Customer Login Group Login 1-888-372-5001

HIPAA Compliance Checklist

HIPAA Compliance Checklist to Determine If Yo ur Organization Is Subject to HIPAA as a Covered Entity or a Business Associate

Audits
  • Have you conducted a security risk assessment?
  • Do you identify and document all deficiencies found during the compliance audits?
  • Have you audited your business associates and subcontractors to ensure they’re HIPAA compliant?
  • Have you established Business Associate Agreements with all vendors and third parties accessing PHI?
  • Following an audit, do you implement corrective action plans to address non-compliance findings?
  • Are your HIPAA compliance efforts regularly reviewed and updated to align with regulatory changes?
People
  • Have all employees been informed about the data security, physical security, and privacy policies and procedures?
  • Are all employees trained on fundamental HIPAA requirements?
  • Is documentation maintained for all HIPAA training sessions conducted?
  • Have you designated a staff member responsible for HIPAA compliance, privacy, and/or security?
  • Is access to PHI restricted to employees with job-related requirements?
  • Have facility access rights been appropriately restricted to authorized personnel?
Policies and procedures
  • Are your information security and privacy policies and procedures documented?
  • Are all instances of PHI shared across public networks encrypted as a standard practice?
  • Have you established clear policies and procedures for the secure disposal of PHI?
  • Do you have effective protocols in place to document and address any violations of PHI policies?
  • Are there established procedures to notify relevant parties promptly in case of a PHI breach?
  • Have you developed a comprehensive contingency plan to address emergencies affecting systems or physical locations containing PHI?
Remediations
  • Have you developed a remediation plan for deficiencies identified in the security risk assessment?
  • Are there established timelines for implementing remediation plans, and are they adhered to consistently?
  • Have you created a remediation plan for deficiencies identified in the administrative assessment?
  • Do you allocate sufficient resources (budget, personnel training) to implement your HIPAA remediation plans?
  • Do you communicate your remediation plans and progress updates to relevant personnel within your organization?
  • Do you maintain documentation of your remediation efforts, including the identified deficiencies, implemented solutions, and testing results?
Reporting and investigations
  • Have comprehensive reports been generated to demonstrate diligent efforts toward HIPAA compliance?
  • Have you created a system to track and manage violation investigations?
  • Are processes in place to provide breach information in the timeframe described by HHS?
  • Are you reporting breach violations with fewer than 500 individuals to the HHS annually?
  • Do you document the annual review of policies and procedures?
  • Have you implemented a process to promptly notify affected individuals in the event of a breach involving PHI?

If you have ticked any of the boxes in the above HIPAA compliance checklist for organizations, your organization is a Covered Entity and required to comply with the applicable Administrative Simplification provisions of the Privacy, Security, and Breach Notification Rules.

Get The FREE

HIPAA Compliance checklist

Download Free Checklist
Get The FREE

HIPAA Compliance Checklist

    Please Enter Correct Email Address
    Google Privacy Policy and Terms of
    Service     apply.

    Frequently Asked Questions

    What are some of the HIPAA courses suitable for my profession?

    Here is the list of HIPAA courses that are suitable for your profession:

    • HIPAA course for healthcare providers: This course is suitable for doctors/physicians, nurses, medical students, laboratory staff, ophthalmologists, chiropractors, hospitals, and medical students.
    • HIPAA course for mental health providers: This course is suitable for psychiatrists/psychologists, behavioral services providers, medical students in mental health, mental health social services providers, psychiatry clinics, and mental health institutes.
    • HIPAA course for insurance agent awareness: This course is suitable for health insurance companies, health insurance agents, healthcare compliance officers, medical transcriptionists, and healthcare IT staff.
    • HIPAA course of employer group health insurance: This course is suitable for benefits administrators, insurance brokers or consultants, legal and compliance officers, and data analysts.
    • HIPAA course for general industry/HR professionals: This course is suitable for human resource consultants, departments, and third-party administrators.
    What are some of the non-HIPAA courses that are required for my profession?

    Compliance requirements in the healthcare sector vary depending on the employing organization and the regulatory landscape at the local, state, and federal levels. Healthcare professionals need to undergo annual training sessions for HIPAA and Bloodborne Pathogens and take a comprehensive compliance course upon initial hiring. 

    These training initiatives ensure that employees remain well-versed in crucial aspects of patient privacy, safety protocols, and regulatory standards essential for maintaining the integrity of healthcare operations.

    Start Now

    See What Others Are Saying

    Know the impact of our services through the words of those who have experienced it firsthand. 

    4.5 Rating 155 Reviews