By the Legal Policy Generator team · Published 2026-02-15

HIPAA Compliance Checklist for Small Businesses (2026)

If your business touches Protected Health Information (PHI) in any way — whether you're a healthcare provider, a health app developer, a dental office, or a SaaS company processing medical data — you may be subject to HIPAA. The civil money penalty framework is steep. The structure is set by 45 CFR § 160.404, and the dollar amounts are adjusted for inflation each year by HHS. As of the 2026 adjustment (effective January 28, 2026), penalties run from a minimum of $145 up to $73,011 per violation for the lower tiers, with an annual cap of $2,190,294 for identical violations in a calendar year; the most culpable tier (willful neglect, not corrected) carries a per-violation penalty up to that same $2,190,294 figure. Because these amounts are re-adjusted annually, always confirm the current figures against the latest HHS inflation-adjustment notice.

Here's a practical checklist to help small businesses understand and work toward HIPAA compliance. This is general information, not legal advice — see the note at the end.

Does HIPAA Apply to You?

HIPAA's rules bind two groups. Covered entities are health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with covered transactions (billing, eligibility checks, claims). Business associates are vendors that create, receive, maintain, or transmit PHI on a covered entity's behalf — think cloud hosts, billing companies, and analytics providers. Both must comply, and the obligation does not depend on company size; per HHS guidance on covered entities and business associates, a one-person practice and a hospital system are held to the same standards. If you are unsure which category you fall into, that determination is worth confirming before you build the rest of your program.

Part 1: Administrative Safeguards

☐ Designate a Privacy Officer responsible for developing and implementing privacy policies
☐ Designate a Security Officer responsible for developing and implementing security policies
☐ Conduct a Risk Assessment — identify where PHI is stored, transmitted, and processed. A risk analysis is an explicit requirement of the Security Rule, not an optional best practice (45 CFR § 164.308(a)(1)(ii)(A)), and HHS treats it as the foundation everything else is built on
☐ Develop Written Policies and Procedures covering all aspects of PHI handling
☐ Train All Employees on HIPAA requirements within a reasonable period of time after they join the workforce (the standard set by 45 CFR § 164.530(b)(2)(i)(B); many organizations target 30 days as a practice guideline), and whenever a material change in policy or procedure affects their job
☐ Implement Sanctions Policy for employees who violate HIPAA procedures
☐ Create a Contingency Plan for data backup, disaster recovery, and emergency mode operations
☐ Sign Business Associate Agreements (BAAs) with all vendors who access PHI

Part 2: Physical Safeguards

☐ Control facility access — limit physical access to areas where PHI is stored
☐ Secure workstations — position screens away from public view, use privacy filters
☐ Device security — encrypt all portable devices (laptops, phones, USB drives)
☐ Proper disposal — shred physical documents, securely wipe electronic media

Part 3: Technical Safeguards

☐ Access controls — unique user IDs, role-based access, automatic logoff
☐ Encryption — encrypt PHI at rest (AES-256) and in transit (TLS 1.2+)
☐ Audit controls — log all access to systems containing PHI
☐ Integrity controls — implement mechanisms to prevent unauthorized alteration of PHI
☐ Transmission security — use encrypted email, secure file transfer protocols
☐ Multi-factor authentication (MFA) — required for all systems accessing PHI

Part 4: Breach Notification Requirements

If unsecured PHI is breached, the HHS Breach Notification Rule sets the clock. Every notice below must go out "without unreasonable delay" and in no case later than the stated deadline — you cannot sit on a known breach until day 59 if you could have acted sooner.

☐ Individual notification — notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach (HHS Breach Notification Rule)
☐ HHS notification — report breaches affecting 500 or more individuals to the HHS Secretary no later than 60 days after discovery
☐ Media notification — notify prominent media outlets serving the area if more than 500 residents of a state or jurisdiction are affected, within the same 60-day window
☐ Breach log (under 500) — log breaches affecting fewer than 500 individuals and report them to HHS no later than 60 days after the end of the calendar year in which they were discovered

Part 5: Documentation

HIPAA is a "show your work" regime: if it isn't documented, regulators treat it as not done. Retention is also a hard rule, not a guideline.

☐ Notice of Privacy Practices (NPP) — provide individuals with a clear notice of how their PHI is used and disclosed and of their rights, as required by 45 CFR § 164.520
☐ Written policies — retain required documentation for six years from the date it was created or last in effect, whichever is later (45 CFR § 164.530(j)(2))
☐ Training records — document all employee training sessions (these are part of the six-year retention requirement)
☐ Risk assessment reports — update after any significant change to your operations or systems; many organizations review at least annually

Common HIPAA Mistakes Small Businesses Make

Using personal email to send PHI (Gmail, Yahoo, etc. are not HIPAA-compliant by default)
No BAAs with vendors — using cloud storage, billing software, or scheduling tools without a signed BAA
Assuming "small" means "exempt" — HIPAA applies regardless of business size
Skipping the risk assessment — this is the #1 most-cited violation in audits
No employee training documentation — training happened but wasn't recorded

How the Three Safeguard Categories Fit Together

The checklist above mirrors the structure of the HIPAA Security Rule, which organizes protections for electronic PHI into administrative, physical, and technical safeguards. Administrative safeguards are the policies, people, and processes — the risk analysis, the workforce training, the assignment of a security official. Physical safeguards protect the hardware and facilities where PHI lives. Technical safeguards are the controls inside your systems: access controls, audit logs, and encryption. The Security Rule is deliberately flexible and scalable, so a solo practitioner and a regional hospital can both satisfy it, but each control category has to be addressed rather than skipped.

A practical sequence for a small business looks like this. First, complete a risk analysis so you actually know where PHI flows. Second, sign Business Associate Agreements with every vendor that touches that PHI — using a cloud drive, billing platform, or scheduling tool without a signed BAA is one of the most common gaps. Third, write the policies your risk analysis shows you need, train your workforce on them, and document that training. Fourth, stand up your breach-response process before you need it, because the 60-day notification clocks start at discovery, not at the moment you finish investigating.

Common HIPAA Misconceptions

Two beliefs get small businesses in trouble. The first is that "small means exempt." It does not — HHS confirms that the rules apply to covered entities and business associates regardless of size. The second is that buying an "encrypted" or "HIPAA-ready" tool makes you compliant. Vendor security is necessary but not sufficient: HIPAA compliance is about your whole program — your risk analysis, your agreements, your policies, your training, and your documentation — not any single product.

Generate Your HIPAA Notice

One of the most important HIPAA documents is the Notice of Privacy Practices, which 45 CFR § 164.520 requires covered entities to give individuals. Our HIPAA Notice Generator creates a notice covering the sections that rule calls for. It's free and takes under 5 minutes.

Generate your HIPAA Notice now →

Disclaimer: This article is general information about HIPAA, not legal advice, and reading it does not create an attorney–client relationship. HIPAA requirements depend on your specific facts, and penalty amounts are adjusted for inflation over time. Consult a qualified healthcare-privacy attorney about your particular situation, and rely on the primary sources at HHS.gov and the Code of Federal Regulations (45 CFR Parts 160 and 164) for the current legal text.