Checklist · Healthcare

HIPAA Compliance: A Practical Checklist

78 Fed. Reg. 5566

Type: Checklist
Jurisdiction: National
Date: 2024-07-16
Topic: Healthcare

HIPAA compliance is not a binder; it is an operating discipline, and this checklist builds one in the order the work actually has to happen. It starts with the threshold question almost everyone gets wrong — whether you are a covered entity, a business associate, a hybrid entity, or outside HIPAA altogether — then inventories PHI and maps every data flow, including the cloud vendors nobody put on the org chart. From there it works through the business associate agreement chain, the Privacy Rule's notice and permitted-use architecture, minimum necessary and the requests it does not touch, the patient rights that OCR enforces most aggressively, and the anatomy of a valid authorization. The Security Rule half of the checklist centers on the risk analysis required by 45 C.F.R. § 164.308(a)(1)(ii)(A) — the failure that recurs most persistently across OCR's published resolution agreements — and walks the required and addressable implementation specifications, the encryption safe harbor, and workforce training and sanctions. It closes with the breach workflow, the four-factor risk assessment and the 60-day clock under 45 C.F.R. §§ 164.402 and 164.404, the six-year documentation rule, and how to survive an OCR investigation. A running hypothetical — a clinic whose unencrypted laptop walks out of a car — carries the traps.

HIPAA Compliance: A Practical Checklist

Healthcare > Healthcare Compliance | Published 16 July 2024 - Updated 9 December 2025 | UpLaw - uplaw.us

Nearly every HIPAA enforcement action begins with the same fact pattern: an organization that believed it was compliant, and could not prove it. This checklist is about the proving.

Keywords: HIPAA compliance, protected health information, ePHI, covered entity, business associate, BAA, Privacy Rule, Security Rule, Breach Notification Rule, security risk analysis, minimum necessary, right of access, four-factor risk assessment, encryption safe harbor, OCR enforcement, six-year retention

HIPAA has a reputation problem. Among people who do not have to comply with it, it is a vague spell muttered to avoid answering questions. Among people who do have to comply with it, it is often a three-inch binder purchased in 2013, printed once, and never opened again. Neither view survives contact with the HHS Office for Civil Rights (OCR), which enforces the rule and which has, with impressive consistency, found the same handful of failures in organization after organization: no current risk analysis, no signed business associate agreement, no encryption, no training records, and no ability to give a patient a copy of her own chart within thirty days.

The good news is that HIPAA is a finite body of law. It is not the shifting fifty-state patchwork that governs consumer privacy generally. The Privacy Rule, the Security Rule, and the Breach Notification Rule live in one place — 45 C.F.R. Part 164, Subparts E, C, and D respectively — and they say what they say. The bad news is that HIPAA is an evidentiary regime. Almost every obligation is really an obligation to document, and the documentation must be produced on demand, six years back.

Work this checklist roughly in order; the phases are sequenced because each depends on the one before it. You cannot write a business associate agreement until you know who touches your data, and you cannot know that until you have mapped it.

To keep this concrete, meet Cedar Hollow Family Health, an invented eleven-provider primary-care clinic in a mid-sized city. Cedar Hollow bills insurance electronically, uses a cloud-hosted electronic health record from a fictional vendor called Meridian Chart, contracts with an outside billing company, and lets its physicians take laptops home. On a Tuesday in March, Dr. Anaya Ruiz reports that her clinic laptop was stolen from her car. It held a downloaded spreadsheet of roughly 1,900 patients pulled for a diabetes quality-reporting project. It was not encrypted. Everything that follows is, in one way or another, about that Tuesday. The clinic is fictional; the Tuesday is not.

Phase 1 — Determine Your Status: Covered Entity, Business Associate, Hybrid Entity, or Out of Scope

[ ] Ask the threshold question: are you a health plan, a health care clearinghouse, or a health care provider who transmits health information electronically in connection with a covered transaction (45 C.F.R. § 160.103)? Only those three are covered entities
[ ] Note the trap in the provider prong: a provider is covered only if it conducts standard electronic transactions (claims, eligibility checks, remittance). A cash-only concierge practice that never bills electronically may be outside HIPAA entirely
[ ] Ask whether you instead create, receive, maintain, or transmit PHI on behalf of a covered entity — if so, you are a business associate, directly liable under the Security Rule and Breach Notification Rule since the HITECH Act and the 2013 Omnibus Rule (78 Fed. Reg. 5566)
[ ] Determine whether you are a hybrid entity under 45 C.F.R. §§ 164.103 and 164.105 — a legal entity with both covered and non-covered functions — and if so, formally designate your health care components in writing
[ ] Consider whether an organized health care arrangement (OHCA) or affiliated covered entity designation applies
[ ] Confirm that entities that merely hold health data are not automatically covered: a fitness app, a wellness vendor selling direct to consumers, or an employer's HR file of doctor's notes is generally outside HIPAA, though state law and the FTC's Health Breach Notification Rule may still bite
[ ] Document the status determination and the reasoning, and re-run it whenever the business model changes

Why it matters, and the traps. HIPAA does not regulate health information; it regulates certain entities that hold health information. This is the single most misunderstood feature of the statute. Getting the status question wrong in either direction is expensive: an organization that wrongly believes it is out of scope builds no program at all, while an organization that wrongly believes its entire corporate family is covered burdens non-clinical business units with rules that do not apply to them. The hybrid-entity designation exists precisely to solve the second problem — a university with a medical school and a football program can wall off the health care component — but it only works if you make the designation in writing before you need it. A hybrid designation invented during an OCR investigation is not a designation; it is a defense.

