Small Clinic HIPAA Starter Checklist

1. Inventory all systems, devices, and workflows that store, transmit, or access ePHIDocument
2. Identify threats and vulnerabilities to each system (unauthorized access, malware, theft, natural disaster, human error)Document
3. Rate likelihood and impact of each identified threat (High / Medium / Low)Document
4. Create prioritized risk mitigation plan with assigned owners and target datesDocument
5. Compile written SRA report with date completed and assessor signatureRetain 6 years

RuleRequired by 45 CFR 164.308(a)(1)(ii)(A). Most commonly cited deficiency in OCR enforcement actions.

1. Write Access Control and Authorization policy: who can access what ePHI and under what circumstances
2. Write Security Management Process policy: how your practice prevents, detects, contains, and corrects security violations
3. Write Workforce Training policy: when and how staff are trained, topics covered, attestation requirements
4. Write Device and Media Controls policy: disposal, re-use, and movement of devices containing ePHI
5. Write Incident Response and Breach Notification policy: detection, reporting, investigation, and HHS notification timelines
6. Write Facility Access Controls policy: physical safeguards for areas where ePHI is accessible
7. Write Contingency and Disaster Recovery policy: data backup, emergency operations, and recovery procedures
8. Write Sanctions policy: consequences for workforce members who violate HIPAA policies
9. Write Business Associate Agreement policy: when BAAs are required and how they are executed and tracked
10. Write Notice of Privacy Practices: patient-facing document describing PHI uses and individual rights
11. Formally adopt all policies with dated leadership signatureRetain 6 years

RuleRequired by 45 CFR 164.316(a). Policies must reflect your actual operations. Generic templates do not satisfy the requirement without customization.

1. Designate a Privacy Officer responsible for Privacy Rule complianceDocument
2. Designate a Security Officer responsible for Security Rule compliance (may be same person in small practices)Document
3. Document both designations with effective date and signed acknowledgmentRetain 6 years

RulePrivacy Officer required by 45 CFR 164.530(a)(1). Security Officer required by 45 CFR 164.308(a)(2).

1. Deliver initial HIPAA training to all workforce members before they access PHI
2. Cover: Privacy Rule, Security Rule, breach reporting, phishing awareness, and your practice-specific procedures
3. Collect signed training attestation from each workforce memberRetain 6 years
4. Schedule annual refresher training and set calendar reminderDocument
5. Record training dates, topics covered, and attendee names in training logRetain 6 years

RuleRequired by 45 CFR 164.308(a)(5)(i). OCR does not accept verbal-only training. Signed attestations are the minimum standard.

1. Assemble compliance binder (physical or digital): SRA report, adopted policies, training records, BAA inventory, incident logRetain 6 years
2. Set 6-year retention schedule and document destruction procedures for expired records
3. Inventory all Business Associate Agreements: confirm each is signed, dated, and on fileRetain 6 years
4. Create incident log template for tracking potential breaches, investigations, and outcomesRetain 6 years

RuleRetention required by 45 CFR 164.530(j). Six years from date of creation or date last in effect, whichever is later.