The Ultimate HIPAA Compliance Checklist

Quick answer: A HIPAA compliance checklist is the list of things a covered entity or business associate has to do, and be able to prove, under the Privacy, Security and Breach Notification Rules. The core items are confirming HIPAA applies to you, naming a Privacy Officer and a Security Officer, a documented risk analysis, safeguards, written policies, training, a signed BAA with every vendor that touches PHI, a breach procedure and six years of records.

The "be able to prove" part is where most organizations come unstuck. Picture the letter. Your billing vendor got hit by ransomware, a few thousand patients' claims data went with it, and the Office for Civil Rights (OCR) wants two things from you: your most recent risk analysis and the business associate agreement you signed with that vendor. The analysis is two years old and still lists a server you retired last spring. The BAA is somewhere, maybe in a former director's inbox, and nobody can find it.

The Health Insurance Portability and Accountability Act doesn't grade you on good intentions. For most healthcare organizations, an investigation comes down to the documents you can hand over in the first few days, so every item on this checklist is something you can prove, and the risk analysis and vendor BAAs get the most attention because they're what that letter asks for.

Choose your next step:

• If you're the one keeping BAAs and vendor contracts that contain PHI, see ContractSafe's contract management security features.

• If you're in healthcare and want every contract in one place, look at our healthcare contract management software.

• If you're drafting or reviewing a BAA right now, read our business associate agreement guide.

HIPAA Compliance Checklist

A HIPAA checklist groups what you have to prove by rule: applicability and officers, the Privacy Rule, the Security Rule, business associates, breach notification, training and sanctions, and documentation. Each item can be checked off only when a document, log or signed agreement backs it up.

Work through each group and mark the items you can prove with a document:

Applicability and Roles

• You've confirmed in writing whether you're a covered entity, a business associate or both. The tests are in Does HIPAA Apply to You?
• You've named a Privacy Officer and a Security Officer (one person can hold both roles), and the appointment is on file.

Privacy Rule

• Your Notice of Privacy Practices is issued, posted and updated for the Part 2 substance use disorder changes that were due February 16, 2026.
• Patient access requests are answered within 30 days (one 30-day extension is allowed if you tell the patient why), and each request is logged.
• Staff see only the minimum PHI their job needs, and the role definitions are written down.

Security Rule

• You have a documented risk analysis that reflects your current systems and vendors (reviewed at least once a year, which is what OCR now expects), and a risk management plan that follows from it. The method is in How to Do a HIPAA Risk Assessment.
• Every user has a unique ID, access to ePHI is logged, and someone reviews the logs on a schedule.
• Laptops, phones, backups and email are encrypted, or there's a written note explaining the reasonable alternative you chose.
• Backups run, a restore has been tested, and the test date is recorded.

Business Associates

• Every vendor that touches PHI signed a BAA before it got access, and each BAA sits in one inventory with its renewal or termination date. The details are in the BAA and Vendor Contract Checklist.

Breach Notification

• A written breach procedure names who decides, who notifies and by when.
• Breaches affecting fewer than 500 people go in a log that's reported to HHS each year. The deadlines are in the Breach Notification Checklist.

Training and Sanctions

• Everyone who handles PHI is trained at onboarding and on a refresh schedule, with completion records.
• A written sanctions policy exists, along with a record of every sanction applied. See Policies, Training and Documentation.

Documentation

• Policies, risk analyses, training records, incident reports, sanctions and BAAs are kept for six years from creation or from the date they were last in effect, whichever is later.

Does HIPAA Apply to You?

HIPAA applies to covered entities, meaning health plans, healthcare clearinghouses and providers that bill electronically in standard transactions, and to business associates that handle PHI on a covered entity's behalf. Handling health data isn't enough on its own to bring you under HIPAA. You'll need to pass one of two tests, and which one you pass decides which duties on the checklist apply to you.

The Covered Entity Test

You're one of the covered entities if you're a health plan, a healthcare clearinghouse, or a healthcare provider that sends health information electronically in a HIPAA standard transaction, such as a claim or an eligibility check. Health plans include insurers, HMOs and most employer group health plans. Hospitals, physicians, dentists, therapists and pharmacies usually qualify because they bill electronically.

