obtain an accounting of disclosures, request restrictions on uses and disclosures, and request confidential communications, responding within the timeframes required by the Privacy Rule.

Appoint a Security Officer who is responsible for developing, implementing, and maintaining the administrative, physical, and technical safeguards required by the HIPAA Security Rule to protect electronic protected health information (ePHI).

Perform a thorough risk analysis to identify potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI in all forms (at rest, in transit, and in use), and document the findings as required by 45 CFR 164.308(a)(1)(ii)(A).

Develop and execute a risk management plan that addresses each identified risk to ePHI with appropriate security measures, reducing risks to a reasonable and appropriate level considering the organization's size, complexity, and capabilities.

Deploy unique user identification, emergency access procedures, automatic logoff, and encryption and decryption mechanisms as technical safeguards to control access to systems that create, receive, maintain, or transmit ePHI.

Implement hardware, software, and procedural mechanisms to record and examine access and activity in information systems containing ePHI, and regularly review audit logs to detect unauthorized access or security incidents.

Establish facility access controls, workstation use policies, workstation security measures, and device and media controls to protect physical access to ePHI and the systems that store it.

Conduct an inventory of all vendors, contractors, consultants, and service providers that perform functions involving the use or disclosure of PHI on behalf of the covered entity, including claims processors, IT service providers, TPA administrators, and cloud storage providers.

Enter into written BAAs with each business associate that include all elements required by 45 CFR 164.504(e), including permissible uses and disclosures, safeguards requirements, breach notification obligations, and return or destruction of PHI upon termination.

Confirm that BAAs require business associates to obtain satisfactory assurances from their subcontractors that subcontractors will appropriately safeguard PHI, creating a chain of responsibility as required by the HITECH Act.

Review all BAAs at least annually and upon any material change in the business relationship, HIPAA regulations, or breach of the agreement to ensure they remain current and enforceable.

Implement a process for periodically assessing business associate compliance with BAA obligations, including requesting evidence of security measures, reviewing incident reports, and addressing any identified deficiencies.

Develop procedures to identify potential breaches of unsecured PHI and conduct a four-factor risk assessment (nature and extent of PHI, unauthorized person, whether PHI was actually acquired or viewed, and extent of risk mitigation) to determine whether breach notification is required.

Provide written notification to each individual whose unsecured PHI was breached within 60 calendar days of discovery, including a description of the breach, types of PHI involved, steps the individual should take, what the organization is doing to mitigate harm, and contact information.

Notify the HHS Secretary through the HHS breach notification portal and provide notice to prominent media outlets serving the state or jurisdiction within 60 days for breaches affecting 500 or more individuals.

Maintain a log of all breaches affecting fewer than 500 individuals and submit the log to the HHS Secretary within 60 days of the end of each calendar year via the HHS breach notification portal.

Maintain comprehensive documentation of each breach incident including the risk assessment, notification decisions, remediation actions taken, and any policy or procedural changes implemented to prevent recurrence.

Provide HIPAA training to all workforce members (including employees, volunteers, and trainees) upon hire and periodically thereafter, covering privacy and security policies, PHI handling procedures, breach reporting, and the consequences of non-compliance.

Deliver additional targeted training to individuals who handle PHI as part of their job functions, addressing specific procedures for their role, the minimum necessary standard, and proper PHI disposal methods.

Maintain all HIPAA-related documentation including policies, procedures, risk analyses, training records, BAAs, breach logs, and privacy practice notices for a minimum of six years from the date of creation or the date last in effect, whichever is later.

Establish and apply a sanctions policy for workforce members who fail to comply with HIPAA privacy and security policies, ranging from retraining to termination depending on the severity and nature of the violation.

Perform regular internal audits of HIPAA privacy and security practices, including risk analysis updates, policy reviews, access control assessments, and training program evaluations, to identify gaps and ensure continuous compliance improvement.