HIPAA Security Rule Checklist, Full Guide

Written risk analysis completed and dated within the past 12 months

Risk analysis re-run after the last material system, vendor, or facility change

Risk management plan with an owner and target date for every identified risk

Sanction policy written and on file

Sanction policy applied at least once when warranted, or documented that no violation has occurred

Information system activity review (log and report review) performed on a defined cadence

Named Security Official on file

Periodic technical and non-technical evaluation of security controls (annual self-assessment)

ePHI flow and system inventory covers where ePHI is created, enters, moves, is stored and leaves, including mobile, medical and IoT devices

Risk management policy states risk appetite and tolerance, owners and review frequency, and past risk decisions are re-examined on that schedule

Sanction policy is tiered, proportional to the harm, and communicated to the workforce before it is applied

Information system activity review names the reviewer, the frequency, and where the logs are kept, including any cloud service

The security official's responsibility is written into a job description and communicated organization-wide

Whether the evaluation is performed internally or externally is decided and documented

Authorization and/or supervision procedure for workforce with ePHI access

Workforce clearance (background screening) procedure

Termination procedure that revokes system access on the effective date

Security awareness training delivered to 100% of workforce with ePHI access

Training refreshed on at least an annual cycle

Periodic security reminders issued to workforce

Malicious-software protection procedure and workforce guidance

Log-in monitoring and anomaly-reporting procedure

Password management procedure (creation, change, safeguarding)

Job descriptions define the security responsibilities of every role that touches ePHI

Documented criteria and procedures govern hiring and assigning tasks to roles with ePHI access

A training needs assessment identifies what each role must learn

An approved training strategy and plan sets audiences, topics, cadence and delivery, including contractors and business associates

Training effectiveness is measured and the plan is updated from the results

Unique user ID assigned to every person accessing ePHI systems

Emergency access procedure documented and tested

Health care clearinghouse functions isolated from larger organization systems (if applicable)

Access authorization decisions documented per role, tied to job function

Access establishment and modification procedure

Periodic access review performed on active accounts, not only at onboarding

Automatic session logoff configured on workstations and applications

Written security incident response plan

Incident log maintained with root cause and disposition for each entry

Breach risk-assessment procedure applying the four-factor test

Notification procedure meeting the 60-day business-associate-to-covered-entity standard

Current, verified contact list for covered-entity breach notification

Law-enforcement delay provision understood and documented

Breach notification sent to each affected individual without unreasonable delay and no later than 60 calendar days after discovery, with the required content, by first-class mail or agreed e-mail, and by substitute notice where contact information is out of date

Notice to the Secretary of HHS made contemporaneously with individual notice for a breach of 500 or more people, or by annual submission within 60 days after year end for smaller breaches, and notice to prominent media when more than 500 residents of one State are affected

Every business associate is contractually required to report security incidents and breaches within a set window, and reports received are logged and handled under this procedure

The incident response capability has documented goals and scope

An incident response team, or the alternative structure the organization chose, is named with its roles

The incident response plan is tested by an exercise at least annually, with results recorded

Post-incident analysis feeds documented updates to the incident response plan

Data backup plan

Disaster recovery plan

Emergency mode operation plan

Contingency plans tested in the past 12 months with documented results

Applications and data criticality analysis

At least one backup copy is kept offline or immutable, and backup logs are reviewed

The recovery strategy documents the order and the time targets for restoring systems and data

Contingency testing includes an actual restore of ePHI from backup, with the results recorded

Preventive measures are identified to reduce the likelihood and impact of disruptions

Facility security plan for any location housing ePHI systems

Facility access control and validation procedures

Contingency operations procedure for facility access during an emergency

Maintenance record log for physical security repairs and modifications

Written workstation-use policy defining permitted functions and environment

Physical workstation security controls in place (siting, screen privacy, locking)

Device and media disposal procedure

Device and media re-use (sanitization) procedure

Media movement accountability log

Data backup and storage procedure prior to equipment relocation

Physical security vulnerabilities are analyzed, with an inventory of every facility access point

Corrective measures for facility vulnerabilities are tracked to completion

Workstations and devices, including mobile, IoT and medical devices, are inventoried and classified by permitted function

Expected performance and permitted uses are defined for each type of workstation and device

The physical surroundings of workstations are analyzed for unauthorized viewing and access

Every method of physical access to workstations and devices is identified and its risk analyzed

Device encryption, screen locks, multi-factor sign-in and mobile device management are applied to workstations and devices

Media are sanitized to NIST SP 800-88 before disposal, with the method recorded

A named custodian records the receipt and removal of hardware and media, including media that leave the facility

