The HIPAA compliance checklist.

The policies, procedures, and people decisions that govern compliance management. More than half of the Security Rule lives here — and it's the most-cited category in OCR enforcement actions.

1. 1

   Conduct a comprehensive risk analysis

   What it costs to skipCited in nearly every major HIPAA settlement. Anthem $16M, Premera $6.85M, Excellus $5.1M.
2. 2

   Develop and implement risk management policies

   What it costs to skipOCR will ask for evidence the risks you found are being actively reduced — not just documented.
3. 3

   Designate a HIPAA Privacy Officer and Security Officer

   What it costs to skipRequired by 45 CFR § 164.530(a)(1) and § 164.308(a)(2). Can be the same person in small orgs.
4. 4

   Create and distribute workforce training programs

   What it costs to skipAnnual training with documented completion is the standard OCR expects.
5. 5

   Establish sanctions for policy violations

   What it costs to skipRequired by § 164.308(a)(1)(ii)(C). Sanction history is reviewed during audits.
6. 6

   Implement information access management procedures

   What it costs to skipMemorial Healthcare paid $5.5M for failing to terminate former-employee access.
7. 7

   Develop contingency and disaster recovery plans

   What it costs to skipBackup, disaster-recovery, and emergency-mode operation plans are all separately required.
8. 8

   Evaluate and document security policies regularly

   What it costs to skipTreating compliance as a one-time project is the #6 most-cited deficiency by OCR.

The technology side of HIPAA. The 2026 Security Rule update will make encryption and MFA mandatory rather than 'addressable' — start now.

1. 1

   Implement unique user identification and access controls

   What it costs to skipShared logins are one of the fastest ways to fail an audit. Each user needs a unique ID.
2. 2

   Enable automatic logoff for inactive sessions

   What it costs to skipRequired by § 164.312(a)(2)(iii). Default 10-15 minutes for clinical workstations.
3. 3

   Deploy encryption for ePHI at rest and in transit

   What it costs to skipLifespan ($1.04M) and Premera ($6.85M) both involved unencrypted data.
4. 4

   Implement audit controls and activity logging

   What it costs to skipRequired for systems containing ePHI. SIEM-class logging is the modern standard.
5. 5

   Establish integrity controls for ePHI

   What it costs to skipMechanisms must prove ePHI hasn't been altered or destroyed without authorization.
6. 6

   Configure transmission security measures

   What it costs to skipTLS 1.2+ for ePHI in transit. Patient-comms email needs end-to-end encryption.

What you must do when (not if) something happens. Strict 60-day clock. Organizations that scramble after an incident make notification mistakes that double their legal exposure.

1. 1

   Develop a breach response and notification plan

   What it costs to skipDoctors' Management Services paid $100K (2024) — the first ransomware-specific HIPAA settlement.
2. 2

   Establish procedures for individual notification within 60 days

   What it costs to skip60 days from discovery. Late notification is itself a separate violation.
3. 3

   Prepare HHS notification procedures

   What it costs to skip500+ individuals: notify HHS Secretary immediately. Under 500: log and report annually.
4. 4

   Document media notification procedures for breaches affecting 500+ individuals

   What it costs to skipRequired notification to prominent media outlets in the affected jurisdiction.