The Business Associate Test

You're a business associate if you create, receive, maintain or transmit PHI on behalf of a covered entity. A subcontractor that handles PHI for a business associate is a business associate too, and since the Omnibus Rule both are directly liable under the Security Rule. Common examples include:

• Data storage firms
• Cloud service providers
• Billing companies
• Attorneys and accountants handling medical records
• Technology vendors whose platforms touch ePHI

Who Falls Outside Both Tests

Some people and companies sit close to PHI without being covered:

• Workforce members, such as employees, volunteers and trainees under your direct control, who are part of your organization and not business associates.
• Vendors whose services involve no use or disclosure of PHI, like a janitorial service that might see a record in passing.
• Personal health record vendors that aren't working for a covered entity, which fall under the FTC's Health Breach Notification Rule instead.

What HIPAA Requires Today and What's Only Proposed

The Privacy, Security and Breach Notification Rules are in force as written, and the Omnibus Rule extends them to business associates. The January 2025 proposal to overhaul the Security Rule is still a proposal, and the 2026 Unified Agenda lists its final action for July 2027. A lot of HIPAA advice written in 2025 treated it as settled, so here's exactly where today's rules and the proposed Security Rule differ:

If the rule becomes final, you'd have 240 days to comply, according to Alston & Bird's analysis of the overhaul. Working toward the proposed controls now does no harm, and encryption already pays off under today's rules: a breach of properly encrypted PHI isn't a breach of "unsecured" PHI, so the notification duties don't kick in. Just don't describe encryption or MFA as required by today's text.

You can also ignore most of a 2024 rule that still shows up in older checklists. The reproductive health care privacy rule and its attestation requirement were vacated nationwide on June 18, 2025 in Purl v. HHS, and the Fifth Circuit's dismissal of the appeals on September 10, 2025 made that final. One piece survived. The same rule had folded in a change to your Notice of Privacy Practices covering Part 2 substance use disorder records, and the ruling didn't touch it. That's the Part 2 Notice of Privacy Practices update on the checklist above, so it stays on your list.

How to Do a HIPAA Risk Assessment

A HIPAA risk assessment, which the Security Rule calls a risk analysis, is a documented review of every place you create, receive, store or send ePHI. It rates what could go wrong, how likely it is, how bad it would be and what you're doing about it. It's also the requirement OCR enforces most often.

The requirement sits in 45 CFR 164.308(a)(1)(ii)(A), which tells you to "conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information." The very next requirement is risk management, which means acting on what you find. So the analysis is about threats to ePHI, not about whether you've followed each HIPAA rule. Checking rule by rule is a compliance audit, and that's a different exercise.

You can't score a risk honestly until you have the facts, so start by getting straight answers to these questions:

• Where does PHI live, including vendor portals, shared drives and signed contracts?
• Who has access to each system, is that access logged, and when did someone last review the log?
• Is every laptop, phone and backup encrypted, and if not, where's the written reason the alternative is reasonable?
• Which vendors have a signed BAA, and which BAAs have lapsed?
• When did you last restore from a backup, and how long did it take?

With those answers in hand, run the assessment in six steps and keep the output of each one:

1. Map your ePHI. List every system, device, vendor portal and contract where ePHI lives or passes through, including the BAAs and vendor agreements that grant access to it.
2. List threats and vulnerabilities. A threat is what could cause harm, such as phishing, ransomware, a lost laptop or a vendor breach. A vulnerability is the weakness that lets it work, such as no MFA, an unencrypted device or an unpatched server.
3. Record existing controls. Write down what already reduces each risk, so you're scoring what's really there and not a worst case.
4. Score each risk. Rate likelihood and impact from 1 to 5 and multiply them. A score of 1 to 5 is Low, 6 to 12 is Moderate, and 15 to 25 is High.
5. Fix and re-score. Assign a fix, an owner and a due date, then score the residual risk you expect once the fix is in place.
6. Log it. Enter each risk in your risk register, covered in the next section.

Take phishing against clinical staff. It gets a likelihood of 4, because they see targeted emails every week, and an impact of 5, because one stolen login can open the EHR. That's 4 × 5 = 20, High. Turning on MFA cuts the likelihood to 3, and teaching staff to report suspicious email quickly limits the impact to 4. The residual risk is 3 × 4 = 12, Moderate.

The same math works on a contract risk most checklists skip. Your billing vendor's BAA expired eight months ago, nobody noticed, and the vendor still logs into your claims system every day. Nothing in writing now binds it to the Security Rule or obliges it to report an incident to you. Vendor breaches aren't rare, either: the HIPAA Journal's 2025 healthcare data breach report found that 35.8% of 2025's large breaches happened at business associates. Daily access with no contractual safeguards earns a likelihood of 3. The vendor holds claims data for your whole patient base, so the impact is 5. That's 15, High.