One boundary is worth drawing early, because it trips up counsel who come to HIPAA from corporate practice. HIPAA is federal law, and its status categories are uniform nationwide. The entity you are running that analysis on, however, is a creature of state law, and nothing in HIPAA tells you how to structure it. Whether a physician practice may be owned by a non-physician investor at all is a question of the corporate practice of medicine doctrine, which is state-specific and varies enormously — some states bar it outright, others permit it through management-services organizations, and a few barely police it. Likewise, when this checklist speaks of corporate formalities, board oversight of a compliance program, or fiduciary duty, the reference point is Delaware corporate law (the Delaware General Corporation Law, 8 Del. C. § 101 et seq.), because Delaware is where most health care holding companies are incorporated and because its case law is the most developed — not because any of it is a national rule. Confirm your own state of incorporation and your own state's practice-of-medicine rules; HIPAA will not do it for you.

Cedar Hollow bills Medicare and commercial payers electronically. It is a covered entity, full stop. Meridian Chart, its EHR vendor, is a business associate — and, critically, so is Meridian's own subcontracted cloud infrastructure provider. For the deeper treatment of that chain, see UpLaw's guide to HIPAA in the Cloud: Business Associates, BAAs, and Protecting ePHI, and the broader statutory landscape in Healthcare Compliance: A Comprehensive Guide to HIPAA, Stark, and the Anti-Kickback Statute.

Phase 2 — Inventory PHI/ePHI and Map Every Data Flow

[ ] Define PHI: individually identifiable health information relating to past, present, or future physical or mental health, the provision of care, or payment for care, held or transmitted by a covered entity or business associate in any form — paper, electronic, or oral
[ ] Define ePHI as the subset in electronic form; only ePHI triggers the Security Rule (45 C.F.R. § 164.302)
[ ] Build a system inventory: EHR, practice management, billing, imaging (PACS), lab interfaces, e-prescribing, patient portal, scheduling, secure messaging, telehealth platform, transcription, fax servers, backup systems, and email
[ ] Do not forget the shadow systems: physician laptops, personal phones with clinical apps, USB drives, home printers, the spreadsheet on a departmental share, the research extract sitting in someone's cloud drive
[ ] Map flows out: clearinghouses, payers, billing vendors, collection agencies, answering services, shredding companies, IT managed-service providers, cloud storage, analytics vendors, and website trackers
[ ] Identify PHI at rest, in transit, and on portable media, and note which of it is encrypted
[ ] Determine what data is de-identified under 45 C.F.R. § 164.514(b) — either the Safe Harbor method (removal of 18 identifier categories) or expert determination — because de-identified data is no longer PHI and falls outside HIPAA entirely
[ ] Maintain the inventory as a living document, reviewed at least annually

Why it matters, and the traps. Every subsequent phase is downstream of this one. You cannot conduct a lawful risk analysis of systems you have not identified, and OCR's most common finding is a risk analysis that covered "the EHR" and nothing else. The methodology here is the same discipline used in general privacy work; see Building a Privacy Compliance Program: Governance, Data Mapping, and the Legal Patchwork and Standing Up a Privacy Compliance Program: A Practical Checklist.

Two traps recur. First, website trackers: pixels and analytics scripts on authenticated patient-portal pages can transmit PHI to third parties, and OCR has taken the position that doing so without a BAA or authorization is an impermissible disclosure. Second, the de-identification shortcut: stripping names is not de-identification. The Safe Harbor method requires removal of all eighteen categories, including all geographic subdivisions smaller than a state (with a limited three-digit ZIP allowance) and all elements of dates except year. Cedar Hollow's diabetes spreadsheet had names removed — and kept dates of birth, full ZIP codes, and medical record numbers. It was PHI. It was always PHI.

