HIPAA does not hand clinics a parts list, so someone has to translate the Security Rule into things IT can check.
A HIPAA IT checklist covers seven areas of the Security Rule: a documented risk analysis, access controls, encryption, backups and recovery, audit logs, staff training, and written agreements with every vendor that touches patient data. This guide explains each in plain terms for Florida clinics. It is general information, not legal advice.
What the Security Rule asks of a clinic
The Security Rule applies to covered entities, which include health care providers that send health information electronically in connection with standard transactions such as insurance claims, and to their business associates. It protects electronic protected health information (ePHI) with administrative, physical and technical safeguards, set out in 45 CFR Part 164, Subpart C.
The rule is flexible by design. You choose measures that fit your size, technical setup, budget and the likelihood and seriousness of the risks. Each implementation specification is either required or addressable. Addressable does not mean optional: you assess whether it is reasonable and appropriate, then implement it, or document why not and use an equivalent measure if that is reasonable.
HHS proposed an update in January 2025 that would remove the addressable label (Federal Register). As of October 2026 it had not been finalized, so the current rule still applies.
Risk analysis: the starting point
The risk analysis is a required part of the rule: an accurate and thorough assessment of the risks to the confidentiality, integrity and availability of ePHI, followed by measures that bring those risks to a reasonable and appropriate level. You may see it called a HIPAA security risk assessment. It is where organizations struggle: HHS’s 2016 to 2017 audits found that only 14 percent of audited covered entities were substantially meeting their risk analysis responsibilities, as the same proposal notes.
- List where patient data lives: the EHR, practice management and billing, imaging, email, shared drives, laptops, phones, copiers and scanners, backups and cloud storage.
- Note the threats and weak spots for each: unpatched software, shared logins, lost devices, phishing, a vendor with broad access.
- Rate likelihood and impact, rank the risks and write a remediation plan with owners and dates. Repeat it when something changes, such as a new EHR, a new location or a new cloud vendor.
The HHS Security Risk Assessment Tool, built by ONC with the Office for Civil Rights for small and medium providers, is a reasonable starting point. NIST SP 800-66 Rev. 2 (2024) gives practical guidance for implementing the rule, and HHS’s voluntary Health Industry Cybersecurity Practices (2023) has a volume for small practices. Using any of them does not by itself mean you meet the rule.
Access control: who can open patient records
The rule requires unique user identification, so every person has their own login, and an emergency access procedure for reaching patient data when normal access fails. It also asks you to verify who is signing in. In practice:
- One login per person. A shared “front desk” account breaks access control and your audit trail at the same time.
- Multi-factor authentication on email, the EHR and remote access, which is the usual way to verify identity.
- Role-based access and automatic logoff, so staff reach only what their role requires and unattended exam room screens lock.
- A joiner and leaver process: accounts created on the first day and disabled on the last.
Encryption: laptops, phones, servers and email
Encryption is addressable under the rule, for stored data and for data in transit. It is hard to justify skipping: it answers what happens when a laptop goes missing. Encrypt laptops, desktops and phones that can reach patient data, plus servers and backups, protect data in transit with a VPN or TLS, and keep recovery keys somewhere other than the device.
Encryption also changes what follows a loss. The breach notification rule applies to “unsecured” protected health information, meaning PHI that has not been made unusable, unreadable or indecipherable to unauthorized people by methods HHS specifies, and Florida’s breach law leaves encrypted information out of its definition of personal information. Ask your attorney how each applies to a specific incident.
Backups and recovery: the contingency plan
Three parts of the contingency plan are required: a data backup plan that keeps retrievable exact copies of ePHI, a disaster recovery plan to restore lost data, and an emergency mode operation plan so critical work continues while systems are down. Testing and revising the plan is addressable.
- Back up everything that holds patient data: the EHR database, imaging, shared files and email.
- Keep one encrypted copy offline or immutable, out of reach of everyday accounts.
- Restore a real system on a schedule and record what happened.
- Write down the recovery order, and plan for downtime with paper forms, a printed schedule and a phone tree.
Ransomware is why this matters. The FBI’s 2025 Internet Crime Report counted 460 ransomware complaints from healthcare and public health, more than from any other critical infrastructure sector. Our backup and disaster recovery service keeps separate, tested backups, so a failed server or an encrypted file share means a restore, not a rebuild.
