HIPAA compliance checklist: an easy-to-follow guide

This post was updated in January 2026 to reflect the proposed HIPAA Security Rule update published by the U.S. Department of Health and Human Services (HHS) in January 2025.

A HIPAA compliance checklist helps you identify which rules apply to you and how to meet them. In this HIPAA compliance guide, you'll find the eight primary steps to achieving HIPAA compliance, tips for implementing them and frequently asked questions.

HIPAA compliance checklist overview

Every organization that uses, handles or discloses protected health information (PHI) needs to understand its compliance obligations under the Health Insurance Portability and Accountability Act (HIPAA). Not every organization must meet the same requirements to become compliant, which can make following HIPAA guidelines particularly confusing.

HIPAA-covered entities, like health plans, healthcare clearinghouses and healthcare providers, are responsible for meeting all HIPAA compliance requirements. Business associates that handle PHI must meet certain requirements, and some organizations that handle health information aren't covered by HIPAA at all.

A checklist gives organizations a clear way to identify and meet the requirements that apply to them. 

HIPAA compliance checklist: eight steps to compliance

Mismanaging PHI can have serious consequences for patients and for the organization that exposed their data. Organizations that expose PHI, intentionally or not, can face civil or criminal penalties.

HIPAA noncompliance can be expensive for organizations. Criminal violations can even lead to prison time. Because exposing patients' medical data is such a serious offense, organizations that handle PHI must comply with HIPAA regulations to protect patients.

Use these eight steps to achieve and maintain HIPAA compliance.

1. Thoroughly understand HIPAA’s three rules

Implementing the right HIPAA compliance controls starts with understanding the requirements in the Privacy Rule, the Security Rule and the Breach Notification Rule.

The Privacy Rule and Security Rule explain what organizations must do to protect PHI and electronic PHI (ePHI), including which safeguards to put in place. The Breach Notification Rule details the notification steps an organization must take after a breach.

You need to understand the intent of these requirements and review implementation specifications to develop the appropriate safeguards, procedures and policies for their organization.

2. Discover which rules apply to your organization

To start, determine whether your organization qualifies as a covered entity. Covered entities are responsible for implementing safeguards dictated by the Privacy Rule to protect all PHI, not just electronic data.

If your organization is a business associate, you're directly subject to the Security Rule and some Privacy Rule requirements through your business associate agreements (BAAs).

3. Determine what data requires extra protection

HIPAA protects individually identifiable health information, not all of your organization's data. 

Identify what data your organization collects, uses or stores both physically on paper and within your IT infrastructure. Determine how much of that data qualifies as PHI, and review how that data is collected, retrieved and deleted. You’ll also want to note who has access to that data and how it’s accessed.

Under the proposed Security Rule update, you'd also need a written inventory of the technology assets that touch ePHI and a network map showing how ePHI moves through your systems, both reviewed at least once every 12 months. 

4. Perform a risk analysis

Recognizing the gaps in your existing data security practices can help you see where additional controls or new procedures are needed to become HIPAA compliant. The HHS Security Risk Assessment (SRA) Tool maps how your current controls align with the requirements detailed in the Security Rule. 

Then audit your privacy and security policies and procedures against HIPAA's Privacy and Security Rules to find where they fall short. Your organization must maintain data security for PHI in use, at rest and during transmission, which often requires updating outdated systems. 

Use your analysis to create your own HIPAA risk assessment checklist and develop a compliance plan to close your security gaps and maintain HIPAA standards.

The proposed Security Rule update would make this more prescriptive. Your risk analysis would need to be written, cover specific elements such as threats, vulnerabilities and risk levels for each asset, and be reviewed at least once every 12 months.

5. Establish accountability in your compliance plan

Once you understand what your organization needs to do to achieve compliance, define who is accountable for which elements of your compliance plan to promote streamlined, transparent communication. 

Maintaining HIPAA compliance requires regular monitoring, audits, technology maintenance and training. Establishing responsible parties for those steps early can help you maintain HIPAA compliance.

6. Avoid violations by addressing gaps

Once you’ve created a compliance implementation and management plan, focus on introducing the privacy and security controls that will mitigate the most risk. Create a HIPAA compliance audit checklist to consistently review your improvements and detect more gaps to address.

Insiders, through error and misuse, cause many HIPAA violations, so balance technical safeguards, such as encryption, with physical safeguards, such as controlled facility access, and administrative safeguards, such as password policies and user training. 

