A 6-step HIPAA compliance checklist for small healthcare practices

Ever feel like you might be missing something when it comes to HIPAA compliance? Like there's a gap you can't quite put your finger on.

It's not just you. HIPAA can be complicated. And when you're the only one carrying the responsibility, it can be tough to know whether or not you're checking all the right boxes.

That's why we created this six-step checklist. It's a straightforward way to give your practice a quick, meaningful compliance check-up. Use it at the start of each year, or whenever your processes change, to keep your practice on track.

This HIPAA compliance checklist is designed specifically for small healthcare practices that want clear, practical guidance without unnecessary complexity.

1. Review your Business Associate Agreements

Business Associate Agreements (BAAs) help ensure that the service providers you work with understand HIPAA, know how to keep your client data safe, and agree to do so. They're also required by the HIPAA Privacy Rule, which is the part of HIPAA that covers how client information is used and shared.

Many HIPAA-compliant service providers, including Hushmail, will provide you with a BAA, so you don't always have to create your own.

To-do checklist

Make a list of the services you use that have access to and store client data (e.g., email, EHR, cloud storage provider, internet-based phone services (VoIP), etc.).
Add people or organizations you work with that also have access to client data (e.g., lawyer, accountant, etc.).
Go through your files to make sure you have a BAA in place with each professional or organization on your list.

Recommended resource if you want to learn more: Do you need a Business Associate Agreement?

2. Complete or update your HIPAA risk analysis

The Office for Civil Rights (OCR) launched a risk analysis initiative in 2024 that stepped up enforcement in this area. As a result, doing a regular risk analysis is more important than ever.

This doesn't need to be complicated. A simple, honest review is a strong starting point.

And you can do a HIPAA risk analysis (aka risk assessment) on your own. You don't need to pay someone else to do it for you.

How often should you do one? At least once a year. You should also repeat it whenever there is a major change in your office (for example, new staff, new equipment, or services).

OCR has made it clear that regular, documented risk analyses are a core expectation under the HIPAA Security Rule. Proposed updates could go a step further by making the specifics of what must be done during those assessments mandatory.

Risk analysis to-do checklist

Make a list of all the places or devices in your office that store protected health information (PHI) (e.g., paper files, desktop computer, laptop, mobile phone, etc.).
Make a list of computer programs you use that store or transmit PHI, including your operating system (Windows for PC or iOS for Mac), electronic health records (EHR), email, digital fax services, texting services, etc.
Think about possible security threats to each of these devices or services, such as loss or theft, weak passwords, or outdated software.
Make a plan to safeguard against these threats.

Your HIPAA risk analysis is the anchor for the rest of the list. The steps that follow build on the systems and risks you've already identified here.

Recommended resource if you want to learn more: How to do your HIPAA risk assessment

3. Use multi-factor authentication

Multi-factor authentication (MFA), also called two-step verification, requires you to verify your identity in at least two ways when you sign in. This includes your email, EHR, and other tools.

One-step authentication	Two-step authentication
Something you know Example: password	Something you know + something you have/are Example: Password + Text code

If this feels tedious, you're not alone. But as security expectations continue to rise, enabling two-step verification is one of the simplest ways to strengthen your safeguards. And it is a small price to pay in comparison to the costs of a breach.

Multi-factor authentication (MFA) checklist

Using the list of programs you identified earlier, review the computer programs you use, including your operating system (e.g., Windows, iOS), EHR, email, digital fax services, etc.
For each of those services, find out how to enable two-step verification and turn it on.

Recommended resource if you want to learn more: Does HIPAA require multi-factor authentication?

4. Encrypt your data

Encryption scrambles sensitive information. Even if someone gained access to your systems, they wouldn't be able to read the data stored there.

With healthcare data breaches on the rise, encryption is a vital part of running a secure practice. The U.S. Department of Health and Human Services (HHS) highlighted its importance in the proposed HIPAA updates, suggesting it be made a mandatory requirement and giving it more focus.

Encryption checklist

From the list of programs you already reviewed, check whether each one supports encryption, including your operating system, email, EHR, and any other tools that store or transmit client data.
Learn how to enable two-step verification and turn it on.

⭐ If the services you use don't offer encryption, consider switching providers.

Recommended resource if you want to learn more: Does HIPAA require encryption?

5. Review your documentation

Your practice's documents and forms act as a written memory of key activities in your practice, and they are an essential part of demonstrating HIPAA compliance.

Documentation checklist

Confirm that you use a Notice of Privacy Practices in your office. If not, get one started.
Review the document categories listed above and fill any gaps.
If you still use paper forms, consider switching to secure online forms to save time and improve security.

6. Review your data storage and disposal practices

As a healthcare provider, protecting client data is a top priority, even after clients leave your care. That's why it's critical to store and dispose of sensitive information in a HIPAA-compliant way (not to mention that you could face fines or other penalties if you skip these steps).

This applies to more than paper files. Even digital records or the devices that store them need to be housed and disposed of carefully.

Device-specific cheat sheet for destroying PHI

Here's a quick reference for common devices and how to properly destroy them:

Device	✅ What works	❌ What doesn't work
Old laptops	Remove the hard drive + destroy it	Deleting files only
USB drives	Smash or shred	Just hitting "delete"
CDs/DVDs	Shred or break into pieces	Surface scratches
Old phones/tablets	Factory reset + physically destroy the device	Factory reset alone
Copier/printer memory	Wipe/remove memory before disposal	Returning without checking

Storage and disposal to-do checklist

Shred paper records using cross-cut or micro-cut shredders. No shredding by hand!
Completely wipe or destroy hard drives before disposing of computers or other devices that store client data.

Recommended resource if you want to learn more: How to properly destroy PHI

Stay on top of HIPAA compliance

Running a HIPAA-compliant practice isn't a one-and-done solution; it's an ongoing process. With a simple annual review and tools that support you, you can protect your clients' privacy and run your practice with confidence. By taking time every year to review your compliance game, you're investing in your practice — and potentially avoiding a security breach or a failed audit.

This checklist is a great place to start. If you find it helpful, bookmark it for next year.

And using HIPAA-compliant tools like Hushmail can also take some of the load off your shoulders.