Your HIPAA Security Rule Checklist

Healthcare organizations handle large amounts of sensitive patient information. If this data is lost or stolen, it can lead to identity theft and delays in patient care. To protect patient data, the HIPAA Security Rule sets national standards for the confidentiality, integrity, and availability of electronic protected health information (ePHI). This HIPAA Security Rule checklist helps your organization understand these requirements and take actionable steps toward compliance.

What is the HIPAA Privacy Rule?

The Department of Health and Human Services issued a set of orders that standardized privacy law for all individuals and organizations that would manage patient health data. These accountable organizations are known as covered entities and are liable for all mandates expressed in the Standards for Privacy of Individually Identifiable Health Information, also known as the HIPAA Privacy Rule.

“A major goal of the Privacy Rule is to assure that individuals’ health information is

properly protected while allowing the flow of health information needed to provide

and promote high quality health care and to protect the public’s health and well being.” – United States Department of Health and Human Services

These privacy standards arrived as medical professionals started to digitize medical records. Taking advantage of digital documentation allows all healthcare-related organizations to better serve patients, since managing digital records is far more efficient than managing hard copies of medical records.

To Whom Does the HIPAA Privacy Rule Apply?

The HIPAA Privacy Rule applies to covered entities, which are organizations involved in delivering healthcare services, such as hospitals, clinics, and health insurance providers. These entities are responsible for protecting patient health information under the Privacy Rule.

Covered entities must also follow the HIPAA Security Rule, which sets standards for safeguarding electronic patient data. Together, the Privacy and Security Rules ensure patient information remains confidential, accurate, and secure.

What Are Covered Entities?

A covered entity is any organization that accesses protected health information (PHI) to provide healthcare services. This includes private medical practices, hospitals, and other healthcare-related organizations that work together to deliver patient care.

Covered entities fall into the following categories:

Health Plans:

• Insurance providers
• HMOs
• Medicare/Medicaid and supplemental insurers
• Employer-sponsored plans
• Government-sponsored plans
• Church-sponsored plans
• Cooperative plans

Healthcare Providers:

• Hospitals, clinics, and private practices
• Healthcare clearinghouses
  

The Privacy Rule also applies to business associates, third-party vendors that handle PHI on behalf of covered entities. These organizations must follow certain Privacy Rule requirements and comply with the HIPAA Security Rule when managing electronic patient data.

What Is Protected Health Information (PHI)?

Protected Health Information (PHI) refers to any individually identifiable health information held or transmitted by covered entities. This includes medical records, lab results, insurance information, and other data that can identify a patient.

Covered entities are responsible for managing PHI in compliance with the HIPAA Privacy Rule and the HIPAA Security Rule, ensuring that patient information remains confidential, accurate, and secure at all times.

What Are HIPAA Authorizations?

When a covered entity needs to share PHI with someone who is not otherwise permitted access under the HIPAA Privacy Rule, the patient’s authorization is required.

HIPAA authorizations must be signed by the patient and clearly specify:

• Who is authorized to access the PHI
• The purpose of the disclosure
• When the authorization expires
• Any additional conditions set by the patient
  

For example, a mental health patient might authorize a provider to share therapy notes for a full psychological evaluation, such as when a veteran submits medical evidence for a PTSD disability claim. Even though legal processes may require documentation, investigators cannot access these records without a signed authorization.

Covered entities must also ensure that any electronic handling of authorized PHI complies with the HIPAA Security Rule, protecting the data from unauthorized access or breaches.

HIPAA Protected Health Information Uses and Disclosures

What Is a Notice of Privacy Practices (NPP)?

Covered entities must provide patients with a Notice of Privacy Practices (NPP). This document explains a patient’s rights under the HIPAA Privacy Rule and describes how their PHI may be used or disclosed. It also informs patients how to file a complaint if they believe their privacy rights have been violated.

NPPs are usually included in registration paperwork when a patient visits a medical provider for the first time. The notice outlines how a covered entity may use the patient’s PHI within HIPAA compliance standards. When PHI is handled electronically, the NPP indirectly relies on the HIPAA Security Rule to ensure this information is protected from unauthorized access or disclosure.

Our HIPAA Security Rule Checklist

A HIPAA Security Rule checklist helps your organization identify areas where your operations may not meet HIPAA compliance standards. Use this checklist to perform an internal audit and pinpoint gaps in how you protect electronic protected health information (ePHI).

This checklist also serves as a way to gauge your organization’s commitment to HIPAA compliance and ensure that your policies, procedures, and security controls align with federal requirements.

Patient Access and Consent

Covered entities must have clear policies and procedures to allow patients to access their PHI safely and securely, even when the data is stored by another entity. This is a key requirement under the HIPAA Security Rule.

Consider the following checklist items:

• Access Process:
  • Have you established a secure process for patients to view their PHI online or in person?
• PHI Copy Requests:
  • Do you have a system to accept and fulfill requests for copies of PHI in the patient’s preferred format (hard copy or digital)?
  • Are copies provided within 30 days, as required by HIPAA?
• Fees for PHI Copies:
  • If your organization charges a fee for PHI copies, are these fees reasonable and transparent?
  • Are fees clearly communicated to patients to avoid prohibitive costs that could hinder HIPAA compliance?
    

