HIPAA IT Compliance Checklist for Medical and Dental Practices

A useful HIPAA IT compliance checklist has to separate two jobs that are constantly mixed together. One is the practice's compliance program: policies, workforce training, business associate agreements, the risk analysis, the sanctions policy, the breach determination process. The other is the set of technical safeguards that live in the network, the servers and the identity system. Those are what an IT provider is hired to build, run and document. The HHS Security Rule, enforced by the HHS Office for Civil Rights, requires administrative, physical and technical safeguards for electronic protected health information, and the obligation sits with the covered entity. No software product carries it for you.

RANGO Technologies supports medical and dental practices across Miami-Dade and Broward County from Miami Lakes. This article covers the technical half: the controls a practice should be able to point to today, how to evidence them, and a straight read on the proposed Security Rule update that a great deal of vendor marketing currently treats as though it were already in force. It is not in force. Final action is now scheduled for July 2027.

Table of Contents

• Where the IT Provider's Responsibility Starts and Stops
• The Technical Safeguards Checklist
• Contingency Planning and the Backup Requirement
• The Proposed Security Rule Update Is Not Law Yet
• What to Do Now Versus What to Watch
• Where a Practice Should Start

Where the IT Provider's Responsibility Starts and Stops

The division of labour

Read the Security Rule and you find three safeguard families. Administrative safeguards are largely a management function: assigning a security official, training staff, running the risk analysis, managing sanctions. Physical safeguards cover facility access, workstation placement and media disposal. Technical safeguards are the software and network controls: access control, audit controls, integrity, authentication and transmission security.

An IT provider can own most of the technical family outright, contribute the technical evidence that feeds the administrative risk analysis, and advise on the physical controls that touch equipment. It cannot own your training records, your policies or your breach determinations. When a provider markets itself as handling "compliance," ask which of the three families it means, and ask to see the artefacts it produces.

What a business associate agreement does and does not do

Your IT provider handles or can access electronic protected health information, so it is a business associate and a signed agreement is required before work begins. That agreement allocates responsibility and creates a contractual duty. It does not transfer your obligation as a covered entity, and it is not a substitute for verifying that the safeguards described in it are actually running.

We implement and document the technical safeguards HIPAA requires; your practice retains responsibility for its overall compliance program.

That sentence is the honest description of the relationship, and it is worth expecting from any provider you evaluate. Our HIPAA IT compliance service page sets out the specific controls we take on for medical and dental practices.

The Technical Safeguards Checklist

Identity: unique accounts, MFA and automatic logoff

Unique user identification is a required implementation specification, and it is still the most commonly broken one. A shared "frontdesk" login means your audit log records a workstation, not a person, which makes an internal incident effectively uninvestigable. Every clinical and administrative user needs a named account in the directory and a named account in the practice management system. Those are two separate lists, and they drift apart.

Add multi-factor authentication on email, remote access and any cloud clinical system, and set automatic logoff on operatory and front-desk workstations to a period short enough to matter. CISA's #StopRansomware Guide recommends phishing-resistant MFA for email, VPNs and accounts reaching critical systems; for a practice, that means hardware keys or passkeys for the accounts with administrative reach, not just a code in an app.

The control that gets skipped is offboarding. When someone leaves, the directory account is usually disabled the same day and the practice management account is not. Write the termination checklist as one list covering every system, and have the provider confirm each disablement in writing.

Audit controls: logging you can actually retrieve

The Security Rule requires mechanisms that record and examine activity in systems containing ePHI. In practice that means three things must be switched on and retained: authentication logs from the identity provider, access logs from the practice management and imaging systems, and firewall or VPN logs.

Retention is where practices get caught. A breach is frequently discovered weeks after it began, and a thirty-day log window means the investigation cannot establish what was accessed — which pushes the practice toward a broader notification than the facts might have required. Ask your provider how long each log source is kept, where it is kept, and how long it takes to produce a report from it. If the answer is "we would have to check," that is the finding.

Encryption and transmission security

Encryption is currently an addressable specification, not a required one, which means a practice may implement an equivalent alternative and document why. In reality, there is almost never a defensible reason not to encrypt in 2026. Full-disk encryption on every laptop and workstation, TLS on every connection to a clinical system, and encrypted email or a patient portal for anything containing ePHI is the baseline.

