Free HIPAA Compliance Checklist 2026 | Are You HIPAA Compliant?

Administrative Safeguards

▾

Designate a HIPAA Security Officer §164.308(a)(2) Assign a specific individual responsible for developing and implementing security policies and procedures.

Designate a HIPAA Privacy Officer §164.530(a)(1) Assign an individual responsible for the development and implementation of privacy policies.

Conduct a Security Risk Assessment §164.308(a)(1)(ii)(A) Perform a thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Implement a Risk Management Policy §164.308(a)(1)(ii)(B) Document security measures to reduce identified risks and vulnerabilities to a reasonable level.

Implement Workforce Sanctions Policy §164.308(a)(1)(ii)(C) Apply appropriate sanctions against workforce members who violate security policies.

Review Information System Activity §164.308(a)(1)(ii)(D) Regularly review records of system activity such as audit logs, access reports, and security incident tracking.

Role-Based Access Controls §164.308(a)(3) Ensure workforce members have appropriate access to ePHI based on their role, and prevent unauthorized access.

Workforce Training Program §164.308(a)(5) Provide regular security awareness training to all workforce members including management.

Security Incident Procedures §164.308(a)(6) Establish policies for identifying, responding to, reporting, and mitigating security incidents.

Contingency Plan §164.308(a)(7) Establish a data backup plan, disaster recovery plan, and emergency mode operation plan for ePHI.

Business Associate Agreements §164.308(b)(1) Obtain signed BAAs from all vendors and partners who create, receive, maintain, or transmit ePHI on your behalf.

Periodic Policy Evaluations §164.308(a)(8) Perform periodic technical and nontechnical evaluations in response to environmental or operational changes.

Physical Safeguards

▾

Facility Access Controls §164.310(a)(1) Implement policies to limit physical access to electronic information systems and the facilities where they are housed.

Workstation Use Policy §164.310(b) Define the proper functions, manner of use, and physical attributes of workstations that access ePHI.

Workstation Security §164.310(c) Implement physical safeguards for all workstations that access ePHI to restrict access to authorized users.

Device and Media Controls §164.310(d)(1) Implement policies for the disposal, re-use, and movement of hardware and electronic media containing ePHI.

Hardware Inventory and Tracking §164.310(d)(2)(iii) Maintain records of the movements of hardware and electronic media, including the person responsible.

Technical Safeguards

▾

Unique User Identification §164.312(a)(2)(i) Assign a unique username and/or number for identifying and tracking user identity in systems with ePHI.

Emergency Access Procedure §164.312(a)(2)(ii) Establish procedures for obtaining necessary ePHI during an emergency.

Automatic Logoff §164.312(a)(2)(iii) Implement electronic procedures that terminate sessions after a predetermined period of inactivity.

Encryption of ePHI §164.312(a)(2)(iv) Implement mechanisms to encrypt and decrypt ePHI at rest and in transit.

Audit Controls §164.312(b) Implement hardware, software, and procedural mechanisms to record and examine activity in systems containing ePHI.

Integrity Controls §164.312(c)(1) Implement policies and procedures to protect ePHI from improper alteration or destruction.

Transmission Security §164.312(e)(1) Implement technical security measures to guard against unauthorized access to ePHI being transmitted over a network (TLS, VPN, etc.).

Authentication of Persons or Entities §164.312(d) Implement procedures to verify that a person or entity seeking access to ePHI is who they claim to be (MFA, etc.).

Organizational Requirements

▾

Business Associate Contracts §164.314(a) Ensure contracts with business associates require them to implement appropriate safeguards for ePHI.

Group Health Plan Requirements §164.314(b) If applicable, ensure group health plan documents require the plan sponsor to implement appropriate safeguards.

Notice of Privacy Practices §164.520 Maintain and distribute a clear Notice of Privacy Practices describing how you use and disclose PHI.

Breach Notification

▾

Breach Notification Policy §164.404 Have documented procedures for notifying affected individuals within 60 days of discovering a breach of unsecured PHI.

HHS Notification Procedure §164.408 Have procedures to notify the Secretary of HHS of breaches (immediately for 500+ individuals, annually for smaller breaches).

Media Notification §164.406 For breaches affecting 500+ residents of a state, have procedures to notify prominent media outlets.

Breach Documentation §164.414 Maintain documentation of all breach investigations, risk assessments, and notifications for at least 6 years.

Administrative Safeguards

Physical Safeguards

Technical Safeguards

Organizational Requirements

Breach Notification

Get the Full HIPAA Compliance Toolkit