Originally published by Vanta.

HIPAA, an acronym for the Health Insurance Portability and Accountability Act, is one of the most important federal regulatory frameworks for healthcare organizations. It’s an elaborate law that imposes many stringent requirements for patient privacy and data security on governed organizations. Complying with HIPAA demands having a strict internal system to address its often complex and ambiguous requirements.

‍If you want to take concrete steps toward meeting the requirements of this regulation, consider this your ultimate HIPAA compliance checklist. Let’s start by refreshing our basic understanding of HIPAA.

‍

What is HIPAA compliance?

HIPAA compliance refers to a set of security, privacy, and other associated rules and practices your organization must implement to safeguard the protected health information (PHI) of patients. It involves numerous ongoing procedures, technical safeguards, controls, and audits to fulfill the prescribed mandates.

‍The U.S. Department of Health and Human Services provides comprehensive resources on HIPAA compliance. In this guide, we’ll focus on the key compliance areas.

‍

Who needs to comply with HIPAA?

HIPAA compliance is mandatory for all healthcare organizations. The regulation differentiates between two types of organizations, as explained in the table below:

‍Both organization types must comply with HIPAA as they use or disclose PHI in some capacity, although there are slight differences between the regulations affecting them. Our checklist will mainly focus on some key HIPAA requirements that these organizations should know about.

‍

Why use a HIPAA compliance checklist?

Considering the complexity of HIPAA requirements, a checklist can help you:

1. Reduce risk of non-compliance: Following a checklist gives you clarity on what actions to take and prevents overlooked tasks.
2. Ensure better accountability: A checklist gives you a bird’s-eye view of numerous compliance processes across departments. It helps you effectively delegate tasks based on defined roles and responsibilities.
3. Save time and improve efficiency: An organized checklist helps avoid the exhausting scouring across numerous resources to understand your obligations. It also serves as a reliable record and helps expedite audits.

‍Checklist: 8 key actions toward HIPAA compliance

Whether you’re a compliance novice or an experienced manager, this checklist will help you stay on top of all the actions necessary to achieve HIPAA compliance:

1. Familiarize yourself with HIPAA’s key rules.
2. Designate a HIPAA compliance officer.
3. Identify PHI and perform a risk assessment.
4. Implement the necessary policies and procedures.
5. Develop a breach reporting plan.
6. Schedule and conduct HIPAA training.
7. Assess and manage third-party risks.
8. Monitor and audit your compliance posture.

‍The sections below will explain what each of the tasks entails.

‍

1. Familiarize yourself with HIPAA’s key rules

HIPAA has more than five compliance components categorized as “rules” that describe administrative action to be taken in different circumstances. The following three rules are especially important for covered entities:

1. Privacy rule: Establishes and requires safeguards for keeping patients’ PHI private.
2. Security rule: Obligates covered entities to implement and maintain technical, physical, and administrative controls to protect PHI.
3. Breach notification rule: Outlines the conditions and requirements for timely and efficient breach reporting.

‍The regulation has additional rules, such as the enforcement rule and omnibus rule, but the above three are critical because most compliance requirements below stem from them. Ideally, you should inform yourself through official HIPAA resources or consult with compliance experts to understand your obligations here fully.

‍

2. Designate a HIPAA security officer

While HIPAA compliance requires the efforts of employees across various departments, such as IT and admin, you must have an appointed security officer to oversee the process. Their primary role is to ensure the organization’s compliance policies and procedures are developed, implemented, and enforced as mandated.

‍Here are some key tasks your security officer will be in charge of:

• Guiding and performing risk assessments and internal compliance audits.
• Outlining organizational privacy and security policies and procedures.
• Reporting breaches and executing disaster recovery plans.

‍Additionally, covered entities are required to appoint both a HIPAA security officer and a HIPAA privacy officer—the latter manages different aspects of patient privacy and supports the training of healthcare staff on privacy protocols. There can be different individuals handling the duties of security and privacy officers, but the same person may serve both roles, especially for smaller organizations.

‍

3. Identify PHI and perform a risk assessment

An essential part of your HIPAA compliance journey is identifying what information qualifies as PHI and non-PHI. It’s crucial to make this distinction to ensure you have the necessary safeguards in place that protect sensitive data and get you close to HIPAA compliance.

