HIPAA Compliance Checklist

The HIPAA Security Rule requires covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates to implement administrative, physical, and technical safeguards to protect electronic Protected Health Information (ePHI). Key requirements include documented risk analysis, designated security officers, workforce access controls, audit controls, encryption for ePHI in transit, Business Associate Agreements, and retaining security documentation for at least six years.

HIPAA applies to "covered entities" — healthcare providers that transmit health information electronically, health plans, and healthcare clearinghouses — as well as their "business associates," meaning vendors and contractors who create, receive, maintain, or transmit ePHI on behalf of a covered entity. This includes cloud storage providers, EHR vendors, billing companies, and many software-as-a-service providers serving healthcare clients.

A Business Associate Agreement is a written contract required by HIPAA between a covered entity and any third-party vendor (business associate) that handles ePHI. The BAA establishes the permitted uses and disclosures of ePHI, requires the business associate to implement appropriate safeguards, and obligates them to report breaches. Operating without a signed BAA is a common HIPAA violation.

Administrative Safeguards are the policies and procedures that manage the selection, development, and maintenance of security measures. This checklist covers nine items: Security Management Process (risk analysis and risk management), Assigned Security Responsibility, Workforce Security (authorization and supervision), Information Access Management, Security Awareness and Training, Security Incident Procedures, Contingency Plan (backup and disaster recovery), Evaluation, and Business Associate Contracts.

Technical Safeguards are the technology and related policies that protect ePHI and control access to it. The five items in this category are: Access Control (unique user IDs, emergency access, auto-logoff, encryption), Audit Controls (hardware and software audit mechanisms), Integrity controls to prevent improper alteration of ePHI, Person or Entity Authentication to verify identity, and Transmission Security (integrity controls and encryption for ePHI sent over networks).

The HIPAA Security Rule requires covered entities to retain documentation of their security policies and procedures for a minimum of six years from the date of creation or the date it was last in effect, whichever is later. This includes written security policies, risk analysis documentation, and records of security training. This requirement is reflected in the "Documentation — Retain documentation for 6 years" item in the Policies & Documentation category.

Checklist progress is maintained in React state for the duration of your current browser session. If you close or refresh the page, the checkboxes will reset. For ongoing compliance tracking, we recommend taking a screenshot of your progress or exporting the browser page before closing. Persistent storage would require an account system, which this tool deliberately avoids to protect privacy.

This tool is designed as a practical self-assessment aid to help you track which Security Rule requirements you have addressed. It is not a substitute for a formal compliance audit, legal counsel, or a certified HIPAA compliance assessment. For official compliance determinations, organizations should work with a qualified HIPAA compliance officer or third-party auditor.