Phase 3 — Business Associate Agreements: Execute Them Down the Entire Subcontractor Chain

[ ] List every vendor that creates, receives, maintains, or transmits PHI on your behalf, and confirm a signed BAA exists for each (45 C.F.R. §§ 164.502(e), 164.504(e), 164.308(b))
[ ] Confirm the BAA contains the required terms: permitted uses and disclosures, no use beyond what the contract or law allows, appropriate safeguards, reporting of security incidents and breaches, flow-down to subcontractors, individual access support, availability of books and records to HHS, and return or destruction of PHI at termination
[ ] As a business associate, execute BAAs with your own subcontractors — the obligation flows all the way down, and there is no bottom to the chain
[ ] Negotiate the commercial terms the regulation does not supply: breach-notification timing (the rule's outer limit is 60 days under § 164.410; contract for far less), indemnification, cyber-insurance minimums, audit rights, encryption commitments, and subcontractor approval
[ ] Understand the conduit exception and how narrow it is: it covers mere transmission (the postal service, an ISP), not storage. A cloud provider that stores ePHI is a business associate even if it holds only encrypted data and lacks the key
[ ] Track BAA execution dates, renewal, and termination in a register
[ ] Do not sign a vendor's take-it-or-leave-it BAA without reading it; many quietly disclaim the very safeguards you need

Why it matters, and the traps. OCR resolution agreements are littered with organizations that had a business associate relationship and no paper. The failure is rarely bad faith — it is that a vendor was onboarded by a department that did not know PHI was involved. Cedar Hollow had a BAA with Meridian Chart. It did not have one with the answering service that takes after-hours calls, or with the shredding company, or with the analytics vendor whose script sat on the portal login page. Each is an independent violation, chargeable regardless of whether anything was ever breached. On vendor-contract hygiene generally, see Building an Enforceable NDA Clause by Clause: A Practical Checklist; in a transaction, unsigned BAAs are a standard diligence finding — see Conducting Merger and Acquisition Due Diligence: A Practical Checklist.

Phase 4 — The Privacy Rule: Notice of Privacy Practices and Permitted Uses

[ ] Draft and maintain a Notice of Privacy Practices compliant with 45 C.F.R. § 164.520: uses and disclosures, individual rights, the entity's duties, complaint procedures, and a contact and effective date
[ ] Provide the notice at first service delivery, make a good-faith effort to obtain written acknowledgment of receipt, post it prominently in the facility, and put it on the website
[ ] Map your permitted uses and disclosures: treatment, payment, and health care operations (TPO) without authorization (§ 164.506); disclosures to the individual; and the public-interest exceptions in § 164.512 (public health, abuse reporting, judicial and administrative proceedings, law enforcement, decedents, research, serious threats)
[ ] Build a process for the § 164.512(e) subpoena path — a subpoena alone is not enough absent a court order, satisfactory assurance of notice to the individual, or a qualified protective order
[ ] Handle facility directories and disclosures to family and friends under § 164.510 (opportunity to agree or object)
[ ] Re-issue and re-post the notice when material changes are made

Why it matters, and the traps. The notice is the most visible artifact of the Privacy Rule and the easiest to get wrong by neglect: a notice that no longer describes what you actually do is worse than no notice, because it is an admission. The subpoena path is where clinics reliably fail — a records clerk receives a civil subpoena from a plaintiff's lawyer and simply ships the chart. That is a disclosure without a permitted basis. Route every legal demand through counsel; see Responding to a Government Subpoena or Investigation: A Practical Checklist, and for the general drafting discipline, Drafting a Privacy Policy: A Practical Checklist.

Phase 5 — Minimum Necessary, and the Requests It Does Not Apply To

[ ] Apply the minimum necessary standard to uses, disclosures, and requests for PHI (45 C.F.R. §§ 164.502(b), 164.514(d))
[ ] Define role-based access classes internally: identify who needs access to what category of PHI, and limit accordingly
[ ] Establish criteria for routine and recurring disclosures, and review non-routine requests individually
[ ] Memorize the exceptions — minimum necessary does not apply to: disclosures to or requests by a provider for treatment; disclosures to the individual or pursuant to the individual's authorization; disclosures required by law; disclosures to HHS for enforcement; and uses or disclosures required for HIPAA compliance
[ ] Do not use minimum necessary as a reason to withhold a patient's own records — that is the most common misapplication in the field

Why it matters, and the traps. Minimum necessary is the Privacy Rule's proportionality principle, and it is the analytic cousin of the data-minimization duty that runs through modern privacy law generally; see Data Minimization and Storage Limitation: Curbing the Over-Retention of Personal Data. The trap is directional. Staff over-apply it to patients (refusing access, redacting the chart) and under-apply it internally (giving every front-desk login full read access to every record). Cedar Hollow's quality-reporting extract is the perfect illustration: the project needed A1C values and visit dates. It got the full demographic and clinical record for 1,900 people, because that was the default export.

