HIPAA Compliance Checklist for Small Medical and Dental Practices

HIPAA compliance for a small medical or dental practice comes down to five groups of work: a documented risk analysis, written policies with staff training, technical safeguards on every device and account that touches patient data, signed business associate agreements with your vendors, and a breach response you have rehearsed. This checklist walks through each in the order an auditor would look at it. It covers the Security Rule as it stands today, with a note on the proposed changes.

Who has to follow this HIPAA checklist?

You do if your practice is a covered entity: a health care provider that bills electronically, a health plan, or a clearinghouse. Most practices that submit claims electronically fall in this group, including medical, dental, therapy, and chiropractic. But the rule reaches past your own walls. Vendors that create, receive, store, or transmit electronic protected health information for you are business associates, and they carry their own obligations. Your IT provider, cloud backup service, and practice management software company are all included. The Security Rule applies to electronic protected health information, so every system that holds it is in scope.

The HIPAA Security Rule text is published in the Electronic Code of Federal Regulations, 45 CFR Part 164, Subpart C.

Step 1: Have you completed a risk analysis?

Your risk analysis is the foundation, and it is one of the items regulators most often find missing. List every place your practice stores or sends patient data: the practice management system, imaging, email, laptops, phones, backups, and paper. For each one, name the threats, such as ransomware, a lost laptop, or a staff member with too much access, and rate how likely and how damaging each would be. Then write a risk management plan that says what you'll do about the highest risks and by when. Redo the analysis when your systems change. Do it at least once a year regardless.

The HHS Security Risk Assessment Tool, hosted by HealthIT.gov, walks small practices through a risk analysis.

Step 2: Are your policies written down and your staff trained?

HIPAA expects you to put your safeguards in writing. Your policies need to cover who can access patient data, how passwords and devices are handled, how you respond to incidents, and how you dispose of old equipment and paper. Name a security official to own the program. Train every workforce member when they start and on a regular schedule after that, and record who completed it. And keep your policies and risk analysis for six years, along with your training records. A short policy your staff actually follows beats a long template nobody reads.

Step 3: Are your technical safeguards in place?

Check each item against your practice. Every user has a unique login. No shared front-desk accounts. Multifactor authentication protects email, remote access, and the practice management system. Laptops and phones that hold patient data are encrypted and can be wiped if lost. Systems are patched on a schedule, and endpoint protection watches for ransomware. Each role can open only the patient records it needs, and audit logs show who opened what. Backups run automatically and stay separate from your network. Test restores happen at least once a year.

NIST SP 800-66 Revision 2 is a practical guide to implementing the HIPAA Security Rule.

What physical safeguards does your practice need?

Your physical safeguards cover the rooms and equipment around patient data. Keep server and network equipment in a locked room or cabinet. Angle front-desk screens so patients in the waiting area can't read them, and set workstations to lock after a few idle minutes. Control who has keys and alarm codes, and change them when staff leave. Log every device that holds patient data, from laptops to the copier with a hard drive, and wipe or destroy drives before they leave your office. And lock paper charts and printed schedules in cabinets.

Step 4: Do you have business associate agreements with your vendors?

Before a vendor can handle your patient data, you need a signed business associate agreement that commits them to protect it and tell you about breaches. List every vendor that touches electronic patient information: your IT provider, cloud email, backup service, practice management and imaging software, transcription, billing, and shredding companies. Confirm each has a signed agreement on file. And if a vendor won't sign one, that's reason enough to question whether you should use them.

Step 5: Is your breach response written and tested?

Write down what you'll do when something goes wrong: who investigates and who decides whether it's a reportable breach, plus who contacts patients. Under the Breach Notification Rule, you must notify affected individuals without unreasonable delay and no later than 60 days after you find the breach. Breaches affecting 500 or more people also require notice to HHS and, in some cases, the media within that window. But smaller breaches aren't exempt: log them and report them to HHS annually. Once a year, run a short tabletop exercise so your staff know the steps before they need them.

Read how to build a cyber incident response plan.

How do you keep evidence that your practice is compliant?

If an auditor or investigator asks, you need to show your work, not describe it. Keep a folder, paper or electronic, with your current risk analysis and risk management plan, plus your written policies with their review dates. Add training records for every staff member, signed business associate agreements, your device inventory, backup test results, and a log of security incidents and how you handled them. Date everything. When something changes, update the document and keep the old version. HIPAA requires you to keep this documentation for six years.

What are the most common HIPAA violations in small practices?

You'll see the same pattern in enforcement cases again and again. Practices skip the risk analysis or never update it. Laptops or phones holding patient data go missing without encryption. Staff can see records they don't need, and nobody reviews access. Vendors handle data without a business associate agreement, and patients don't get timely access to their own records. Ransomware hits a practice with no tested backup. Fix only these, and you've covered most of what goes wrong for practices your size.

What changed in HIPAA requirements for 2026?

The rules you must follow today are the existing Security Rule. In January 2025, HHS proposed a major update. It would require items such as multifactor authentication, encryption, an asset inventory, and regular compliance reviews, and it would remove the current distinction between required and addressable safeguards. As of October 2026, HHS has not finalized that proposal. Most of what it proposes is already good practice. Working through this checklist now puts you ahead if a final rule arrives.

The proposed HIPAA Security Rule update is published in the Federal Register.

See our HIPAA compliance guide for healthcare practices.

Learn how we support medical and dental practices.

Check where you stand with the free compliance readiness tool.