HIPAA Compliance Checklist for 2024

Introduction: Why HIPAA Compliance Isn't Optional

If your organization handles protected health information (PHI), HIPAA compliance isn't just a legal requirement—it's a fundamental responsibility to protect patient privacy and trust.

Non-compliance can result in devastating consequences:

• Civil penalties up to $1.5 million per violation category per year
• Criminal charges with prison sentences up to 10 years
• Reputation damage that can destroy a practice
• Loss of patient trust that takes years to rebuild
• Business closure in severe cases

As an MSP and MSSP serving healthcare providers across California, we've seen firsthand how challenging HIPAA compliance can be—especially for small to mid-sized practices without dedicated IT security teams.

This comprehensive checklist will help you understand what's required, identify gaps, and take actionable steps toward full compliance.

Understanding HIPAA: The Fundamentals

What Is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) was enacted in 1996 to establish national standards for protecting sensitive patient health information.

Who Must Comply?

Covered Entities:

• Healthcare providers (doctors, dentists, clinics, hospitals)
• Health plans (insurance companies, HMOs, Medicare/Medicaid)
• Healthcare clearinghouses (billing services)

Business Associates:

• IT service providers
• Cloud storage vendors
• Billing companies
• Shredding services
• Anyone with access to PHI on behalf of a covered entity

Key HIPAA Rules

1. Privacy Rule – How PHI can be used and disclosed
2. Security Rule – Technical, physical, and administrative safeguards
3. Breach Notification Rule – Requirements for reporting PHI breaches
4. Enforcement Rule – Penalties and compliance procedures

HIPAA Security Rule: The Three Pillars

The Security Rule requires covered entities to implement safeguards across three categories:

1. Administrative Safeguards

Policies and procedures to manage security measures protecting PHI.

Required Components:

• Security management process
• Assigned security responsibility
• Workforce security and training
• Information access management
• Security awareness and training
• Security incident procedures
• Contingency planning
• Business associate agreements

2. Physical Safeguards

Physical measures to protect electronic systems and facilities.

Required Components:

• Facility access controls
• Workstation use policies
• Workstation security
• Device and media controls

3. Technical Safeguards

Technology controls to protect PHI and control access.

Required Components:

• Access controls (unique user IDs, emergency access)
• Audit controls (logging and monitoring)
• Integrity controls (data hasn't been altered)
• Transmission security (encryption in transit)

2024 HIPAA Compliance Checklist

Administrative Controls

Risk Assessment and Management

• [ ] Conduct annual risk assessments of all systems handling PHI
• [ ] Document identified risks and remediation plans
• [ ] Implement risk mitigation strategies based on assessment findings
• [ ] Review and update risk assessments when technology or processes change
• [ ] Maintain risk assessment documentation for audit purposes

Policies and Procedures

• [ ] Develop written HIPAA policies covering all required safeguards
• [ ] Create incident response procedures for security events
• [ ] Establish data backup and disaster recovery plans
• [ ] Document sanction policies for HIPAA violations
• [ ] Review and update policies annually or when regulations change

Workforce Training

• [ ] Provide HIPAA training to all workforce members within 30 days of hire
• [ ] Conduct annual refresher training for all staff
• [ ] Document all training sessions with sign-in sheets and completion certificates
• [ ] Train staff on phishing and social engineering attacks
• [ ] Update training materials to reflect new threats and technologies

Access Management

• [ ] Implement unique user IDs for all systems accessing PHI
• [ ] Enforce least privilege access (users only access what they need)
• [ ] Remove access immediately when employees leave
• [ ] Review user access rights quarterly
• [ ] Implement automatic session timeouts (15 minutes of inactivity)

Business Associate Agreements (BAAs)

• [ ] Execute BAAs with all vendors who handle PHI
• [ ] Review BAA terms to ensure HIPAA compliance obligations are clear
• [ ] Maintain BAA documentation for all active relationships
• [ ] Audit business associates annually for compliance
• [ ] Terminate relationships with non-compliant vendors

Physical Safeguards

Facility Security

• [ ] Restrict physical access to areas containing PHI
• [ ] Implement visitor sign-in logs and escort policies
• [ ] Install surveillance cameras in sensitive areas
• [ ] Use badge access systems for restricted areas
• [ ] Conduct facility security audits annually

Workstation Security

• [ ] Position monitors away from public view
• [ ] Lock workstations when unattended (automatic screen lock after 5 minutes)
• [ ] Use privacy screens in open environments
• [ ] Secure workstations with cable locks where appropriate
• [ ] Remove PHI from workstations when not in use

Device and Media Controls

• [ ] Maintain inventory of all devices that access PHI
• [ ] Encrypt all mobile devices (laptops, tablets, smartphones)
• [ ] Implement mobile device management (MDM) for remote wipe capabilities
• [ ] Establish media disposal procedures (shredding, degaussing, secure erasure)
• [ ] Document all media disposal activities

Technical Safeguards

Access Controls

• [ ] Implement Multi-Factor Authentication (MFA) on all systems accessing PHI
• [ ] Use strong password policies (12+ characters, complexity requirements)
• [ ] Enable automatic logoff after inactivity
• [ ] Create emergency access procedures for critical systems
• [ ] Monitor and log all access attempts to PHI