Phase 6 — Patient Rights: Access, Amendment, Accounting, Restrictions

[ ] Right of access (§ 164.524): produce PHI in the designated record set within 30 days, with one 30-day extension on written notice; provide it in the form and format requested if readily producible, including electronically; charge only a reasonable, cost-based fee limited to labor for copying, supplies, and postage
[ ] Honor a patient's direction to transmit the record to a third party where the request is in writing, signed, and clearly identifies the recipient
[ ] Right to amend (§ 164.526): accept or deny within 60 days (one 30-day extension); a denial must be written, must state the basis, and must let the individual file a statement of disagreement
[ ] Accounting of disclosures (§ 164.528): maintain the ability to account for six years of disclosures other than TPO, those made to the individual, and other enumerated exclusions
[ ] Right to request restrictions (§ 164.522(a)): you may generally decline — except you must honor a request to withhold from a health plan information about a service the individual paid for out of pocket in full
[ ] Confidential communications (§ 164.522(b)): accommodate reasonable requests for alternative means or locations
[ ] Track every request, the date received, the date fulfilled, and the outcome

Why it matters, and the traps. OCR's Right of Access Initiative has produced dozens of settlements, most of them small-dollar and all of them avoidable, arising from a single fact: someone asked for their records and did not get them. The fee rule is the second trap — per-page state fee schedules for litigation copies do not govern a patient's § 164.524 request. The mechanics of a records request will feel familiar to anyone who has run a consumer-rights pipeline; see Responding to a Data Subject Access Request: A Practical Checklist. Note too that the 21st Century Cures Act information-blocking rules now sit alongside § 164.524 and can penalize the same delay from a different direction.

Phase 7 — Valid Authorizations, Marketing, and the Sale of PHI

[ ] Use a § 164.508-compliant authorization form containing: a specific description of the information, the person authorized to disclose, the recipient, the purpose, an expiration date or event, the individual's signature and date, the right to revoke and how, the fact that the entity may not condition treatment on signing (with narrow exceptions), and notice of potential re-disclosure
[ ] Never accept a compound authorization where the rule forbids it, or a blanket "any and all records forever" form — it is defective on its face
[ ] Obtain authorization for marketing uses (§ 164.508(a)(3)), and disclose if the entity receives remuneration for the communication
[ ] Obtain authorization for any sale of PHI (§ 164.508(a)(4)), and state that the disclosure will result in remuneration
[ ] Obtain authorization for most uses of psychotherapy notes (§ 164.508(a)(2))
[ ] Flag 42 C.F.R. Part 2 substance-use-disorder records, which carry stricter consent rules than HIPAA

Why it matters, and the traps. A defective authorization is not a partial defense; it is no authorization, and the disclosure made in reliance on it is impermissible. Marketing is the recurring commercial trap — a clinic that accepts payment from a device manufacturer to send patients a "you may benefit from" letter has engaged in marketing for remuneration, and the fact that the clinic sincerely believed the device would help is irrelevant to the analysis.

Phase 8 — The Security Rule Risk Analysis: The Most-Cited Failure in OCR Enforcement

[ ] Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI the organization creates, receives, maintains, or transmits — 45 C.F.R. § 164.308(a)(1)(ii)(A). This is required, not addressable
[ ] Scope it to all ePHI, enterprise-wide — every system from Phase 2, not just the EHR
[ ] Identify threats and vulnerabilities, assess likelihood and impact, assign risk levels, and document the methodology
[ ] Implement risk management measures sufficient to reduce risks to a reasonable and appropriate level — § 164.308(a)(1)(ii)(B). The analysis is worthless without the remediation plan that follows it
[ ] Date it, sign it, and update it — on a defined cadence and upon any material change in systems, vendors, or operations
[ ] Consider using the HHS/ONC Security Risk Assessment (SRA) Tool or a NIST-aligned methodology (NIST SP 800-30), and keep the working papers
[ ] Do not confuse a vendor's security questionnaire, a penetration test, or a "HIPAA gap assessment" checklist with a risk analysis. They are inputs, not the thing itself

Why it matters, and the traps. If there is a single sentence to take from this document, it is this: the failure to conduct an accurate and thorough enterprise-wide risk analysis is the finding that recurs most persistently across OCR's published resolution agreements and corrective action plans. It appears in settlement after settlement, often as the lead finding, because it is the obligation that everything else in the Security Rule depends on and because it is trivially easy for OCR to test — they simply ask for it, and note the date. Cedar Hollow had a risk analysis. It was performed in 2019 by the EHR vendor, covered only the EHR, and never mentioned laptops or portable media. In OCR's eyes, Cedar Hollow had no risk analysis at all.