The fix has three parts. Re-sign the BAA within 30 days, so the vendor is again bound to Security Rule safeguards and incident reporting. Check that the vendor's access matches what the BAA allows, and cut anything beyond it. Set a renewal alert 90 days before the new expiry date so the gap can't open again. It's the trimmed access and the restored obligations that make a breach less likely, not the signature itself. Likelihood drops to 2, and the residual risk is 10, Moderate.

If you're a smaller practice, HHS's free Security Risk Assessment Tool 3.6 walks you through the same ground. Version 3.6, released September 10, 2025, uses NIST-aligned Low, Moderate and High risk levels and records who reviewed each section and when, which is exactly the kind of evidence an investigator asks for. Whatever tool you use, the scores and fixes end up in one place: your risk register.

What Goes in a HIPAA Risk Register and How Often to Reassess

A HIPAA risk register is the running record of every risk to ePHI, with its asset, threat, vulnerability, controls, residual score, owner and review date. A HIPAA risk assessment should be repeated at least once a year and whenever systems, vendors or workflows change.

Give each entry in the register these fields:

• Asset (the system, device, vendor or contract)
• Threat
• Vulnerability
• Existing controls
• Planned mitigation and due date
• Residual risk score
• Risk owner
• Next review date

The once-a-year cadence comes from what OCR has demanded, not from the text of the rule. In its April 2026 ransomware settlements, the corrective action plans required asset inventories, maps of how ePHI flows, vulnerability and penetration testing, and a fresh risk analysis every year. That's a fair preview of what an investigator will expect you to have on hand.

A calendar date isn't the only trigger, though. Start a new assessment, or at least update the affected entries, when any of these happen:

• You add a new system or vendor.
• You move systems or data to the cloud.
• You merge with or acquire another organization.
• You change how ePHI moves through a workflow.
• You have a security incident, including one at a vendor.

The documentation standard in 45 CFR 164.316 backs this up. It requires you to update documentation in response to environmental or operational changes and to keep it for six years. If the register stays current, each annual assessment becomes an update instead of a fresh start. Some of the entries that go stale fastest are the vendor ones, which is where the next checklist comes in.

BAA and Vendor Contract Checklist

Every vendor that touches PHI needs a signed BAA before it gets access, and that BAA needs tracking like any other contract with dates, an owner and an end. Vendors are where a lot of breaches start, with business associates behind more than a third of 2025's large breaches.

For each vendor relationship, you should be able to tick off these items:

• One inventory of every BAA, listing the vendor, the signing date and the renewal or termination date.
• Confirmation that each BAA requires the vendor to follow the Security Rule, report incidents to you and flow the same terms down to its subcontractors.
• An alert set 90 days before each BAA renews or expires.
• Restricted access to contracts that contain PHI, with a log of who viewed them.
• On the day a relationship ends, access revoked and PHI returned or destroyed, with written confirmation.

A signed BAA is a promise, so check the vendor behind it too. Ask for a recent security audit report, find out where your data will be stored, and for cloud storage providers, compare their setup with HHS's guidance on HIPAA and cloud computing.

Then treat the paperwork as part of your risk analysis. A vendor with no BAA, or one whose BAA lapsed at renewal, is a vulnerability, and it goes in the register with a score like any other risk. The BAA also sets how fast that vendor has to tell you about a breach, which feeds straight into your own notice deadlines.

Breach Notification Checklist

Under HIPAA, notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. Notify HHS at the same time if 500 or more people are affected. For smaller breaches, log them and report the log to HHS within 60 days after the calendar year ends.

Under the Breach Notification Rule, here's who you notify and when:

• Individuals get written notice without unreasonable delay, and within 60 calendar days of discovery.
• If 500 or more people are affected, notify HHS at the same time as the individuals.
• If more than 500 residents of one state are affected, also notify prominent media in that state within 60 days.
• If fewer than 500 people are affected, log the breach and report it to HHS no later than 60 days after the calendar year ends.
• Business associates must notify the covered entity within 60 days of discovery, and many BAAs set a shorter window, so check yours.
• State breach laws may apply too, and some require notice to the state attorney general.

Those deadlines only work if you've rehearsed. Your incident response plan should meet four goals:

• Clear lines of communication: Name who contacts regulators, who talks to patients and providers, and who tells employees.
• Planned responses: Decide in advance how you'll contain a breach, take corrective action and handle press questions.
• Response deadlines: Set internal deadlines well inside the 60-day limits, because delay adds damage and can raise penalties.
• Regular drills: Run tabletop exercises with staff so you find the weak spots before a real incident does.

