HIPAA Security Checklist: A Practical Guide for Teams Handling Health Data

The first healthcare project I worked near, I remember someone saying “just don’t touch PHI unless you have to” — and honestly, that instinct captures most of HIPAA in one sentence. But once your system does need to touch protected health information, there’s a real, structured set of safeguards you need in place. This checklist breaks HIPAA’s Security Rule into things you can actually implement and verify.

What Is HIPAA, and What’s PHI?

The Health Insurance Portability and Accountability Act (HIPAA) sets national standards for protecting health information in the US. Protected Health Information (PHI) is any individually identifiable health information — not just diagnoses, but names, dates, addresses, and other identifiers when connected to health data.

HIPAA’s Security Rule breaks required safeguards into three categories: administrative, physical, and technical.

The HIPAA Security Checklist

Administrative Safeguards

• Conduct a formal risk analysis identifying where PHI is created, received, stored, or transmitted
• Assign a designated Security Officer responsible for HIPAA compliance
• Implement workforce training on PHI handling, updated annually
• Establish access management procedures — granting, modifying, and revoking access to PHI
• Maintain a documented incident response and breach notification procedure
• Execute Business Associate Agreements (BAAs) with any third party that handles PHI on your behalf

Physical Safeguards

• Restrict physical access to facilities and systems storing PHI
• Implement workstation security policies (screen locks, positioning to prevent shoulder-surfing)
• Control and log device and media disposal to prevent data recovery from decommissioned hardware

Technical Safeguards

• Implement unique user identification for anyone accessing PHI — no shared logins
• Enforce automatic logoff after periods of inactivity
• Encrypt PHI at rest and in transit
• Maintain audit controls logging access to systems containing PHI
• Implement integrity controls to detect unauthorized alteration of PHI
• Enforce transmission security for any PHI sent over networks, including email

flowchart TD
    A[PHI Identified in System] --> B[Risk Analysis Performed]
    B --> C[Administrative Safeguards Applied]
    B --> D[Physical Safeguards Applied]
    B --> E[Technical Safeguards Applied]
    C --> F[Documented & Audited]
    D --> F
    E --> F
    F --> G[Ongoing Monitoring & Annual Review]

Step-by-Step: Building HIPAA-Compliant Systems

Step 1: Identify Where PHI Lives

Map every system, database, log, and third-party integration that touches PHI. This is the foundation everything else builds on.

Step 2: Conduct a Risk Analysis

Assess likelihood and impact of potential threats to each PHI location identified in step 1, and document the findings — this document is one of the most commonly requested items during a HIPAA audit or investigation.

Step 3: Implement Access Controls

Apply role-based access control so only people who genuinely need PHI for their job function can access it, with unique credentials per user and MFA where feasible.

Step 4: Encrypt Everything Sensitive

While HIPAA technically treats encryption as “addressable” rather than strictly “required,” in practice it’s the standard expectation, and failing to encrypt PHI is hard to justify during an investigation.

Step 5: Set Up Audit Logging

Every access to PHI should be logged with who, what, and when, retained long enough to support investigations and periodic review.

Step 6: Establish Breach Notification Procedures

HIPAA requires notifying affected individuals, and in some cases the Department of Health and Human Services and media, within specific timeframes after discovering a breach involving unsecured PHI.

Best Practices

• Treat encryption as mandatory in practice, even though it’s technically “addressable” under the rule.
• Get Business Associate Agreements signed before any vendor touches PHI, not after.
• Automate audit logging rather than relying on manual review — PHI access volume is usually too high for manual tracking to be reliable.
• Segment systems containing PHI from the broader network to limit exposure if other systems are compromised.
• Review and update your risk analysis at least annually, and whenever significant system changes occur.

Common Mistakes

• Assuming a BAA isn’t needed for a “small” vendor. Any third party handling PHI on your behalf needs a BAA, regardless of size.
• Using shared or generic login credentials. This directly violates the unique user identification requirement and makes audit logging meaningless.
• Treating the risk analysis as a one-time task. It needs to be revisited regularly, especially after infrastructure or vendor changes.
• Sending PHI over unencrypted email or messaging. This is one of the most common and preventable HIPAA violations.
• Forgetting mobile devices and laptops. Portable devices with PHI need the same encryption and access control standards as servers.

FAQs

Does HIPAA apply to all healthcare-related companies? It applies to “covered entities” (healthcare providers, health plans, clearinghouses) and their “business associates” — vendors that handle PHI on their behalf. Not every health-adjacent company is automatically covered, but many are.

Is encryption mandatory under HIPAA? Technically it’s labeled “addressable,” meaning you can implement an equivalent alternative, but in practice encryption is the expected standard and alternatives are hard to justify.

What happens after a HIPAA breach? You’re required to notify affected individuals, and depending on the scope, the Department of Health and Human Services and potentially media outlets, within defined timeframes.

How is HIPAA different from GDPR? HIPAA specifically governs health information in the US healthcare context, while GDPR is a broader EU regulation covering all types of personal data across industries.

Conclusion

HIPAA compliance comes down to knowing exactly where PHI lives in your systems and applying administrative, physical, and technical safeguards consistently around it. The risk analysis is the foundation — everything else, from access control to encryption to audit logging, flows from understanding where the actual exposure is. Treat this checklist as a living document, revisit it as your systems evolve, and you’ll be in a far stronger position than teams that only think about HIPAA when an audit letter shows up.