Phase 9 — Administrative, Physical, and Technical Safeguards: Required vs. Addressable

[ ] Understand the architecture: the Security Rule (§ 164.306) is technology-neutral and scalable, and each standard has implementation specifications marked required or addressable
[ ] Understand what addressable does not mean: it does not mean optional. It means you must assess whether the specification is reasonable and appropriate; if it is, implement it; if it is not, document why and implement an equivalent alternative measure where reasonable
[ ] Administrative (§ 164.308): risk analysis and risk management, sanction policy, information system activity review, assigned security responsibility, workforce security and clearance, information access management, security awareness and training, security incident procedures, contingency plan (data backup, disaster recovery, emergency mode operation), periodic evaluation, and BA contracts
[ ] Physical (§ 164.310): facility access controls, workstation use and workstation security, and device and media controls — including disposal and media re-use, both required
[ ] Technical (§ 164.312): access control (unique user identification and emergency access — required; automatic logoff and encryption/decryption — addressable), audit controls (required), integrity, person or entity authentication (required), and transmission security
[ ] Turn on audit logging and actually review it; § 164.308(a)(1)(ii)(D) requires regular review of system activity
[ ] Document every addressable decision in writing, with the reasoning and the date

Why it matters, and the traps. "Addressable" is the most dangerous word in HIPAA. Organizations read it as "we decided not to," and then discover in an investigation that the rule required a documented, reasoned assessment they never made. An undocumented decision to skip an addressable specification is not a decision; it is a gap. The remote-work perimeter problem is the same one that plagues confidential business information generally — see Guarding Trade Secrets Without a Perimeter: Remote Work and the Cloud.

Phase 10 — Encryption and the Breach Safe Harbor

[ ] Encrypt ePHI at rest — full-disk encryption on every laptop, desktop, server, phone, tablet, and portable drive that can touch PHI
[ ] Encrypt ePHI in transit — TLS for portals and interfaces, secure email or a portal for patient communication, VPN for remote access
[ ] Use encryption consistent with the HHS guidance specifying technologies that render PHI unusable, unreadable, or indecipherable (74 Fed. Reg. 42740, Aug. 24, 2009) — in practice, NIST-validated methods, FIPS 140-validated modules, NIST SP 800-111 for data at rest
[ ] Keep the keys separate from the encrypted media; a laptop with the key stored on it is not encrypted in any meaningful sense
[ ] Maintain evidence of encryption status per device — a report from your endpoint-management console, dated
[ ] Manage disposal and media re-use: wipe or destroy per NIST SP 800-88 and keep certificates of destruction

Why it matters, and the traps. Encryption is technically "addressable," which has misled a generation of compliance officers into treating it as discretionary. It is, functionally, the most valuable control in HIPAA — because properly encrypted PHI is not "unsecured PHI" under 45 C.F.R. § 164.402, and its loss is therefore not a reportable breach. That is the safe harbor. A stolen encrypted laptop is a purchasing problem. A stolen unencrypted laptop is a federal reporting event, a media notice, an OCR investigation, and a class action. The cost delta between those two Tuesdays is measured in millions; the cost delta between the two laptops is zero.

Cedar Hollow's laptop was not encrypted. There is no safe harbor. Everything that follows is now mandatory.

Phase 11 — Workforce Training, Access Management, and Sanctions

[ ] Train all workforce members on policies and procedures as necessary and appropriate to their functions (§ 164.530(b)) — including volunteers, students, and contractors under your direct control
[ ] Train new hires within a reasonable time after joining, and retrain when policies materially change
[ ] Run a security awareness and training program (§ 164.308(a)(5)): security reminders, protection from malicious software, log-in monitoring, and password management
[ ] Keep attendance and completion records — dated, per person, retained six years
[ ] Implement access management (§ 164.308(a)(4)): authorization, establishment, and modification of access; and termination procedures (§ 164.308(a)(3)(ii)(C)) that kill credentials on the day someone leaves
[ ] Maintain and apply a written sanction policy (§§ 164.530(e), 164.308(a)(1)(ii)(C)) — with graduated discipline, applied consistently, and documented every time
[ ] Prohibit retaliation against complainants and whistleblowers, and never require an individual to waive rights as a condition of treatment or payment (§ 164.530(g), (h))

Why it matters, and the traps. A sanction policy that has never been applied is evidence against you: it proves either that nothing ever went wrong (implausible) or that you do not enforce your own rules. The snooping case — an employee looking up a celebrity, a neighbor, or an ex — is the classic test, and the only defensible answer is a documented, proportionate sanction. Embed these obligations in the handbook and the investigation playbook; see Drafting an Employee Handbook That Holds Up: A Practical Checklist and Conducting a Workplace Investigation: A Practical Checklist. Termination procedures deserve special attention: orphaned credentials are how former employees become present-tense breaches.

Phase 12 — The Breach Workflow: The Four-Factor Risk Assessment and the 60-Day Clock