Audit logs: knowing who touched what
Audit controls are a required standard: record and examine activity in the systems that contain or use ePHI. The rule also requires regular review of audit logs, access reports and security incident tracking reports.
- Turn on the EHR’s access logging and decide who reviews it, how often, and what counts as unusual, such as a staff member opening records of patients they do not treat.
- Collect sign-in and administrator activity from email, the firewall, remote access and servers, and alert on failed sign-ins and new administrator accounts.
- Write down how long you keep logs and who can read or delete them.
Logs only help if someone looks at them. Our managed detection and response service watches endpoints and network activity around the clock, while reviewing clinical access to charts stays with your privacy or compliance officer.
Staff training and awareness
A security awareness and training program for every member of the workforce, including management, is a required standard. Its parts, which are security reminders, protection from malicious software, log-in monitoring and password management, are addressable. A sanction policy for staff who ignore the rules is required as well.
- Train new staff before they get system access, refresh everyone on a schedule, and keep attendance records, because the rule expects written documentation.
- Send short reminders between sessions, and run simulated phishing emails so people practice spotting the real ones.
- Make reporting easy: one address or number for a suspicious email, a lost phone or a misdirected fax.
Our email security and awareness training covers the phishing side.
Healthcare IT support: what to ask your vendors
A covered entity may let a business associate handle ePHI only with satisfactory assurances, documented in a written contract. The agreement must require the vendor to follow the Security Rule, hold its subcontractors to the same standard, and report any security incident it learns of, including breaches of unsecured PHI. Your EHR vendor, billing company, cloud host, backup provider and IT provider are usually business associates. When you choose healthcare IT support or any other vendor, ask:
- Will you sign a business associate agreement, and who are your subcontractors?
- How do you protect our data: encryption, multi-factor sign-in, logging and patching?
- How quickly will you tell us about an incident? Florida law gives a third-party agent up to 10 days after determining a breach, so ask what the contract commits to.
- Where is our data stored, and what happens to it when the contract ends?
Florida’s breach law runs alongside HIPAA
Section 501.171 of the 2025 Florida Statutes requires reasonable measures to protect personal information, including medical and health insurance details. It sets a 30-day deadline to notify affected individuals after a breach is determined, and to notify the Department of Legal Affairs when 500 or more Floridians are affected. The statute treats notice given under a federal regulator’s rules as compliant if you notify individuals under those rules and send the Department a timely copy. Confirm with counsel how that applies to your clinic.
What to do next
To have an outside engineer check your clinic’s IT against this list, start with the complimentary assessment. SNATEK provides IT support for healthcare practices from our office in Cooper City, across Broward, Miami-Dade and Palm Beach counties. Our compliance and cyber insurance readiness work maps the technical controls we run to HIPAA and HITECH safeguards, so the evidence for your risk analysis exists when you need it. Compliance decisions stay with you and your counsel.
Frequently asked questions
Is there a HIPAA certification for IT vendors or software?
HHS has said it does not endorse or recognize private certifications of Security Rule compliance, so be cautious about any vendor that advertises one. What you can ask for is a signed business associate agreement and a clear description of the safeguards the vendor uses (HHS OCR FAQ).
Does HIPAA require encryption?
Encryption is an addressable specification, for stored data and for data in transit. You must assess it, then implement it or document why it is not reasonable and use an equivalent measure. For laptops, phones, servers and backups that is a hard case to make, and HHS’s January 2025 proposal would require encryption, with limited exceptions.
How often does a clinic need a risk analysis?
The rule sets no fixed interval. It asks for an accurate and thorough analysis and for evaluation whenever your environment or operations change, so a new EHR, office or cloud vendor should trigger a fresh look. Many practices also schedule one every year.
Does a small practice need all of this?
Yes, the rule applies whatever your size, but how you meet it can scale. You weigh your size, technical setup, costs and the likelihood and seriousness of the risks, and you document the choices. A five-person clinic and a hospital will not look alike, but both need a risk analysis and written policies.
Written by the SNATEK engineering team, Cooper City, Florida. Managed IT, cybersecurity and cloud support for South Florida organizations since 1996.