HIPAA Compliance Checklist 2026 for Small Healthcare Practices
Check your practice against key HIPAA Privacy and Security requirements, identify potential gaps, and get recommended next steps.
- ✔ Free Starter assessment
- ✔ Guided HIPAA compliance questions
- ✔ Recommended next steps
- ✔ Additional report features with eligible paid plans
Prefer a printable overview? HIPAA checklist PDF →
Do not enter patient names, medical information, or other protected health information (PHI).
New to HIPAA? Learn what HIPAA is and who it applies to →
What is a HIPAA compliance checklist?
A HIPAA compliance checklist can help organize a review of key Privacy and Security requirements and identify areas that may require additional attention.
A checklist is a starting point for structured review. It does not by itself certify that an organization is HIPAA compliant and does not replace legal or professional advice when needed.
HIPAA Compliance Requirements Checklist
HIPAA compliance requirements vary depending on how a healthcare organization handles protected health information (PHI) and electronic protected health information (ePHI). A practical HIPAA compliance checklist can help you review the key areas that may apply to your practice.
Key areas to review include:
- Privacy: Review how PHI is used, disclosed, and protected.
- Security: Review administrative, physical, and technical safeguards for ePHI.
- Risk analysis: Identify potential risks and vulnerabilities affecting ePHI.
- Business associates: Review vendors that handle PHI and determine whether Business Associate Agreements (BAAs) are needed.
- Workforce training: Review whether workforce members receive appropriate HIPAA privacy and security training.
- Documentation: Maintain applicable HIPAA policies, procedures, assessments, and other required records.
- Breach response: Establish processes for evaluating and responding to potential breaches of unsecured PHI.
Use the checklist below to review these areas in more detail and identify items that may need further attention.
Built for Solo Providers and Small Healthcare Practices
GetHIPAAcheck is designed to make structured HIPAA review easier for smaller healthcare organizations that may not have a dedicated compliance team.
- Solo healthcare providers
- Small healthcare practices
- Therapists and counseling practices
- Private healthcare practices
Therapists and counseling practices can also review our HIPAA Compliance for Therapists guide →
HIPAA Compliance Areas to Review
- HIPAA Privacy policies and procedures
- Security risk analysis and risk management
- Administrative safeguards
- Physical safeguards
- Technical safeguards
- Workforce access and training
- Business Associate Agreements
- Incident and breach-response procedures
- HIPAA-related documentation
1. Review Where PHI Is Handled
Identify where protected health information (PHI) and electronic protected health information (ePHI) are created, received, maintained, or transmitted throughout your practice.
Relevant systems and workflows may include:
- EHR and practice-management systems
- Email and messaging
- Telehealth platforms
- Cloud services
- Billing systems
- Computers and mobile devices
- Backups
- Patient forms and records
Learn more: What Counts as PHI Under HIPAA? →
2. Review HIPAA Security Safeguards
The HIPAA Security Rule includes administrative, physical, and technical safeguards for protecting ePHI.
- Access controls
- User authentication
- Device and workstation security
- Security policies and procedures
- Security incident procedures
- Protection of ePHI in electronic systems and communications
3. Review Security Risks
Organizations subject to the HIPAA Security Rule should identify and evaluate potential risks and vulnerabilities affecting ePHI.
For a focused explanation, see the HIPAA Risk Assessment guide →
4. Review HIPAA Privacy Practices
Review how your practice uses and discloses PHI, handles applicable individual rights, and maintains Privacy Rule policies and procedures.
5. Review Vendors and Business Associate Agreements
Identify vendors that may create, receive, maintain, or transmit PHI on behalf of your practice.
Review each relationship to determine whether the vendor qualifies as a business associate and whether an appropriate Business Associate Agreement is required.
Learn more: Do Solo Providers Need a BAA? →
6. Review Workforce Training
Review applicable HIPAA training requirements and whether workforce members understand the policies, procedures, and security practices relevant to their roles.
Therapy practices can also review: HIPAA Training for Therapists →
7. Review HIPAA Documentation
Review whether applicable HIPAA documentation reflects your current practices and systems.
- Policies and procedures
- Risk analysis documentation
- Risk management activities
- Training records
- Business Associate Agreements
- Incident-related documentation
HIPAA Guides by Practice Type
This page is the main HIPAA compliance checklist for solo providers and small healthcare practices. For profession-specific guidance, use the related guides below.
- HIPAA for Therapists
- HIPAA Compliance for Therapists — guidance for therapy and counseling practices. Therapists can use this main checklist as the practical review starting point.
- HIPAA Laws for Therapists
- HIPAA for Private Practice
How the GetHIPAAcheck Assessment Works
- Start the free Starter assessment
- Answer guided Yes, No, or Unsure questions
- Review potential gaps and recommended next steps
- Access additional report and history features with eligible plans
Frequently Asked Questions
Is there a free HIPAA compliance checklist available?
Yes. GetHIPAAcheck offers a free Starter HIPAA checklist for solo providers and small healthcare practices. It helps you review key HIPAA Privacy and Security areas and identify potential gaps. Completing a checklist does not by itself certify HIPAA compliance.
Does HIPAA apply to every solo healthcare practitioner?
No. Working as a solo healthcare practitioner does not by itself determine whether HIPAA applies. HIPAA applies to covered entities and business associates that meet the applicable definitions and requirements.
What does a HIPAA compliance checklist cover?
A HIPAA compliance checklist may help organize review of areas such as Privacy and Security requirements, risk analysis, administrative, physical and technical safeguards, workforce training, vendor relationships, Business Associate Agreements, incidents, and documentation.
Does completing a HIPAA checklist certify compliance?
No. Completing a checklist does not certify HIPAA compliance or constitute government approval. A checklist can support internal review and help identify areas that may require additional attention.
What is a HIPAA risk assessment?
A HIPAA Security Rule risk analysis involves identifying and evaluating potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information.
Is GetHIPAAcheck a legal service?
No. GetHIPAAcheck is an independent compliance-support tool intended to support internal review and documentation. It does not provide legal advice or certify HIPAA compliance.
Compliance Disclaimer: GetHIPAAcheck is an independent compliance-support tool and is not affiliated with or endorsed by HHS or OCR. Assessment results are intended to support internal review and documentation. They do not provide legal advice, certify HIPAA compliance, or constitute government approval.
Review Your HIPAA Practices
Start with the guided assessment to review key requirements, identify potential gaps, and receive recommended next steps.
Start Free HIPAA ChecklistPrefer a printable overview? View HIPAA Checklist PDF →