What should healthcare leaders review when assessing HIPAA Security Rule readiness?
Healthcare leaders should review governance and ownership, which HIPAA obligations apply to the organization, Administrative, Physical, and Technical Safeguards, where electronic protected health information lives, and how the organization will respond to incidents. A practical HIPAA compliance checklist helps teams map these requirements to their actual environment before an audit, outage, or security incident forces the conversation.
Most organizations do not fail HIPAA because they ignored it. They fail because they never mapped it to their actual environment.
That distinction matters.
Every healthcare practice, clinic, and multi-site operator knows HIPAA exists. Far fewer can say, with confidence, which of its requirements they have implemented, which ones they have addressed differently and documented why, and which ones are still sitting on a to-do list from three years ago.
The gap between knowing HIPAA matters and knowing your own compliance posture is where audit findings and security gaps can emerge. In healthcare, those gaps can also affect staff pressure, EHR availability, operational continuity, and the systems that support patient care.
This checklist will not make your organization compliant on its own. No checklist can. What it will do is give you the big picture before you get lost in the details, so you know what to bring to a real compliance conversation, whether that is with legal counsel, a security partner, or your own internal team.
The HIPAA Security Rule is built around three categories of safeguards: Administrative, Physical, and Technical.
Within those categories are individual implementation specifications labeled as either required or addressable. Required means exactly what it sounds like.
Addressable does not mean optional. It means your organization must assess whether the specification is reasonable and appropriate for its environment. If it is not implemented as written, the organization must document why and implement an equivalent alternative when reasonable and appropriate.
Addressable safeguards are commonly misunderstood because organizations may skip them or implement them without documenting the reasoning behind the decision.
That is the real starting point. Not another tool. Not another vendor pitch. A clear, honest map of where your organization stands against these three categories.
HIPAA requires a designated Security Officer. This is a named requirement under the Security Rule. Someone in your organization needs to hold this responsibility by name, not simply by department.
Alongside that, someone needs to own the compliance documentation itself. Risk assessments, policies, training records, and safeguard decisions all need a home and a person responsible for keeping them current.
Compliance is not a project with an end date. It is a posture that should be revisited on a defined cadence, not only when an auditor asks for it.
Before you can build a compliance program, you need clarity on your role. Are you a Covered Entity, a Business Associate, or both? That distinction shapes which obligations apply directly to you.
From there, identify every vendor, partner, or platform that creates, receives, maintains, or transmits electronic protected health information, or ePHI, on your behalf. Your EHR platform is the obvious one, but billing vendors, IT providers, cloud storage, and scheduling software may also qualify depending on the services they provide.
Business Associate Agreements should be in place where required. Vendor relationships accumulate over time, so these agreements and the responsibilities behind them should be reviewed rather than assumed.
This category covers the policies and procedures that govern how your organization manages risk day to day.
At minimum, that means written policies covering access management, workforce training, and incident response, along with a documented risk analysis.
A real risk analysis is not a network diagram or a checklist an IT vendor filled out once. It is an analysis of where risk lives in your specific environment, tied to your systems, vendors, and workflows.
If your most recent risk analysis cannot help explain what happens if a critical system goes down or patient information is exposed, it is not giving leadership the operational clarity it needs.
This is also where required versus addressable specifications matter. For every addressable item, your documentation should show your reasoning, not just your decision.
Physical safeguards are easy to overlook because they feel less technical, but they carry equal weight under the Security Rule.
Facility access controls need to cover spaces where ePHI is stored or accessed, not just server rooms. Workstation and device security matters just as much. Screen-lock timing, physical placement of monitors and devices, and controls over portable devices all fall under this category.
So does media disposal. Any device, drive, or piece of hardware that held patient data needs a documented, verifiable disposal process when it is retired.
This is where many organizations focus first, and for good reason, but it still deserves a full pass rather than partial coverage.
Every user needs a unique login. Shared credentials, even among trusted staff, undermine the access-control model HIPAA is built around.
Audit logging needs to exist and be reviewed, not simply collected and forgotten in a system no one checks.
Encryption for data at rest and in transit can materially reduce the risk of unauthorized disclosure. Under the Breach Notification Rule, whether notification is required depends on whether protected health information was secured in accordance with applicable guidance and on the facts of the incident. Encryption should not be treated as a blanket exemption from investigation or notification obligations.
Automatic logoff is an addressable implementation specification. Like other addressable safeguards, it requires a reasoned assessment and documentation based on the environment.
Before you can protect ePHI, you need to know where it lives. That means a real inventory: which systems store it, how it flows between them, and who has access at each point.
Many organizations discover gaps during this step alone: data sitting in a forgotten shared drive, an old export nobody remembers creating, or a vendor integration no one flagged as high risk.
Once you can see the full picture, prioritize next steps based on likelihood and impact, not on whatever feels most urgent that week. A structured HIPAA risk assessment helps turn that visibility into a practical roadmap.
Understand your notification obligations and timelines under the Breach Notification Rule before you need them, not during an active incident.
Security incident procedures and breach-notification obligations are related, but they are not interchangeable. The facts of a suspected incident should be evaluated carefully, documented, and escalated to qualified legal or compliance counsel when required.
Finally, treat compliance as a living posture, not an annual box to check. Reassess whenever something in your environment changes meaningfully: a new vendor, a new location, a new EHR platform, a leadership change, or a security incident.
Waiting for the calendar to tell you it is time is how gaps quietly reopen.
None of this is designed to be done alone, and it is not meant to replace legal counsel. It is meant to give you a clear, structured way to see your organization's posture before you sit down with the people who can help close the gaps, whether that is your compliance attorney, your board, or a security partner.
Bridgehead IT holds ISO/IEC 27001 certification through Prescient Security. That certification reflects a formal, independently assessed approach to managing information-security risks, controls, policies, and continuous improvement. It does not make a client HIPAA compliant, but it provides a meaningful trust signal when evaluating the partner supporting your environment.
As Brooke Evans, Chief Growth Officer at Flourish Research, put it:
“We view Bridgehead as a trusted extension of our management team for IT, and that is invaluable.”
Get a HIPAA and Compliance Risk Assessment from Bridgehead IT. We will help you see your gaps clearly, mapped to what actually matters for your organization, not a generic template.
The goal is a practical roadmap that supports patient-data protection, EHR availability, operational continuity, and the people responsible for delivering care.
Talk with Bridgehead IT about a healthcare security risk assessment and a clear path forward.
This checklist is intended as a general educational resource and does not constitute legal advice or a complete HIPAA compliance assessment. For guidance on applying HIPAA and HITECH requirements to your organization, consult qualified legal counsel.