HIPAA Compliance Checklist: Privacy, Security, and Breach Rules
A HIPAA compliance checklist covers five areas: the Privacy Rule, the Security Rule, the Breach Notification Rule, business associate agreements, and the training, policies, and documentation that prove the rest, with a current risk analysis at the center of the Security Rule. HIPAA applies to covered entities, meaning health plans, health care clearinghouses, and health care providers that transmit health information electronically in standard transactions such as claims, and to the business associates that handle protected health information (PHI) for them. No government agency certifies HIPAA compliance, so the checklist doubles as your evidence file: each line below names the requirement, its citation in 45 CFR Part 164, and the record that shows you meet it.
The tables reflect the regulations as of October 2026.
Who does HIPAA apply to?
HIPAA binds two groups, both defined in 45 CFR 160.103; confirm which one you are first.
| Group | Definition in 45 CFR 160.103 | Examples |
|---|---|---|
| Covered entity | "A health plan," "a health care clearinghouse," or "a health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter" | Hospitals, practices, pharmacies, and labs that bill electronically; health insurers and employer group health plans; billing clearinghouses |
| Business associate | A person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information" for a regulated function or activity | SaaS and cloud vendors that store PHI, billing companies, managed IT providers, and law or accounting firms with PHI access |
| Subcontractor | A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate | A SaaS vendor's cloud host, support outsourcer, or backup provider |
| Outside HIPAA | Organizations that hold health information without one of these roles | A fitness app sold directly to consumers; an employer holding sick leave records as employer |
Encryption does not take a cloud vendor out of scope. HHS's cloud computing guidance says "Lacking an encryption key does not exempt a CSP from business associate status."
The HIPAA compliance checklist at a glance
The table summarizes each area, its usual owner, and its evidence; later sections list the line items.
| Area | Core requirements | Citation | Usual owner | Evidence to keep |
|---|---|---|---|---|
| Privacy Rule | Notice of privacy practices, minimum necessary, patient rights, privacy official, complaints, sanctions | 45 CFR 164.500 to 164.534 | Privacy officer | Notice versions, request logs, complaint log |
| Security Rule | Risk analysis and risk management, then administrative, physical, and technical safeguards for ePHI | 45 CFR 164.302 to 164.318 | Security officer | Risk analysis, risk management plan, policies, access reviews |
| Breach Notification Rule | Breach risk assessments and notices to individuals, HHS, and the media | 45 CFR 164.400 to 164.414 | Privacy officer with counsel | Incident log, risk assessments, copies of notices |
| Business associate agreements | A compliant agreement with every vendor that handles PHI | 45 CFR 164.504(e), 164.314(a) | Legal or procurement | Vendor inventory and signed agreements |
| Training | Privacy training for the workforce and a security awareness program | 45 CFR 164.530(b), 164.308(a)(5) | HR with privacy and security officers | Training records by person and date |
| Policies and documentation | Written policies and procedures, and records kept for six years | 45 CFR 164.316, 164.530(i) and (j) | Privacy and security officers | Policy library with version history |
Privacy Rule checklist
The Privacy Rule governs how covered entities use and disclose PHI and what rights patients and plan members hold. Business associates carry the parts their agreements assign to them.
| Item | What the rule requires | Citation |
|---|---|---|
| Notice of privacy practices | Describe uses, disclosures, and rights; providers with a direct treatment relationship give it at first service and seek written acknowledgment; post it on your website. Compliance with the 2024 notice changes still in effect was due February 16, 2026. | 164.520 |
| Minimum necessary | Limit uses, disclosures, and requests to the minimum PHI needed for the purpose; disclosures for treatment are exempt. | 164.502(b), 164.514(d) |
| Right of access | Act on a request no later than 30 days after receipt, with one extension of up to 30 days if you give a written reason and date within the first 30; charge only a reasonable, cost-based fee. | 164.524 |
| Amendment | Act on a request to amend within 60 days, with one extension of up to 30 days. | 164.526 |
| Accounting of disclosures | Account for disclosures made in the six years before the request, within 60 days, with one 30-day extension; the first accounting in any 12 months is free. | 164.528 |
| Restrictions and confidential communications | Consider restriction requests, grant those that withhold disclosures to a health plan for care paid in full out of pocket, and accommodate reasonable requests for confidential communications. | 164.522 |
| Privacy official and contact | Designate a privacy official and a contact person who receives complaints. | 164.530(a) |
| Complaints, sanctions, mitigation | Run a complaint process, sanction workforce members who violate policy, and mitigate known harmful effects. | 164.530(d) to (f) |
HHS revised its model notices of privacy practices in February 2026 to reflect the 2024 Part 2 changes for substance use disorder records. OCR enforces the access deadline: in August 2026 it announced a $50,000 settlement with Azul Vision, Inc., an eye care group with 31 California clinics, after a patient who requested her records on January 9, 2023 received them on January 6, 2025.