[ ] Start with the presumption: any acquisition, access, use, or disclosure of unsecured PHI not permitted by the Privacy Rule is presumed to be a breach unless you demonstrate a low probability that the PHI has been compromised (45 C.F.R. § 164.402)
[ ] Check the three statutory exceptions first: unintentional good-faith acquisition by a workforce member acting within scope; inadvertent disclosure between authorized persons at the same entity; and a disclosure where the entity has a good-faith belief the recipient could not reasonably have retained the information
[ ] If no exception applies, run the four-factor risk assessment, in writing: (1) the nature and extent of the PHI, including identifiers and likelihood of re-identification; (2) the unauthorized person who used it or to whom it was disclosed; (3) whether the PHI was actually acquired or viewed; and (4) the extent to which the risk has been mitigated
[ ] Document the conclusion either way — a "low probability of compromise" determination must be defensible, not merely asserted
[ ] Discovery starts the clock: a breach is discovered on the first day it is known, or by exercising reasonable diligence would have been known, to any workforce member other than the person who committed it
[ ] Notify individuals without unreasonable delay and no later than 60 calendar days after discovery (§ 164.404), with the required content: what happened, what PHI was involved, steps individuals should take, what you are doing, and contact information
[ ] If 500 or more residents of a state or jurisdiction are affected, provide notice to prominent media without unreasonable delay and within 60 days (§ 164.406)
[ ] Notify HHS (§ 164.408): for breaches affecting 500 or more individuals, contemporaneously with individual notice; for breaches affecting fewer than 500, log them and report annually within 60 days after the end of the calendar year
[ ] Business associates must notify the covered entity without unreasonable delay and within 60 days of discovery (§ 164.410) — and should be contractually bound to far less
[ ] Layer on state breach-notification statutes, which are not preempted where more stringent, and which frequently impose shorter deadlines and their own AG-notice obligations
[ ] Mitigate (§ 164.530(f)), preserve evidence, and tender the claim to your cyber insurer

Why it matters, and the traps. The 60 days is an outer limit, not a target — "without unreasonable delay" is the operative standard, and OCR has penalized entities that used the full sixty days without justification. Two traps deserve emphasis. First, the assessment is not a vibe check: an undocumented "we don't think anyone looked at it" is precisely the conclusion OCR reverses. Second, the annual small-breach log is real and routinely forgotten; entities that reported nothing for years have been cited for it.

Run Cedar Hollow's laptop through the four factors. Nature and extent: names, DOBs, ZIP codes, MRNs, and diabetes diagnoses and lab values for 1,900 people — sensitive, richly identifiable, high risk. Unauthorized person: unknown car thief, no confidentiality obligations. Actually acquired or viewed: unknown, but the device was unencrypted and password-protection alone does not defeat access to the drive. Mitigation: none available — the device cannot be recovered or remotely wiped. The conclusion writes itself. This is a breach of 1,900 individuals: individual notices within 60 days, contemporaneous HHS notice, and — because 1,900 exceeds 500 in a single state — prominent media notice. For the operational sequence, use Responding to a Data Breach: A Notification and Incident Response Checklist alongside Data Breach Notification Law: A Comprehensive Guide, and tender coverage early — see Tendering a Claim and Preserving Coverage: A Policyholder's Checklist and Insurance Coverage Law: A Comprehensive Guide for Policyholders.

A caution on that last step, because the temptation is to treat the cyber policy as a federal backstop. It is not. Insurance is regulated by the states, and coverage questions — whether notification costs are covered, whether a regulatory-defense sublimit applies, what "unauthorized access" means in your policy, whether late notice forfeits coverage — are answered by the law of the state whose law governs the policy, not by HIPAA. There is no nationwide rule on any of them; even the notice-prejudice question (whether an insurer must show prejudice before denying for late notice) splits sharply among the states. Read the policy, and confirm the governing state's rule before you assume the loss is covered.

Phase 13 — Documentation, Policies, and the Six-Year Retention Rule

[ ] Maintain written policies and procedures implementing the Privacy Rule (§ 164.530(i)) and the Security Rule (§ 164.316(a)), and update them as the law and the business change
[ ] Retain required documentation for six years from the date of creation or the date it was last in effect, whichever is later (§§ 164.530(j)(2), 164.316(b)(2)(i)) — note this is a federal HIPAA rule and is separate from state medical-record retention laws, which vary and are often longer
[ ] Keep, at minimum: the status determination, the data map, the risk analyses and risk-management plans, addressable-specification decisions, BAAs and the vendor register, notices of privacy practices and acknowledgments, training records, sanction records, access-request logs, breach risk assessments and notification records, the small-breach log, business continuity and disaster-recovery plans, and evaluation reports
[ ] Designate a Privacy Official and a Security Official by name (§§ 164.530(a), 164.308(a)(2))
[ ] Maintain a complaint process and a record of complaints and their resolution
[ ] Run periodic technical and non-technical evaluations (§ 164.308(a)(8)) and remediate the findings — an open finding that stays open is willful neglect in slow motion

Why it matters, and the traps. HIPAA compliance is, evidentiarily, a documentation regime: an undocumented control is, to OCR, a nonexistent control. The retention rule bites in both directions — destroy too early and you cannot prove compliance; keep clinical data forever and you enlarge every breach. The reconciliation is a written retention schedule that distinguishes compliance documentation (six years, HIPAA) from the medical record itself (state law). If litigation or an investigation is reasonably anticipated, the duty to preserve overrides any schedule; see Issuing a Litigation Hold and Preserving ESI: A Practical Checklist.

