HIPAA checklist for the software your clinic runs

This checklist covers the software side of HIPAA for a small practice. It is general information and not legal advice. The rules and HHS guidance are the source of truth, and your compliance officer or counsel has the final word on what applies to your practice. Start with the HHS page for HIPAA professionals and its Security Rule summary.

Know what you run

• List every system that stores, sends or displays patient information: the EHR, scheduling, billing, patient messaging, telehealth, email, fax, document scanning, backups, and the phones and laptops staff use.
• Note who administers each one and who the vendor is.
• Note where patient information leaves the building, such as exports, reports and shared folders.
• Update the list whenever you add or retire a tool.

Vendors and agreements

• Identify which vendors create, receive, maintain or transmit patient information for you. These are generally business associates, and HHS has guidance on business associates.
• Confirm you hold a signed business associate agreement for each of them, and know where it is filed.
• Ask each vendor which subcontractors touch your data.
• Revisit the list at every renewal.

Risk analysis

• The Security Rule expects a documented risk analysis of the electronic patient information you hold. Check that yours exists, covers every system on your list, and carries a date.
• Repeat it when you add systems, move offices or change how data flows, and record what you decided to do about each risk it found.
• Keep it with the rest of your HIPAA documentation.

Access

• Every person who uses a system has their own login. Shared logins make an audit trail useless.
• Roles limit what each person can see and change, so a front-desk user does not get clinical notes they have no need for.
• Staff who leave lose access the same day, and the process names who does it.
• Sessions lock after a period of inactivity.
• Multi-factor sign-in is switched on wherever the system offers it.

Logs and monitoring

• Know where each system’s audit log lives and who can read it.
• Someone looks at the logs on a schedule, and the schedule is written down.
• Decide what to look for, such as access to the records of a colleague’s family, activity at odd hours and large exports.

Backups and recovery

• Backups exist for every system that holds patient records, are kept apart from the originals, and are encrypted.
• Someone has restored from a backup recently enough to know it works.
• A written plan says how the clinic keeps seeing patients when the main system is down, and staff know where to find it.

Devices and messages

• Laptops, tablets and phones that can reach patient information are encrypted and can be wiped remotely.
• Email and text tools that carry patient information protect it in transit and, where the provider is a business associate, are covered by an agreement. Ordinary consumer messaging apps are generally not built for this, so ask your compliance officer before staff use them.
• Guest Wi-Fi runs separately from the Wi-Fi and wiring the clinic systems use.

Patient access requests

• You can produce a patient’s records from the system in the form they are entitled to ask for. HHS sets out the rules, including the general 30-day response time, on its right of access page. State law can be stricter.
• Someone owns each request and records when it came in and when it went out.

If something goes wrong

• A written incident plan says who decides, who calls the vendor and who calls counsel.
• The Breach Notification Rule sets deadlines for telling affected individuals and HHS. Read the HHS breach notification page before you need it, and keep the plan next to it.
• A lost or stolen device is reported to the person named in the plan at once, not at the end of the week.

People and paperwork

• Staff are trained on your policies when hired and again on a schedule, and each session is recorded.
• Policies are written down, dated and kept. The Security Rule expects documentation to be retained for six years from the date it was created or last in effect, whichever is later.
• Sanctions for violating the policies are written down too.

For questions to put to a vendor, use the EHR vendor question list. The security and compliance articles go deeper on individual topics.