‍The HIPAA privacy rule defines PHI as individually identifiable health information held or maintained by a covered entity or its business associates, which is transmitted or maintained in any form or medium.

‍Still, many organizations may find it hard to differentiate between PHI and non-PHI. To minimize confusion, HIPAA specifies 18 identifiers associated with personally identifiable health information. We have listed some key identifiers below:

• Names
• Addresses (any geographical subdivisions more precise than a state)
• Social Security numbers
• Contact information
• Medical record numbers
• Biometric data (e.g., fingerprints and retinal scans)

‍As far as compliance is concerned, you must understand how PHI can be used and disclosed as per HIPAA requirements. Both covered entities and business associates may use and disclose PHI only for treatment, payment, and healthcare operations — i.e., TPO activities. You should consult your legal team to map the full scope of the do’s and don’ts applicable.

‍Additionally, if a certain use/disclosure of PHI is not permitted under the privacy rule, you have the provision to request individual authorization from the patient or their authorized representative via a designated form.

‍‍

4. Implement the necessary policies and procedures

HIPAA’s rules prescribe numerous procedures and policies you must put into place to safeguard PHI and ensure compliance. The following table outlines some notable ones:

‍This is only a brief summary of the HIPAA policies and procedures. Consult with your HIPAA security officer to identify the ones that apply to your organization. You should also document the underlying processes and task owners to ensure smooth implementation.

‍

5. Develop a breach reporting plan

Under HIPAA’s breach notification rule, any breach affecting 500 or more individuals must be reported to the Secretary of Health and Human Services within 60 days. If the number of affected individuals is lower, the report must be made within 60 days of the end of the calendar year.‍

While the reporting process is straightforward, you still need a well-defined internal plan for breach reporting. Define who will report the breach (e.g., the security officer) and when they should do it (e.g., as soon as the breach is discovered and assessed).

‍Add elaborate due diligence procedures within your HIPAA compliance program for timely detection of breaches, as well as an appropriate response plan.

‍

6. Schedule and conduct HIPAA training

HIPAA compliance training is mandatory for governed organizations. The idea behind comprehensive training is to:

• Reduce the risk of policy violations and non-compliance.
• Strengthen cybersecurity measures and practices at all levels of the organization.
• Boost privacy and security awareness and build a culture of compliance.

‍It’s best to conduct HIPAA training at least annually so that all your personnel stay updated on the necessary policies and procedures.

‍

7. Assess and manage third-party risks

Under HIPAA, a third party is any organization that is neither the covered entity nor a business associate. For example, a cloud hosting provider or app developer would be considered a third party.

‍Since such entities might receive and process PHI as part of their services, you need to develop a third-party risk management (TPRM) program to help with HIPAA compliance. The aim is to ensure all your vendors and other third parties implement security and privacy measures to protect the PHI they access.

‍The key TPRM-related HIPAA practices you should follow include:

• Third-party risk assessments and mitigation: You need to conduct thorough risk assessments to understand your third-party risk landscape and develop the necessary mitigation strategies.
• Evaluation of a vendor’s security posture: Each vendor has a unique risk profile that you should account for. Conduct due diligence while onboarding new vendors and pay special attention to their technical and procedural security controls.
• Security incident reporting: If an incident occurs on a third party’s end, they must report it to you as soon as possible via an established communication channel.
• Business associate agreements (BAAs): You must have written agreements with business associates that demonstrate their ability to safeguard your organization’s PHI.

‍

8. Monitor and audit your compliance posture

You need to monitor the implemented policies and procedures at regular intervals to ensure full compliance. HIPAA requires internal audits at least annually, but you can conduct them more frequently to keep your compliance posture steady.

‍The audit should include a systematic evaluation of all the technical and non-technical requirements of the regulation. Some sample audit areas include:

• Inspecting security measures
• Assessing business associate agreements
• Reviewing HIPAA training
• Documenting key findings and highlighting non-compliant or vulnerable areas
• Recommending corrective actions

‍You can set up an internal audit team or partner with end-to-end compliance platforms to streamline the process.

A note from Vanta: Vanta is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.