HIPAA has a reputation for being impossible to understand, so many small practices do one of two things. They assume the software vendor handled it, or they avoid thinking about it until something goes wrong. Neither works, and the requirements are more reasonable than the reputation suggests.
This is a plain-English overview, not legal advice. Your attorney or compliance officer decides what applies to your specific practice.
Who it applies to
HIPAA applies to covered entities, which includes most healthcare providers who bill insurance electronically, and to business associates, which are the vendors who handle patient information on their behalf. A solo practitioner counts. Being small does not make you exempt.
The part that causes the most trouble: the risk analysis
The HIPAA Security Rule expects you to carry out an accurate and thorough assessment of the risks to the electronic patient information you hold. That means knowing where it is stored, who can reach it, and what could go wrong, then writing it down.
This is the requirement practices most often skip, and it is the one the rest builds on. Without it, you cannot show that your safeguards match your real risks.
A risk analysis is not a one-time document. It should be revisited when you change systems, add a location, or have an incident.
What else the Security Rule expects
The rule groups its requirements into administrative, physical, and technical safeguards. In practice, that translates to:
- A named person responsible for security. In a small practice this is often the owner or office manager, with outside help.
- Written policies and procedures that match what you really do, not a template sitting in a drawer.
- Staff training, and a record that it happened.
- Access control. Each person has their own login, and people only reach what their job requires.
- Audit logging. Systems record who accessed patient information, and someone can review it.
- Protection for devices and data, including encryption where it is reasonable, screen locks, and a plan for lost or stolen devices.
- Backup and recovery, so you can restore patient records after a failure.
- A way to handle incidents, including what to do and who to tell.
The rule is flexible about how. It asks for measures that fit the size and complexity of your practice, but it does not let you skip categories.
Business associate agreements
Any vendor that creates, stores, or sends patient information for you needs a signed business associate agreement. That commonly includes your electronic health record vendor, a cloud backup provider, an email or messaging service used for patient information, an answering service, and an IT provider with access to your systems.
Ask for the agreement before the vendor touches patient data. A vendor that will not sign one should not hold your patient information.
Breach notification
If unsecured patient information is exposed, the Breach Notification Rule requires you to notify the affected patients, and in many cases the government, within set timeframes. Knowing what counts as a breach, and who decides, is something to settle before it happens.
Common misunderstandings
“We bought HIPAA-compliant software.” Software can support compliance. It cannot make your practice compliant, because the rules cover how your people use it, who has access, and how it is set up.
“There is a HIPAA certification.” There is no official government HIPAA certification for practices or products. Be careful with anyone who sells one. Language like “HIPAA-aligned” describes work done against the rule’s requirements and is more honest.
“We have never had a problem, so we are fine.” Many problems are only found when someone looks. A risk analysis is how you look on your own schedule.
“Our IT person covers it.” IT staff handle the technical safeguards. The administrative parts, such as policies, training, and decisions, belong to the practice.
Keep your documentation
HIPAA expects you to document your policies, your risk analysis, and your training, and to keep that documentation for six years. If you are ever audited, or have an incident, your records are how you show what you did and when.
Where to start
- Make a list of every system that holds patient information.
- Find out whether you have a current written risk analysis.
- Check that every vendor with access has a signed business associate agreement.
- Confirm that staff training happened this year and is recorded.
If any of those four is a “not sure,” that is a reasonable place to begin. Our HIPAA audit walks through all of this against your actual setup and gives you a written list of gaps in priority order. You can also read more on our healthcare page, or tell us what is going on.