HIPAA Compliance Checklist

Use this free checklist from VComply to protect PHI and ensure your organization adheres to HIPAA’s privacy and security regulations. By following these guidelines, you will protect the confidentiality, integrity, and availability of PHI while reducing the risk of data breaches and compliance failures.

hipaa-compliant-checklist

HIPAA Compliance Checklist

Print IconDownload PDF

Administrative Safeguards

1. Do you have a designated Privacy Officer responsible for overseeing compliance with HIPAA regulations?
YesNoNA
2. Do you have formal written policies and procedures that address how PHI is used, stored, and shared within your organization?
YesNoNA
3. Do you conduct regular risk assessments to identify vulnerabilities related to the confidentiality, integrity, and availability of PHI?
YesNoNA
4. Do you have an incident response plan for identifying, managing, and reporting security breaches or violations of HIPAA?
YesNoNA
5. Do you conduct background checks on all employees who handle PHI to ensure trustworthiness?
YesNoNA
6. Do you regularly review and update policies based on changes to HIPAA regulations or internal practices?
YesNoNA
7. Do you have clear procedures for granting, modifying, and terminating access to PHI based on job roles and responsibilities?
YesNoNA

Physical Safeguards

1. Do you have secure areas where PHI is stored, preventing unauthorized physical access?
YesNoNA
2. Do you restrict access to areas where PHI is stored or processed, using keycards or other security measures?
YesNoNA
3. Do you ensure that paper records containing PHI are locked away when not in use and only accessible to authorized individuals?
YesNoNA
4. Do you implement safeguards for portable devices (e.g., laptops, USB drives) that store or transmit PHI, such as encryption and secure storage?
YesNoNA
5. Do you have a visitor log and escorting policy for individuals who enter areas where PHI is accessed or stored?
YesNoNA
6. Do you dispose of physical records containing PHI securely through shredding or other secure methods when they are no longer needed?
YesNoNA
7. Do you have a disaster recovery plan for restoring physical records or facilities in the event of a natural disaster or physical breach?
YesNoNA

Technical Safeguards

1. Do you use encryption to protect PHI during electronic transmission (e.g., email, internet communication)?
YesNoNA
2. Do you ensure that access to electronic PHI (ePHI) is restricted through role-based access control (RBAC) and user authentication protocols?
YesNoNA
3. Do you use multi-factor authentication (MFA) to enhance security when accessing ePHI systems and applications?
YesNoNA
4. Do you regularly audit access logs to monitor and detect unauthorized access or suspicious activities related to ePHI?
YesNoNA
5. Do you have secure backup systems in place to protect ePHI from loss due to hardware failure or other incidents?
YesNoNA
6. Do you regularly update and patch your software and systems to mitigate security vulnerabilities? 
YesNoNA
7. Do you have firewalls, intrusion detection systems (IDS), or intrusion prevention systems (IPS) in place to protect ePHI from unauthorized access?
YesNoNA
8. Do you use secure methods to dispose of ePHI stored on electronic devices that are no longer in use (e.g., data wiping or secure degaussing)?
YesNoNA

PHI Protection

1. Do you classify and label PHI properly to ensure it is easily identified and treated with the necessary protections throughout its lifecycle?
YesNoNA
2. Do you ensure that all forms of PHI (electronic, paper, verbal) are identified, documented, and handled according to HIPAA guidelines?
YesNoNA
3. Do you track the flow of PHI within your organization, including its creation, storage, access, transmission, and destruction?
YesNoNA
4. Do you establish policies for handling PHI in non-traditional environments, such as remote work settings or external data storage solutions?
YesNoNA
5. Do you encrypt PHI when it is stored electronically (e.g., in databases, on servers, or on portable devices)?
YesNoNA
6. Do you ensure PHI is encrypted when transmitted electronically (e.g., over email, file transfers, or cloud storage)?
YesNoNA
7. Do you use secure communication channels (e.g., HTTPS, secure FTP) to send or receive PHI across networks? 
YesNoNA
8. Do you implement end-to-end encryption for PHI transferred to external parties, such as vendors, contractors, or business associates?
YesNoNA
9. Do you ensure that any wireless transmission of PHI (e.g., Wi-Fi networks) is securely encrypted and protected from unauthorized access?
YesNoNA
10. Do you implement role-based access control (RBAC) to ensure only authorized personnel can access PHI?
YesNoNA
11. Do you use multi-factor authentication (MFA) for users accessing systems that contain or process PHI?
YesNoNA