Encryption

• [ ] Encrypt PHI at rest on all storage devices
• [ ] Encrypt PHI in transit (TLS/SSL for email and web traffic)
• [ ] Use encrypted email solutions for sending PHI externally
• [ ] Encrypt backup media (tapes, external drives, cloud backups)
• [ ] Test encryption effectiveness regularly

Audit Controls and Monitoring

• [ ] Enable audit logging on all systems handling PHI
• [ ] Monitor logs for suspicious activity (failed login attempts, unusual access patterns)
• [ ] Retain audit logs for at least 6 years
• [ ] Review audit logs monthly
• [ ] Implement automated alerting for high-risk events

Transmission Security

• [ ] Use secure file transfer protocols (SFTP, HTTPS)
• [ ] Avoid sending PHI via unencrypted email
• [ ] Use secure patient portals for electronic communications
• [ ] Implement email encryption solutions (e.g., TLS enforcement)
• [ ] Verify recipient identity before transmitting PHI

Data Backup and Disaster Recovery

• [ ] Perform daily backups of all systems containing PHI
• [ ] Store backups offsite or in the cloud (encrypted)
• [ ] Test backup restoration quarterly
• [ ] Document recovery time objectives (RTO) and recovery point objectives (RPO)
• [ ] Maintain disaster recovery plan and update annually
• [ ] Conduct disaster recovery drills at least annually

Breach Notification Preparedness

• [ ] Establish breach notification procedures per HIPAA requirements
• [ ] Identify breach notification team members and their roles
• [ ] Maintain breach notification templates (patients, HHS, media)
• [ ] Understand notification timelines (60 days to notify affected individuals)
• [ ] Document all breach investigations and remediation efforts

Common HIPAA Compliance Gaps

Based on our work with healthcare providers, here are the most common compliance failures:

1. Incomplete Risk Assessments

Many practices conduct surface-level assessments that miss critical vulnerabilities. A proper risk assessment should:

• Cover all systems, devices, and processes that touch PHI
• Assess both technical and non-technical risks
• Evaluate third-party vendor risks
• Document likelihood and impact of identified risks

2. Missing or Outdated Business Associate Agreements

Failing to execute BAAs with vendors who handle PHI is one of the most frequently cited violations during audits. This includes:

• IT service providers
• Cloud email providers (Microsoft 365, Google Workspace)
• Cloud storage vendors
• Billing and transcription services

3. Lack of Encryption

Unencrypted laptops, mobile devices, and email are major breach risks. If a device is lost or stolen without encryption, it's considered a reportable breach.

4. Inadequate Access Controls

Giving employees more access than necessary (failure to implement least privilege) creates unnecessary risk. Regular access reviews are critical.

5. Insufficient Logging and Monitoring

Many organizations enable logging but never review the logs. Without monitoring, you won't detect unauthorized access or insider threats.

6. Poor Workforce Training

One-time training during onboarding isn't sufficient. HIPAA requires ongoing education, especially around emerging threats like phishing and ransomware.

What to Do If You're Not Compliant

If your practice has compliance gaps, here's how to get back on track:

Step 1: Conduct a Gap Analysis

Compare your current state against the checklist above and identify deficiencies.

Step 2: Prioritize Remediation

Focus on high-risk items first:

1. Encryption of devices and data
2. Access controls and MFA
3. Business associate agreements
4. Risk assessment documentation
5. Backup and disaster recovery testing

Step 3: Develop a Remediation Plan

Document what needs to be done, who's responsible, and target completion dates.

Step 4: Implement Technical Controls

Work with an experienced IT provider to deploy:

• Encryption solutions
• MFA and access controls
• Audit logging and monitoring
• Secure backup systems

Step 5: Update Policies and Train Staff

Ensure all workforce members understand their HIPAA obligations.

Step 6: Document Everything

Maintain records of:

• Risk assessments
• Policy reviews
• Training sessions
• BAAs
• Remediation efforts

How Advanced Networks Can Help

As a managed IT and cybersecurity provider specializing in healthcare, we help practices achieve and maintain HIPAA compliance through:

HIPAA Compliance Assessments

• Comprehensive risk assessments
• Gap analysis and remediation planning
• Policy and procedure development

Technical Implementation

• Encryption deployment (devices and data)
• MFA and access control configuration
• Secure cloud migrations (Microsoft 365, Azure)
• Audit logging and SIEM implementation

Ongoing Compliance Management

• 24/7 SOC monitoring for threats
• Quarterly compliance reviews
• Annual policy updates
• Workforce training programs

Incident Response

• Breach investigation and containment
• Notification assistance
• Remediation and hardening

Conclusion: Compliance Is an Ongoing Process

HIPAA compliance isn't a one-time project—it's an ongoing commitment to protecting patient privacy through proper policies, technology, and training.

If you're unsure about your compliance status, we're here to help.

Call us at (805) 233-6407 or schedule a free HIPAA compliance assessment.

Protecting patient data is our mission,
Advanced Networks Team