Unique user identification enforced at the system level

Emergency access procedure implemented technically

Automatic logoff enforced by configuration

Encryption of ePHI at rest, or documented compensating rationale

Audit control mechanisms recording and examining system activity

Mechanism to authenticate ePHI has not been improperly altered or destroyed

Person-or-entity authentication (credential verification; multifactor is the accepted 2026 standard for remote and privileged access)

Transmission integrity controls for ePHI in transit

Encryption of ePHI in transit, or documented compensating rationale

Technical access control capabilities are identified for each ePHI system, including network segmentation

Access control procedures are implemented in the selected hardware and software for each ePHI system

The audit scope is set from the risk analysis, with defined record content: user, event, date and time

Audit and activity review tools are selected and deployed

Sources that could alter or destroy ePHI without authorization are identified

Integrity mechanisms are monitored, with a response process when alteration is detected

Where authentication applies is documented for every system and application holding ePHI

Authentication options (something known, held, or biometric) are evaluated for each system

Multi-factor authentication is enforced for remote and privileged access

Every path ePHI travels (email, file transfer, portals, apps) is inventoried with who could intercept it

Encryption in transit uses algorithms of sufficient strength, configured so they cannot silently downgrade

Signed BAA on file for every covered-entity relationship

Signed BAA on file for every downstream subcontractor with PHI access

Subcontractor BAAs flow down the same restrictions the organization itself received

Vendor security due-diligence process performed before onboarding a subprocessor

Active subcontractor BAAs and their security posture reassessed on a periodic cycle

Every vendor that creates, receives, maintains, or transmits PHI on the organization's behalf is identified as a business associate and recorded in the BAA tracker before any PHI is shared

Signed Business Associate Agreement containing every required element on file with each business associate before PHI is disclosed to it, documenting the satisfactory assurances the Privacy Rule requires

Due diligence on a business associate's safeguards performed before contracting and repeated on a periodic cycle for those that hold or process ePHI

A known material violation of a BAA by a business associate is cured or the arrangement terminated where feasible, and the steps taken are documented

Security requirements are applied when acquiring information technology systems and services

A named coordinator measures business associate performance and re-checks the business associate list for completeness

Minimum-necessary standard applied to routine PHI use and disclosure

Permitted-use and disclosure limits in the BAA followed in operational practice, not only on paper

Process to support the covered entity's obligations to individuals (access, amendment, accounting of disclosures) when the BA holds the records

PHI returned or destroyed at contract termination, or the extension of protections documented if return or destruction is infeasible

Uses and disclosures of PHI limited to treatment, payment, and health care operations, those made with an opportunity to agree or object, the public-interest categories the rule lists, and those made under a valid authorization, with the workforce trained on which is which

Identity and authority of a requester verified before any disclosure, including personal representatives and public officials, and the verification documented

Reasonable safeguards in place to limit incidental uses and disclosures of PHI in every form: oral, paper, and electronic

No sale of PHI, and no marketing or fundraising communications, without the authorization or opt-out the Privacy Rule requires

All required policies and procedures reduced to writing

All actions, activities, and assessments the rule requires to be documented, are in fact documented

Documentation retained six years from creation date or last-effective date, whichever is later

Documentation periodically reviewed and updated for environmental or operational changes

Cybersecurity supply chain risk management extends beyond BAA-centric due diligence to supplier concentration risk, fourth-party (N-tier) visibility, and component/software provenance

Notice of Privacy Practices developed, provided at first service delivery (or as otherwise required), and posted; good-faith effort made to obtain written acknowledgment of receipt for a direct treatment relationship

Minimum-necessary standard applied as the covered entity's own comprehensive policy governing routine and non-routine PHI uses, disclosures, and requests -- broader than the narrow business-associate duty in Domain I

Written, HIPAA-compliant authorization obtained before any use or disclosure of PHI not otherwise permitted for treatment, payment, health care operations, or another Privacy Rule exception

Process to receive, verify the requester's identity for, and respond to an individual's request to access, inspect, or obtain a copy of their PHI within the required timeframe

Process to receive and act on an individual's request to amend their PHI, including a timely acceptance or denial and the required documentation

Process to track disclosures of PHI and produce an accounting of disclosures on an individual's request

Privacy Official designated as responsible for privacy policies and procedures, and a contact person named to receive complaints and questions about the Notice, both documented

Every workforce member trained on the privacy policies and procedures relevant to their role: new members within a reasonable period after joining, all affected members after a material change, with completion documented

Complaint process available to individuals and described in the Notice; complaints and their disposition documented; no intimidation, retaliation, or waiver of rights as a condition of treatment, payment, enrollment, or eligibility

Requests to restrict uses or disclosures considered and documented, the restriction on disclosure to a health plan for a service paid in full out of pocket always granted, and reasonable requests for confidential communications accommodated

Harmful effects of a known use or disclosure in violation of policy or the Privacy Rule mitigated to the extent practicable, and privacy documentation retained for six years