Security Rule checklist
The Security Rule applies to ePHI held by covered entities and business associates alike, and each implementation specification is either required (R) or addressable (A). An addressable specification still demands a decision under 45 CFR 164.306(d): implement it if it is reasonable and appropriate, and if it is not, document why and implement an equivalent alternative where that is reasonable.
| Safeguard | Standard | Implementation specifications |
|---|---|---|
| Administrative, 164.308 | Security management process | Risk analysis (R); risk management (R); sanction policy (R); information system activity review (R) |
| Administrative | Workforce security | Authorization or supervision (A); workforce clearance (A); termination procedures (A) |
| Administrative | Information access management | Isolating clearinghouse functions (R); access authorization (A); access establishment and modification (A) |
| Administrative | Security awareness and training | Security reminders (A); protection from malicious software (A); log-in monitoring (A); password management (A) |
| Administrative | Assigned security responsibility; security incident procedures | Designate a security official (R); response and reporting (R) |
| Administrative | Contingency plan | Data backup (R); disaster recovery (R); emergency mode operation (R); testing and revision (A); applications and data criticality analysis (A) |
| Administrative | Evaluation; business associate contracts | Periodic technical and nontechnical evaluation (R); written contract or other arrangement (R) |
| Physical, 164.310 | Facility access controls | Contingency operations (A); facility security plan (A); access control and validation (A); maintenance records (A) |
| Physical | Workstation use and security | Workstation use (R); workstation security (R) |
| Physical | Device and media controls | Disposal (R); media re-use (R); accountability (A); data backup and storage (A) |
| Technical, 164.312 | Access control | Unique user identification (R); emergency access procedure (R); automatic logoff (A); encryption and decryption (A) |
| Technical | Audit controls; integrity | Record and examine system activity (R); mechanism to authenticate ePHI (A) |
| Technical | Person or entity authentication; transmission security | Verify the identity of users (R); integrity controls (A); encryption (A) |
Source: 45 CFR Part 164, Subpart C, and HHS's Summary of the HIPAA Security Rule, read October 2026.
The January 2025 proposal would rewrite this table. HHS's fact sheet on the proposal says it would remove the distinction between required and addressable specifications, require encryption of ePHI at rest and in transit and multi-factor authentication with limited exceptions, and add vulnerability scanning every six months and penetration testing every 12 months. As of October 2026 the proposal is not final, and HHS's 2026 Unified Agenda lists it under long-term actions with a final action date of July 2027; our HIPAA Security Rule update tracks it. In BD Emerson's view, few risk analyses can justify leaving encryption or MFA off an ePHI system, so treat both as defaults now.
Breach Notification Rule checklist
An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented risk assessment shows a low probability that the PHI has been compromised. The assessment weighs four factors: the PHI involved, who received it, whether it was acquired or viewed, and how far the risk was mitigated. Deadlines run from discovery: the first day the breach is known, or with reasonable diligence would have been known, to any workforce member or agent other than the person who committed it.
| Notice | Who and when | Citation |
|---|---|---|
| Individuals | Each affected individual, without unreasonable delay and no later than 60 calendar days after discovery, by first-class mail or agreed email | 164.404 |
| Substitute notice | A website posting or major media notice, plus a toll-free number, each for 90 days, when contact information is out of date for 10 or more people | 164.404(d)(2) |
| Media | Prominent media outlets serving a state or jurisdiction when the breach involves more than 500 of its residents, within the same 60 days | 164.406 |
| HHS, 500 or more individuals | The HHS breach portal, at the same time as individual notice and no later than 60 days after discovery | 164.408(b) |
| HHS, fewer than 500 | A log of each breach, submitted no later than 60 days after the end of the calendar year in which the breaches were discovered | 164.408(c) |
| Business associate to covered entity | Without unreasonable delay and no later than 60 days after discovery, identifying each affected individual where possible | 164.410 |
| Burden of proof | Documentation that every required notice went out, or of why no notice was required | 164.414(b) |
Source: HHS Breach Notification Rule guidance and 45 CFR 164.400 to 164.414.