Following these steps ensures your organization maintains both patient trust and HIPAA Security Rule compliance.

HIPAA Authorizations Checklist

Ensure your HIPAA authorizations protect both your organization and your patients. Use the following checklist:

• Authorization Specificity:
  • Are authorizations clear about uses, recipients, disclosures, and expiration dates?
  • Vague authorizations may fail to protect the patient or your organization.
• Plain Language:
  • Are authorizations written in plain English, avoiding medical jargon and confusing clinical terms?
  • Patients must clearly understand what they are signing to meet HIPAA compliance.
• Patient Signature and Date:
  • Is every authorization signed and dated by the patient?
  • Unsigned authorizations are invalid under HIPAA.
• Secure Storage and Disposal:
  • Are authorizations stored in a secure location and disposed of properly when no longer needed?
  • If stored electronically, are these authorizations protected according to the HIPAA Security Rule?
    

Losing or mishandling authorizations could expose your organization to legal action.

Notice of Privacy Practices (NPP) Checklist

Ensure your organization properly informs patients of their rights under HIPAA. Use the following checklist:

• NPP Distribution:
  • Is an NPP included in all new patient or client paperwork?
  • Are patients informed of their PHI rights from the start of services?
• Acknowledgment of Rights:
  • Do patients or clients confirm in writing that they have read and understood the NPP?
  • A signed acknowledgment protects your organization as a covered entity.
• Public Display:
  • Is your NPP prominently displayed on your premises and/or clearly accessible on your website?
  • If posted electronically, are you ensuring it is secured in accordance with the HIPAA Security Rule?
• Complaint Management:
  • Are there policies and procedures to handle patients who believe their rights under the NPP were not followed?
  • Is there a clear process for investigating and rectifying complaints promptly?
• Routine Compliance Audits:
  • Do your daily operations align with your NPP and HIPAA Privacy Rule?
  • Are regular audits performed to ensure that compliance is effective, not just procedural.

Employees and Business Associates Checklist

Ensuring that employees and business associates follow HIPAA regulations is essential for maintaining compliance. Use this checklist to assess your organization’s practices:

• Staff HIPAA Understanding:
  • Do all staff members understand HIPAA Privacy Law and workplace procedures relevant to PHI?
  • Are staff aware of their responsibilities in managing PHI under the HIPAA Security Rule?
• Training and Documentation:
  • Have employees received proper HIPAA compliance training?
  • Do you collect proof of training (e.g., signed attestation forms) to demonstrate compliance?
• Reporting Non-Compliance:
  • Is there a process for employees to report HIPAA violations safely, ideally anonymously, without fear of reprisal?
• Confidentiality Agreements:
  • Do all employees and independent contractors (non-business associates) sign confidentiality agreements regarding PHI access and handling?
• Business Associate Due Diligence:
  • Are business associates and vendors carefully vetted to ensure they understand HIPAA Privacy and Security requirements?
  • Do you maintain an up-to-date list of all business associates and third-party vendors who may access PHI?
• Business Associate Agreements (BAAs):
  • Are proper BAAs in place with all vendors and business associates, outlining HIPAA-compliant directives for handling PHI?
  • Are BAAs reviewed and updated annually to reflect changes in relationships or operations?
• Electronic PHI Safeguards:
  • Do your employees and business associates follow HIPAA Security Rule safeguards when accessing or managing electronic PHI (ePHI)?
    

Are access controls, encryption, and other technical protections enforced consistently?

Cybersecurity Protocols Checklist

Protecting electronic PHI (ePHI) is a central requirement of the HIPAA Security Rule. Use the following checklist to assess your organization’s cybersecurity readiness:

• Network Documentation:
  • Do you maintain an up-to-date network diagram showing all potential attack vectors that could threaten PHI?
• Basic Cybersecurity Measures:
  • Are firewalls, malware protection, and monitoring tools properly implemented and maintained to protect PHI?
  • Are these protocols reviewed and updated regularly?
• Incident and Breach Response:
  • Do you have a documented incident response plan for security breaches?
  • Does the plan cover quarantining incidents, diagnosing root causes, patching vulnerabilities, and reporting damages?
  • Are lessons learned from breaches used to improve tools, policies, and procedures?
• Employee Training on Cyber Threats:
  • Have staff received training on phishing attacks and other social engineering threats?
  • Do employees know how to safely identify and respond to suspicious links or messages to reduce cyber risk?
• HIPAA Security Rule Compliance:
  • Are all cybersecurity protocols aligned with HIPAA Security Rule standards to ensure the confidentiality, integrity, and availability of ePHI?

Key Takeaways: HIPAA Security Rule Compliance Checklist

Using the checklist above, your organization can take practical steps toward HIPAA compliance, ensuring that patient PHI is protected according to federal privacy and security laws. Failing to comply with the HIPAA Privacy or Security Rule can result in financial penalties, reputational damage, and potential patient lawsuits.

At RSI Security, we help covered entities build and maintain HIPAA Security Rule compliance. Our team of cybersecurity specialists can create a customized HIPAA Security Rule checklist, implement safeguards, and train your staff to protect PHI against breaches, negligence, and misuse.

Take action by contacting RSI Security today to ensure your organization meets HIPAA Security Rule standards and safeguards your patients’ sensitive information.

Download Our HIPPA Checklist