Phase 14 — Preparing for an OCR Investigation or Audit

[ ] Know what triggers OCR: a complaint (anyone can file), a large-breach report (500+ breaches trigger investigation as a matter of course), a compliance review, or an audit
[ ] Assemble the first-request package in advance — OCR's opening data request is predictable: policies and procedures, the risk analysis, the risk-management plan, BAAs, training records, sanction policy, the breach risk assessment, and evidence of encryption
[ ] Route everything through counsel; consider privilege at the outset of any internal investigation
[ ] Understand the civil penalty tiers (42 U.S.C. § 1320d-5; 45 C.F.R. § 160.404), keyed to culpability: (1) did not know and would not have known with reasonable diligence; (2) reasonable cause and not willful neglect; (3) willful neglect, corrected within 30 days; (4) willful neglect, not corrected. Per-violation amounts and annual caps are adjusted for inflation — confirm the current figures at 45 C.F.R. § 160.404 rather than relying on any published table
[ ] Note that correction within 30 days of actual or constructive knowledge is the difference between Tier 3 and Tier 4, and can be an affirmative bar to penalties for non-willful violations — speed of remediation is a legal argument, not just good hygiene
[ ] Understand criminal exposure under 42 U.S.C. § 1320d-6: knowing wrongful disclosure, escalating for false pretenses and for intent to sell or use PHI for commercial advantage or personal gain
[ ] Expect a Corrective Action Plan (CAP) with a monitoring period in any resolution agreement — CAPs are frequently more burdensome than the settlement payment
[ ] Remember there is no private right of action under HIPAA (see Acara v. Banks, 470 F.3d 569 (5th Cir. 2006)) — but plaintiffs routinely plead HIPAA as the standard of care in state-law negligence and privacy claims, and state attorneys general may sue under HITECH (42 U.S.C. § 1320d-5(d))

Why it matters, and the traps. The willful-neglect tiers mean that the history of your program is on trial, not just the incident. An organization whose 2019 risk analysis flagged unencrypted laptops, and which did nothing for six years, is in Tier 4 territory. An organization with no analysis at all is often worse off still. The lesson runs backward from Phase 14 into Phase 8: the risk analysis is not paperwork, it is the document that determines your penalty tier on the worst day of your professional life.

Common Mistakes to Avoid

Treating "addressable" as "optional." It means assess, decide, and document. An undocumented skip is a bare violation.
A risk analysis scoped to the EHR. The rule says all ePHI, enterprise-wide. Laptops, phones, backups, portable media, vendor systems.
A stale risk analysis. A 2019 document does not describe a 2025 network. Date it, update it, prove it.
Missing BAAs for the invisible vendors. Answering services, shredding companies, IT managed-service providers, transcriptionists, cloud storage, analytics.
Forgetting to flow BAAs down to subcontractors. The obligation goes all the way to the bottom of the chain.
Confusing the patient's § 164.524 access request with a litigation records request. Different timelines, different fees, different rules.
Using minimum necessary to withhold records from the patient. It does not apply to disclosures to the individual, and OCR has built an enforcement initiative around this error.
Producing records on a bare civil subpoena. Absent a court order, § 164.512(e) demands satisfactory assurances or a qualified protective order.
Skipping the written four-factor assessment. "We concluded it was low risk" without a document is a breach you failed to report.
Believing HIPAA preempts state law. It sets a floor. More-stringent state statutes — California's CMIA, Texas's HB 300 — survive (45 C.F.R. § 160.203), as do state breach statutes.
Assuming password protection equals encryption. It does not, and only encryption buys the safe harbor.
A sanction policy that has never been used. Consistency is the whole point; selective enforcement is worse than none.
Ignoring the annual small-breach log. Fewer-than-500 breaches must be reported to HHS within 60 days of year-end.
Assuming HIPAA is the only law in the room. The FTC's Health Breach Notification Rule, 42 C.F.R. Part 2, state genetic-privacy statutes, and AI-driven clinical tools all sit alongside it — see AI Governance and Compliance: A Comprehensive Guide.
Reasoning from HIPAA's federal uniformity to everything adjacent. HIPAA is federal and uniform. The entity holding the PHI, the doctrine governing who may own it, and the insurance policy paying for the breach are all state law — corporate practice of medicine varies state by state, corporate governance defaults to Delaware unless you incorporated elsewhere, and cyber-coverage disputes turn on the policy's governing state. Do not let a federal answer stand in for a state question.

