A practical HIPAA guide for solo providers and small private healthcare practices.
Operating a private practice does not by itself determine whether HIPAA applies. HIPAA applies to covered entities and business associates that meet the applicable definitions and requirements.
If you're new to HIPAA, start with our What Is HIPAA? guide to understand what HIPAA means, who it applies to, and what information it protects.
Start by reviewing where protected health information and electronic protected health information may exist throughout your practice.
Review how PHI is used and disclosed, how individual rights are handled, and whether current policies and procedures reflect your actual practice.
Practices subject to the Security Rule should review administrative, physical, and technical safeguards protecting ePHI.
A Security Rule risk analysis should consider potential risks and vulnerabilities affecting ePHI.
Identify vendors that may create, receive, maintain, or transmit PHI on behalf of your practice and review whether Business Associate Agreements are required.
If your private practice has workforce members, review applicable Privacy and Security training requirements and relevant documentation.
Remote care may introduce additional platforms, devices, communications, vendors, and access considerations.
Review the HIPAA Compliance Checklist →
Use GetHIPAAcheck to review key requirements, identify potential gaps, and receive recommended next steps.