Annual Audit and Assessment

1. Do you conduct an annual HIPAA compliance audit to ensure all safeguards, policies, and procedures are followed?
YesNoNA
2. Do you assess the effectiveness of your technical and physical safeguards each year to identify any potential vulnerabilities or gaps?
YesNoNA
3. Do you evaluate your employees' adherence to HIPAA policies and determine whether additional training or resources are needed?
YesNoNA
4. Do you ensure that your risk assessments are comprehensive and updated based on any changes in your organizational structure, technology, or regulations?
YesNoNA
5. Do you document the results of your audits and assessments and track any corrective actions taken?
YesNoNA

Policies and Procedures

1. Do you have documented policies and procedures for managing PHI and ensuring HIPAA compliance?
YesNoNA
2. Do your policies address data access, sharing, and storage practices to prevent unauthorized access to PHI?
YesNoNA
3. Do your procedures include clear guidelines for responding to security incidents or breaches?
YesNoNA
4. Do you regularly review and update your policies and procedures to align with changes in HIPAA regulations or organizational needs?
YesNoNA
5. Do you communicate your policies clearly to all employees, business associates, and vendors handling PHI?
YesNoNA

Identifying Gaps

1. Do you have a process for identifying compliance gaps during your risk assessments or audits?
YesNoNA
2. Do you regularly assess areas like employee training, system vulnerabilities, and access control policies to spot any deficiencies?
YesNoNA
3. Do you conduct gap analysis after a breach or compliance issue to understand what went wrong and improve processes?
YesNoNA
4. Do you keep track of identified gaps and measure improvements over time?
YesNoNA

Remediation Plan

1. Do you have a remediation plan in place to address identified gaps, deficiencies, or compliance failures?
YesNoNA
2. Do you prioritize remediation actions based on the level of risk or impact they could have on patient data?
YesNoNA
3. Do you track the progress of your remediation efforts to ensure they are completed in a timely manner?
YesNoNA
4. Do you document the steps taken to correct non-compliance issues and prevent them from recurring?
YesNoNA
5. Do you communicate with stakeholders about remediation efforts and timelines for resolution?
YesNoNA

Employee Training

1. Do you provide mandatory HIPAA training for all employees handling PHI, including new hires and temporary staff?
YesNoNA
2. Do you offer periodic refresher training to ensure employees stay updated on HIPAA requirements and best practices?
YesNoNA
3. Do you track and document training completion to maintain compliance records?
YesNoNA
4. Do you provide specialized training for roles that require heightened access to sensitive PHI (e.g., IT staff, managers)?
YesNoNA
5. Do you test employees on their knowledge of HIPAA regulations and policies to assess training effectiveness?
YesNoNA

Business Associates (BA) and Vendors

1. Do you have Business Associate Agreements (BAAs) in place with all vendors and third parties who have access to PHI?
YesNoNA
2. Do your BAAs include provisions regarding the protection of PHI, breach notifications, and audit rights?
YesNoNA
3. Do you ensure that vendors comply with HIPAA regulations through regular audits or reviews?
YesNoNA
4. Do you evaluate vendor security practices to ensure they meet HIPAA standards before engaging in business?
YesNoNA
5. Do you maintain records of all BAAs and track their renewals?
YesNoNA

Breach Notification

1. Do you have a breach notification policy that outlines how to handle incidents involving PHI breaches?
YesNoNA
2. Do you notify affected individuals within 60 days in the event of a breach?
YesNoNA
3. Do you report breaches to the Department of Health and Human Services (HHS) when applicable?
YesNoNA
4. Do you notify the media if a breach affects 500 or more individuals?
YesNoNA
5. Do you have procedures in place to conduct a root cause analysis and prevent future breaches?
YesNoNA

Contingency Plan

1. Do you have a contingency plan to ensure the availability of PHI during emergencies or system failures?
YesNoNA
2. Do you back up ePHI regularly and store it securely to protect against data loss?
YesNoNA
3. Do you have a disaster recovery plan to restore access to PHI if systems are compromised?
YesNoNA
4. Do you test your contingency and disaster recovery plans annually to ensure they are effective and well-practiced?
YesNoNA
5. Do you review your plans after incidents to ensure they are adapted to handle emerging risks or scenarios?
YesNoNA

Disclaimer: This detailed checklist will help ensure that your organization is fully compliant with HIPAA regulations, from policies and training to breach management and contingency planning. It provides a structured approach to achieving, maintaining, and auditing compliance across all aspects of HIPAA safeguards.