A practical walkthrough of the controls a mid-sized practice needs to have in place. Written for a practice manager, not for an auditor.
This is the version of the HIPAA checklist we hand to a practice manager on day one. It is not the auditor's version. It is the version that answers the question, "okay, what do I actually need to do, and in what order?"
Administrative safeguards
- Assigned Security Officer, documented in writing, not just verbally
- Workforce training with tracked completion, annual, no missed years
- Sanctions policy for policy violations, applied consistently
- Access authorization and termination procedures, tested on real departures
Physical safeguards
- Facility access controls (logged badge or key access, with a real access review)
- Workstation security (auto-lock timers, encrypted drives, screen privacy where warranted)
- Device and media disposal procedures, with certificates of destruction on file
Technical safeguards
- Unique user identification for every account, plus MFA
- Automatic logoff on idle workstations
- Encryption in transit and at rest for all ePHI, not "most"
- Audit logs that are actually reviewed, and kept long enough to investigate (many practices keep them six years, matching HIPAA's documentation-retention rule)
← All whitepapers