A drill only helps you in an investigation if there's a record that it happened, and the same goes for every policy and training session behind it.

Policies, Training and Documentation

HIPAA requires written safeguards and policies, a sanctions policy, and training for every workforce member who handles PHI. HIPAA records proving those steps must be kept for six years from the date of creation or the date last in effect, whichever is later.

Safeguards

The Security Rule groups safeguards into three kinds:

• Administrative safeguards are the risk analysis, officer appointments, policies and training.
• Physical safeguards are things like locked doors and file cabinets, security cameras, shredders and where you place workstations.
• Technical safeguards include unique logins, access logs, encryption or a documented alternative, and contract systems that let you set permissions and roles so PHI in contracts stays with the people who need it.

Policies

Safeguards hold up only when written policies tell people how to use them. Write policies for system maintenance and monitoring, incident reporting and handling violations. Include a sanctions policy that says what happens to staff who break the rules, and name an owner for each policy and each assessment so everyone knows who answers for it. When people change roles or leave, the policy should say who removes their access and how fast.

Training

Policies don't do much if nobody knows them, so training is required under both the Privacy Rule and the Security Rule, and it covers everyone in your workforce who handles PHI. Do it at onboarding, then refresh it on a set schedule. Regular security awareness training helps staff catch the phishing emails and weak passwords behind so many breaches. Your training should cover these topics:

• Overview of HIPAA rules
• Guidelines for keeping data secure
• Proper handling of PHI
• Reporting security breaches
• How to use HIPAA-compliant software
• Cybersecurity best practices
• Risk assessment protocols and procedures

Documentation

All of that work needs a paper trail. Keep every record in one secure, organized repository, retained for six years from the date it was created or last in effect, whichever is later. That includes:

• Training records
• Policies and procedures
• Risk analyses and the risk register
• Incident reports and complaints
• Sanctions applied for noncompliance
• BAAs and vendor contracts

Those records are what you'll be measured against if OCR comes calling, and the gap between having them and not having them shows up in what an investigation costs.

What Noncompliance Costs Now

Most OCR cases end with a corrective action plan, not a fine. The money shows up in breach costs and in settlements, and recent settlements keep turning on the same failure: an inadequate risk analysis.

When fines do apply, civil penalties scale with culpability. After HHS's January 28, 2026 inflation adjustment, the minimum penalties per violation are:

• $145 where you didn't know about the violation
• $1,461 for reasonable cause
• $14,602 for willful neglect that was corrected
• $73,011 for willful neglect that wasn't corrected

Identical violations are capped at $2,190,294 per calendar year. Knowingly misusing PHI for personal gain is a federal crime that carries up to 10 years in prison.

You don't need a breach to draw OCR's attention. Its Phase 3 HIPAA audits of 50 covered entities and business associates have run since December 2024 and focus on the Security Rule provisions most relevant to hacking and ransomware. On April 23, 2026, OCR announced four ransomware settlements totaling $1,165,000, and all four cited an inadequate risk analysis.

The breach itself usually costs far more. IBM's 2026 Cost of a Data Breach report puts the average healthcare breach at $6.64 million, the highest of any industry, a spot healthcare has held for years according to IBM's breakdown of healthcare breach costs. Whatever the dollar figure, an investigation keeps coming back to the two records from that opening letter: a current risk analysis and a BAA you can find.

Related Reading

• What makes a good contract manager
• CLM software checklist

How ContractSafe Helps With HIPAA Compliance

ContractSafe keeps your BAAs and vendor contracts in one searchable repository and alerts you before each one renews or expires. That's the contract side of this checklist. It doesn't replace your risk analysis, but it gives the analysis accurate vendor inputs and puts the BAA in your hands when OCR asks for it.

Every plan includes optical character recognition (text search on scans), so even scanned BAAs are keyword searchable, along with unlimited date fields and automated reminders for renewals, expirations and notice deadlines. Access is controlled at the contract level through folder and tag permissions, set per user or per team, and the activity audit trail records contract views, downloads and changes. ContractSafe doesn't hide individual fields from someone who can open a contract, so keep PHI-heavy contracts in folders only the right people can reach.

On the security side, every plan includes 256-bit AES encryption, two-factor authentication, a SOC 2 audit report, ISO 27001 certification, vulnerability and penetration testing, and offsite backup of all data. Single sign-on comes with the Finalize and Maximize plans.

ContractSafe pricing starts at $450/month (Organize plan, billed annually; $540 month-to-month), with unlimited users on every plan. If you'd like to load a few of your own BAAs and see how the alerts work, you can start a free trial.