7. Maintain detailed documentation

As you implement data privacy and security improvements to comply with HIPAA guidelines, track all progress with thorough documentation. This can include maintaining versions of your policies and procedures as they’re edited, tracking who attended compliance training sessions, and recording which entities you share PHI with.

The Security Rule requires you to keep written policies and procedures, and records of required actions, activities and assessments, for six years. These are also the first things the HHS Office for Civil Rights (OCR) asks for in an audit. Beyond what's required, document as much of your HIPAA compliance as you can so you can spot and close security gaps quickly. 

8. Report breaches promptly

If a breach affects 500 or more people, you must notify the HHS Secretary within 60 days of discovering it. Smaller breaches can be logged and reported once a year, within 60 days of the end of the calendar year. Following the Breach Notification Rule, you must also notify affected individuals without unreasonable delay, and no later than 60 days after discovery. If a breach affects more than 500 residents of a state or jurisdiction, you must also notify prominent media outlets serving that area.

OCR investigates every reported breach affecting 500 or more people, and it may investigate smaller ones. Conduct your own investigation into HIPAA violations and document your findings. Combined with OCR’s investigation, this can help you close security gaps and restore your organization’s HIPAA compliance. 

HIPAA compliance implementation tips

Implementing all the changes necessary to become HIPAA compliant can be time-consuming and costly. A few simple steps can improve your security while you work toward compliance, including:

• prioritizing training to reduce risky employee behavior.
• reviewing access logs to understand how, when and why users are accessing PHI.
• conducting unannounced facility walkthroughs to see whether staff follow procedures and physical documents are secure.
• storing ePHI backups securely offsite.
• removing access promptly when employees, contractors or vendors leave.
• requiring stronger security standards in your BAAs. 

HIPAA compliance checklist FAQ

What is a HIPAA compliance checklist?

A HIPAA compliance checklist lays out the steps to achieve and maintain compliance, including the safeguards you need to protect PHI.

Who is responsible for HIPAA compliance?

HIPAA-covered entities in the United States must comply with all HIPAA regulations. These include health plans, such as health insurers and HMOs; healthcare providers that transmit health information electronically, such as hospitals, clinics, nursing homes and physician practices; and healthcare clearinghouses, which process medical claims and billing data.

Business associates, such as accountants, law firms, IT providers and cloud vendors that handle PHI for a covered entity, are directly responsible for complying with the Security Rule and parts of the Privacy Rule. Some organizations that handle health information, such as life insurers and many school health centers, aren't covered by HIPAA at all, although laws, like FERPA, may apply. 

Is there a specific HIPAA compliance checklist for IT?

HIPAA doesn't have a dedicated IT compliance checklist, but IT teams are often responsible for implementing and managing administrative, technical and physical security controls to protect electronic PHI and safeguard against data breaches.

How do you make your website HIPAA compliant?

Ensuring your website is HIPAA compliant involves implementing encryption, secure data transmission, regular audits and access controls. HIPAA applies only if your site collects or displays PHI. Sign a BAA with your hosting provider, and avoid third-party tracking tools on pages that handle PHI.

Who enforces HIPAA compliance?

OCR enforces HIPAA through complaint investigations, compliance reviews and audits. 

What happens if you fail a HIPAA audit?

When an organization fails an OCR HIPAA audit, OCR will work with the organization to develop a corrective action plan to help it become compliant. These plans often involve a data risk analysis, data encryption, the creation and documentation of new policies and procedures, or training your workforce under OCR supervision.

If OCR finds violations, the organization may also face civil money penalties under the four tiers defined in HIPAA’s Omnibus Rule, or agree to a settlement. Individuals may also face criminal charges for some HIPAA violations.

Where access control fits in the checklist

Access management is an important part of any HIPAA technical requirements checklist. To keep ePHI secure, you need to control who can reach patient data and what they can do once they're in, without slowing down clinicians or staff. 

The Delinea Platform applies that control across the systems where ePHI lives. Secret Server vaults and rotates the privileged credentials that reach patient data and records the sessions, so an access log names a person rather than a shared account. Privileged Remote Access extends the same control to clinicians, contractors and vendors connecting from outside.

On the servers themselves, Privilege Control for Servers enforces least privilege and elevates access just-in-time rather than leaving it standing. 

Still not sure where to begin? See a live demo of how better access management brings you one step closer to HIPAA compliance.