State breach laws apply alongside HIPAA, so check the deadline in each state where your patients or members live before an incident.
Business associate agreement checklist
Sign a business associate agreement before a vendor creates, receives, maintains, or transmits PHI for you. Under 45 CFR 164.504(e) and the security terms in 164.314(a), every agreement must cover these terms:
- The permitted and required uses and disclosures of PHI, and no other use or disclosure except as the contract or the law requires.
- Appropriate safeguards, including compliance with the Security Rule for ePHI.
- Reporting of any use or disclosure the contract does not allow, including breaches of unsecured PHI under 164.410 and security incidents.
- The same restrictions for any subcontractor that handles the PHI.
- Support for individual rights: access under 164.524, amendment under 164.526, and the information needed for an accounting under 164.528.
- Compliance with the Privacy Rule for any covered entity obligation the vendor carries out.
- Availability of internal practices, books, and records to HHS.
- Return or destruction of all PHI at termination if feasible, and continued protection where it is not.
- The covered entity's right to terminate if the business associate violates a material term.
Keep a vendor inventory that shows which vendors touch PHI and when each agreement was signed and last reviewed. Your risk analysis still has to cover the risk each vendor brings.
Training, policies, and documentation
HIPAA requires training but sets no annual interval. Section 164.530(b) requires Privacy Rule training for each workforce member within a reasonable period after joining and after a material policy change, and 164.308(a)(5) requires a security awareness and training program for the whole workforce, including management. BD Emerson recommends training at hire and every year, because a dated annual record is easy to defend. Sections 164.316 and 164.530(i) and (j) require written policies and procedures, kept with the records they call for, for six years from creation or the date last in effect, whichever is later.
The HIPAA risk analysis
The risk analysis is the first required specification in the Security Rule and the subject of OCR's Risk Analysis Initiative, which had produced 14 enforcement actions by June 2026. It must assess the risks to all ePHI you hold and feed a risk management plan with owners and dates. Our HIPAA security risk assessment guide walks through the eight-step method, a scored risk register row, and how often to update it.
Short checklists for a covered entity and a SaaS business associate
The two tables compress the checklist for its two most common readers. Each line names a record you should be able to produce on request.
| Covered entity item | Proof to keep |
|---|---|
| Notice of privacy practices current and posted on your website | Current notice and its effective date |
| Privacy official and security official designated in writing | Designation records |
| Risk analysis covering every ePHI system, updated within the past year | Signed analysis and risk management plan |
| Business associate agreement with every vendor that touches PHI | Vendor inventory with agreement dates |
| Access requests answered within 30 days | Request log with receipt and response dates |
| Breach procedure with the four-factor assessment | Incident log and completed assessments |
| Workforce trained at hire and annually | Training records |
| SaaS business associate item | Proof to keep |
|---|---|
| Signed agreement with each customer that sends you PHI | Agreement register by customer |
| Subcontractor agreements with your cloud host and any vendor that stores PHI | Subcontractor agreement list |
| Risk analysis that covers production, backups, logs, and support tooling | Signed analysis and risk management plan |
| Encryption in transit and at rest, and MFA for workforce access to PHI | Configuration exports |
| Breach reports to customers within 60 days of discovery, or sooner if an agreement requires it | Incident procedure and notice templates |
| Tested backups and a contingency plan | Restore test results |
Our guide to HIPAA compliance for SaaS companies covers the business associate case in more depth.
Is there an official HIPAA certification?
No. HHS does not certify organizations as HIPAA compliant and does not recognize anyone else's certification. Its FAQ on Security Rule certification says "there is no standard or implementation specification that requires a covered entity to 'certify' compliance," that HHS "does not endorse or otherwise recognize private organizations' 'certifications'," and that a certification "does not preclude HHS from subsequently finding a security violation." When a vendor calls itself HIPAA certified, ask what stands behind the phrase. It usually means staff took a HIPAA course, an outside firm assessed the vendor against HIPAA, or the vendor holds a SOC 2 report or a HITRUST certification. Each is useful evidence, and none transfers the vendor's HIPAA obligations.
What are the penalties for HIPAA violations?