The gap is usually not the servers. It is the imaging workstation running an older operating system because the sensor driver was never updated, the laptop a hygienist takes home, the USB stick used to hand a referral to a specialist, and the flat network where the guest Wi-Fi and the operatory equipment share a subnet. Network segmentation is the cheapest of those fixes and the one most often missing; our cybersecurity work with practices usually starts there.

Contingency Planning and the Backup Requirement

The data backup plan is a rule, not a best practice

Contingency planning is an explicit part of the Security Rule, and it includes a data backup plan, a disaster recovery plan and an emergency mode operation plan. For a practice in South Florida, that requirement overlaps neatly with hurricane exposure, which means one properly designed system can address both.

CISA's guidance is blunt about the architecture: maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of those backups in a disaster recovery scenario. The failure mode it is written against is specific — a backup target that appears as a mapped drive on an infected workstation gets encrypted along with everything else.

Prove it with a restore, on a schedule

An untested backup is a hypothesis. The test that matters is not "did the job report success," it is "how long did it take to bring the practice management database up on replacement hardware, and did the images come with it." Run that at least annually, write down the elapsed time, and compare it to how long the practice can actually operate on paper.

Geographically separated, hurricane-resilient backups with regular restore testing is what we build for practices under cloud backup and disaster recovery. The restore log is also one of the more persuasive artefacts to have on hand during a risk analysis review.

The Proposed Security Rule Update Is Not Law Yet

What the NPRM would change

On December 27, 2024, OCR issued a notice of proposed rulemaking, published in the Federal Register on January 6, 2025. HHS's proposed Security Rule update would remove the "addressable" implementation classification entirely, making those specifications mandatory. It proposes required encryption, multi-factor authentication, network segmentation and anti-malware, annual penetration tests, vulnerability scans every six months, annual compliance audits, a more prescriptive risk analysis, dedicated ePHI backup and recovery controls, and verification of business associates' technical safeguards.

Where it stands as of August 2026

Not final. OCR received roughly 4,745 public comments, and more than 100 hospital systems and provider associations asked HHS to withdraw the proposal. The final rule was originally targeted for May 2026; the unified agenda now shows final action due July 2027. Anyone selling you a product on the basis that these requirements are already binding is either mistaken or hoping you are.

That said, the proposal is a reasonable preview of where enforcement expectations are heading, and the substance of it is not exotic. Most of the proposed technical items are controls a well-run practice would want regardless.

Cyber insurance is already asking for the same list

Insurers moved faster than the rulemaking. MFA, EDR, tested offline backups, segmentation and documented offboarding now show up routinely in application questionnaires, and an inaccurate answer on an application is its own problem. We help you meet common cyber-insurance control requirements — often within 30 days. Coverage decisions remain with your insurer.

What to Do Now Versus What to Watch

The split

Do the first three now

Encryption, MFA and segmentation belong in this year's budget whatever happens to the rule. They are the controls that reduce the chance of a reportable event, they are what insurers ask about, and they are already what a risk analysis will flag as gaps. None of them require the proposal to be finalised to be worth doing.

Watch the last three

Annual penetration tests and semi-annual vulnerability scans are a real recurring cost for a small practice, and formal technical verification of every business associate is a workload nobody has scoped yet. Plan for them, price them, and do not buy them on a multi-year commitment before the rule is final. Reviewing the HHS OCR breach portal is a free and sobering alternative in the meantime — the pattern of reported incidents at small provider organisations tells you more about your realistic risk than any vendor deck will.

Where a Practice Should Start

A sensible ninety days

Start with an inventory: every device, every system holding ePHI, every vendor with access. Then unique accounts and MFA, then a restore test, then segmentation of the clinical network from guest and general office traffic. Feed the results into the risk analysis rather than treating the risk analysis as a separate paperwork exercise, because the Security Rule expects the technical findings and the management response to be the same document set.

Florida practices have a second layer on top of the federal one. The state's own notification timetable and penalty structure is covered in dental office IT compliance issues Florida practices cannot ignore, and if you run a dental practice specifically, the longer treatment is in our guide to HIPAA compliance for dental offices in Miami.

Get an outside read

If you want a technical baseline of where the practice actually stands, request a free IT assessment. We will inventory what is running, show you which technical safeguards are in place and which are not, and hand you the findings whether or not you engage us. Our office is at 14100 Palmetto Frontage Rd, Suite 108, Miami Lakes, FL 33016, and the phone number is (305) 901-8990.

This article provides general information, not legal or insurance advice. Consult qualified professionals regarding your specific obligations and coverage.