The Consolidated HIPAA Checklist

[ ] Status determination made and documented (CE, BA, hybrid, out of scope)
[ ] Hybrid-entity health care components formally designated in writing, if applicable
[ ] PHI/ePHI inventory and data-flow map complete and current
[ ] Website trackers and shadow systems accounted for
[ ] Every vendor touching PHI has a signed, compliant BAA; register maintained
[ ] BAAs flow down to subcontractors; breach-notice timing shortened by contract
[ ] Notice of Privacy Practices current, distributed, acknowledged, posted, and on the website
[ ] Permitted uses/disclosures mapped; subpoena and law-enforcement path routed through counsel
[ ] Minimum necessary implemented via role-based access; exceptions understood
[ ] Access requests fulfilled in 30 days, in the requested format, at a cost-based fee
[ ] Amendment, accounting, restriction, and confidential-communication processes running
[ ] Out-of-pocket-in-full restriction requests honored
[ ] Authorization form § 164.508-compliant; marketing and sale-of-PHI rules understood
[ ] Enterprise-wide risk analysis current, dated, and signed
[ ] Risk-management plan tied to the analysis, with owners and dates
[ ] Administrative, physical, and technical safeguards implemented; every addressable decision documented
[ ] Encryption at rest and in transit; per-device evidence retained; keys managed
[ ] Media disposal and re-use controls with certificates of destruction
[ ] Audit logs enabled and actually reviewed
[ ] Workforce trained; completion records retained; security awareness ongoing
[ ] Access provisioning and same-day termination procedures in place
[ ] Written sanction policy — applied and documented
[ ] Breach workflow: presumption, exceptions, written four-factor assessment, 60-day clock
[ ] HHS notice (500+ contemporaneous; <500 annual log), media notice, state-law layer
[ ] Privacy Official and Security Official designated by name
[ ] Policies, procedures, and all required documentation retained six years
[ ] Periodic evaluation performed; findings closed
[ ] OCR first-request package assembled and ready
[ ] Cyber-insurance coverage confirmed and the tender process understood

Primary Authority

Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191; 42 U.S.C. § 1320d et seq.
HITECH Act, Div. A, Title XIII of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5; 42 U.S.C. § 17931 et seq.
HIPAA Omnibus Final Rule, 78 Fed. Reg. 5566 (Jan. 25, 2013) (extending direct liability to business associates and subcontractors)
45 C.F.R. Parts 160, 162, and 164
Privacy Rule: 45 C.F.R. Part 164, Subpart E — including §§ 164.502(b) and 164.514(d) (minimum necessary); 164.502(e) and 164.504(e) (business associate contracts); 164.506 (TPO); 164.508 (authorizations); 164.510 and 164.512 (permitted disclosures); 164.520 (notice of privacy practices); 164.522 (restrictions); 164.524 (right of access); 164.526 (amendment); 164.528 (accounting of disclosures); 164.530 (administrative requirements, training, sanctions, mitigation, documentation)
Security Rule: 45 C.F.R. Part 164, Subpart C — §§ 164.306 (general rules; required vs. addressable), 164.308 (administrative safeguards, including the § 164.308(a)(1)(ii)(A) risk analysis), 164.310 (physical safeguards), 164.312 (technical safeguards), 164.314 (organizational requirements), 164.316 (policies, procedures, and six-year documentation)
Breach Notification Rule: 45 C.F.R. Part 164, Subpart D — §§ 164.402 (definition of breach; four-factor risk assessment), 164.404 (individual notice), 164.406 (media notice), 164.408 (HHS notice), 164.410 (business associate notice), 164.414 (burden of proof)
Hybrid entities and organizational requirements: 45 C.F.R. §§ 164.103, 164.105
De-identification: 45 C.F.R. § 164.514(b)
Preemption (state law floor): 45 C.F.R. §§ 160.201–160.205
HHS Office for Civil Rights: enforcement authority, investigation and compliance-review procedures, and the four culpability-based civil penalty tiers — 45 C.F.R. Part 160, Subparts C, D, and E
Civil money penalties and tiers: 42 U.S.C. § 1320d-5; 45 C.F.R. §§ 160.404, 160.410 (affirmative defenses and correction). Per-violation amounts and annual caps are inflation-adjusted; confirm the current figures in the regulation rather than relying on a published table
Criminal penalties: 42 U.S.C. § 1320d-6
State attorney general enforcement: 42 U.S.C. § 1320d-5(d) (HITECH § 13410(e))
HHS Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable to Unauthorized Individuals, 74 Fed. Reg. 42740 (Aug. 24, 2009)
Substance use disorder records: 42 C.F.R. Part 2
Acara v. Banks, 470 F.3d 569 (5th Cir. 2006) (no private right of action under HIPAA)

Secondary Sources

HHS Office for Civil Rights, HIPAA guidance materials, resolution agreements, and corrective action plans
HHS/ONC Security Risk Assessment (SRA) Tool
NIST SP 800-30 (risk assessment), SP 800-66 (HIPAA Security Rule implementation), SP 800-111 (storage encryption), SP 800-88 (media sanitization)
HHS OCR guidance on HIPAA and cloud computing

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This checklist is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. HIPAA is federal law, but state medical-privacy and breach-notification statutes are not preempted where they are more stringent, and requirements change over time; verify current requirements and consult qualified counsel before acting.