OCR sets civil money penalties in four culpability tiers under 45 CFR 160.404, adjusted each year for inflation. HHS published the 2025 adjustment in the Federal Register on January 28, 2026. The adjusted amounts apply to penalties assessed on or after that date for violations that occurred on or after November 2, 2015.
| Tier | Culpability | Per violation | Calendar-year cap for identical violations |
|---|---|---|---|
| 1 | Did not know and, with reasonable diligence, would not have known | $145 to $73,011 | $2,190,294 |
| 2 | Reasonable cause, not willful neglect | $1,461 to $73,011 | $2,190,294 |
| 3 | Willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 |
| 4 | Willful neglect, not corrected within 30 days | $73,011 to $2,190,294 | $2,190,294 |
Source: HHS, Annual Civil Monetary Penalties Inflation Adjustment, 91 FR 3665 (January 28, 2026).
Under a 2019 notice of enforcement discretion, OCR applies lower annual caps by tier: $25,000, $100,000, $250,000, and $1.5 million, each adjusted for inflation. Most enforcement ends in a resolution agreement with a payment and a corrective action plan. Of the actions dated January 2025 through September 2026 on HHS's resolution agreements page, two were civil money penalties, $1,500,000 against Warby Parker and $200,000 against Oregon Health & Science University.
How to prove HIPAA compliance to customers
With no certificate to point to, customers ask for evidence. Keep this pack ready if you sell to health systems or payers.
| Evidence | What it shows | Who produces it |
|---|---|---|
| Signed business associate agreement and subcontractor list | You accept HIPAA obligations and flow them down | Your legal team |
| Risk analysis summary and risk management plan status | You meet 164.308(a)(1) and act on the results | Your security officer or outside assessor |
| HIPAA audit or gap assessment report | An outside firm tested your program against HIPAA requirements | An independent assessor, such as a HIPAA audit provider |
| SOC 2 Type 2 report mapped to HIPAA | Your controls operated over a period, examined by a CPA firm | A CPA firm |
| HITRUST certification | An authorized external assessor validated your controls and HITRUST certified them | HITRUST and its assessor |
| Penetration test summary | Exploitable weaknesses were tested and fixed | A testing firm |
| Policies, training records, incident procedure | The administrative safeguards exist and run | Your compliance team |
BD Emerson performs HIPAA risk analyses, gap assessments, and HIPAA audits, and builds HIPAA compliance programs. It performs SOC 2 examinations through its CPA attest practice, and the firm that examines your controls does not also implement them. For HITRUST, BD Emerson handles readiness, and a HITRUST Authorized External Assessor performs the validated assessment.
Frequently asked questions
What is on a HIPAA compliance checklist? It covers the Privacy Rule, the Security Rule, the Breach Notification Rule, business associate agreements, workforce training, and written policies kept for six years. The Security Rule portion starts with a documented risk analysis and risk management plan, then the safeguards. Each line should name the requirement, its citation in 45 CFR Part 164, an owner, and the evidence that proves you meet it.
Who needs to comply with HIPAA? Covered entities and business associates. Covered entities are health plans, health care clearinghouses, and health care providers that transmit health information electronically in standard transactions such as claims. Business associates are vendors that create, receive, maintain, or transmit PHI for a covered entity, including cloud providers that store encrypted data they cannot view, and their subcontractors.
Is HIPAA certification required? No. HHS does not require, issue, or recognize HIPAA certifications, and its FAQ states that a private certification does not prevent HHS from later finding a violation. Customers ask for third-party evidence instead, such as a HIPAA audit report, a SOC 2 Type 2 report mapped to HIPAA, or a HITRUST certification, which support your case without replacing your own risk analysis and records.
How often is HIPAA training required? HIPAA sets no fixed interval. The Privacy Rule requires training for each workforce member within a reasonable period after joining and after material policy changes, and the Security Rule requires a security awareness and training program. Training at hire and every year, with a dated record for each person, gives you evidence that holds up in an investigation.
What are the penalties for violating HIPAA? OCR's civil money penalties run in four culpability tiers. After the 2025 inflation adjustment published January 28, 2026, they range from $145 to $73,011 per violation in the lowest tier and from $73,011 to $2,190,294 in the highest, with a regulatory calendar-year cap of $2,190,294 for identical violations, which OCR's 2019 enforcement discretion lowers for the first three tiers. Most cases settle instead.
How long do you have to respond to a patient's request for records? A covered entity must act on a request for access no later than 30 days after receiving it under 45 CFR 164.524. It may extend once by up to 30 more days if it gives a written reason and a completion date within the first 30. Fees must be reasonable and cost-based, and OCR enforces the deadline, as its August 2026 Azul Vision settlement shows.
If you are working through this checklist for the first time or preparing for a customer's security review, our HIPAA compliance team can run the risk analysis, close the gaps it finds, and assemble the evidence pack your customers will ask for.
About the author
