Medical Practice HIPAA & Patient Data Security Checklist

1.1 Has your practice completed a comprehensive, annual HIPAA Security Risk Assessment (SRA) to identify vulnerabilities to Protected Health Information (PHI)?

1.2 Are all required HIPAA Security and Privacy Rule policies and procedures documented, up-to-date, and accessible to all staff?

1.3 Does your practice consistently adhere to HIPAA Privacy Rule requirements regarding patient rights, uses, and disclosures of PHI?

2.1 Are granular, role-based access controls implemented within your EHR system, ensuring staff only access the minimum necessary PHI?

2.2 Is all sensitive patient data encrypted both when being transmitted (to labs, cloud) and when stored (servers, devices)?

2.3 Do you have automated, encrypted, and regularly tested backups of all critical patient data and EHR systems, stored offsite?

3.1 Is your practice's network infrastructure (Wi-Fi, internet, internal network) secured with up-to-date firewalls, network segmentation, and secure configurations?

3.2 Are all devices used for practice work (laptops, desktops, tablets, phones) protected with up-to-date antivirus/anti-malware and Endpoint Detection & Response (EDR)?

3.3 Are all operating systems, EHR software, and other applications regularly updated with the latest security patches?

4.1 Do you have a signed Business Associate Agreement (BAA) in place with every vendor that creates, receives, maintains, or transmits PHI on your behalf?

4.2 Do you have a process for vetting the security practices of all third-party vendors, especially those with access to your systems or PHI?

4.3 Are secure, encrypted channels mandated and enforced for all data exchange with third-party vendors?

5.1 Is there a documented and regularly tested Incident Response Plan (IRP) specifically for data breaches and IT disruptions?

5.2 Do all staff (clinical, administrative, billing) receive regular, mandatory cybersecurity awareness training tailored to medical practice threats like phishing for PHI?

5.3 Are physical safeguards in place to protect PHI and IT systems (secure server rooms, locked filing cabinets, workstation security)?