HIPAA Compliance and IT: A Checklist for Small Healthcare Practices
HIPAA compliance often gets treated as a paperwork exercise: a binder of policies, a signed form, done. But HIPAA's Security Rule puts specific, technical requirements on how a practice's IT is actually set up. A well-written policy does not protect a patient record sitting on an unencrypted laptop. Here is a practical checklist for where small healthcare practices most often fall short.
HIPAA is a technical requirement, not just a policy document
The HIPAA Security Rule specifically covers electronic protected health information, and it requires administrative, physical, and technical safeguards. The technical safeguards are the part most small practices are weakest on, because they require ongoing IT work, not a one-time policy sign-off.
A practice can have a complete HIPAA policy manual and still fail an audit if the underlying systems do not actually implement what the policy describes.
Business Associate Agreements
Any vendor that touches protected health information on your behalf, including your IT provider, needs a signed Business Associate Agreement. This is not optional and it is one of the first things an auditor checks.
If your current IT provider has never mentioned a BAA, that is worth asking about directly.
Where small practices most often fall short
- Encryption not enabled on laptops and mobile devices that can access patient records
- Staff accounts with more access than their role actually requires
- No audit logging of who accessed which patient record and when
- Former employees still able to log into systems weeks or months after leaving
- Backups that exist but have never been tested for a real restore
- No documented incident response plan for what happens if a breach is suspected
What a HIPAA-aware IT setup actually includes
- 1
Encryption on every device that can access patient data, including phones and laptops used remotely.
- 2
Role-based access so staff can only see the patient information relevant to their job.
- 3
Audit logs that record access to patient records, reviewed periodically rather than left unchecked.
- 4
A documented offboarding process that removes access the same day an employee leaves.
- 5
Backups that are tested with an actual restore, not just confirmed to have run.
- 6
A written incident response plan, since HIPAA breach notification has strict timelines once a breach is discovered.
Why this matters beyond the audit risk
Healthcare is one of the most targeted industries for ransomware, in part because attackers know patient care cannot simply stop. A practice that has not addressed these technical safeguards is exposed to both a compliance failure and a real operational one at the same time.
Getting this right protects patients and staff whether or not an audit ever happens.
None of this requires an enterprise IT budget. It requires an IT partner who treats HIPAA as a technical requirement built into daily operations, not a document that gets filed away after signing. If you cannot confidently answer whether your practice has a signed BAA with every vendor touching patient data, that is the first thing worth checking.
Questions about your IT setup?
We work with small businesses and accounting firms across the Chicago area. Schedule a free 30-minute consultation and we will tell you honestly what we see.