Is there an official HIPAA certification?

No. HHS does not certify organizations, people or products as HIPAA compliant, and it does not recognize private certifications. You show compliance through your risk analysis, policies, safeguards and records.

Does HIPAA require full-disk encryption on laptops?

Encryption is an addressable specification today, so you must use it where reasonable or document an equivalent. For laptops that leave the building, few alternatives hold up, and encryption is what usually keeps a lost device from becoming a reportable breach. The proposed rule would make it required.

Is a lost encrypted laptop a reportable breach?

Usually not, if the encryption meets HHS guidance and the key was not compromised. You still need to assess the incident and document the decision.

Can staff use personal phones to access PHI?

Yes, if your risk analysis and BYOD policy allow it and the phone meets your controls. That means at least a passcode, a supported OS and a way to remove work data. Write the rules down and get users to sign them.

How often should we do a HIPAA risk analysis?

The current rule asks for an accurate, thorough analysis that you review periodically and whenever your environment changes. Many organizations do it yearly. The proposed rule would require a review at least every 12 months.

Is the 2025 HIPAA Security Rule in effect?

No. It was proposed in January 2025 and, as of October 2026, the regulatory agenda lists final action for July 2027. The existing Security Rule still applies.

How fast does HIPAA require patches to be applied?

The current rule sets no fixed deadline, but unpatched systems are a risk your risk analysis and risk management plan must address. The proposed rule would require critical fixes within 15 days and high-risk fixes within 30, which is a reasonable target now.

Does an MDM make us HIPAA compliant?

No. A device management tool covers many endpoint controls, such as encryption, passcodes, patching and remote wipe. The rest of the program, from the risk analysis to business associate agreements and training, is still yours.

What does OCR ask for in a HIPAA audit?

A HIPAA audit or investigation letter usually asks for your current and previous risk analysis, the risk management plan, security and privacy policies with their history, training records, business associate agreements, and records showing your safeguards were in use, such as log reviews and device encryption reports. In the 2016-2017 audits, organizations had 10 business days to respond.

HIPAA Compliance Checklist for IT Teams (PDF + Excel)

A HIPAA compliance checklist turns the HIPAA Security, Privacy and Breach Notification Rules into a list of jobs you can assign, finish and prove. This one has 76 controls in 12 areas. Each control cites its section of 45 CFR and lists the evidence an auditor will ask for. The PDF and Excel versions add an owner and a frequency for each one.

It is written for the people who carry most of the work: IT managers, sysadmins and MSPs supporting clinics, practices, health tech companies and business associates. The device and endpoint section goes further than most checklists, because that is the part IT actually configures.

Download the checklist as a printable PDF and an Excel tracker with a status dashboard, or work through it below.

Preview of the HIPAA compliance checklist PDF and Excel tracker

In short

Start with a risk analysis that covers every system, laptop, phone and vendor that touches ePHI. It is the gap OCR has targeted in its recent settlements.
Encrypt every laptop and desktop, require passcodes on phones, and store the recovery keys centrally.
Sign a business associate agreement with every vendor before PHI reaches it.
Addressable does not mean optional. Do it, or document why not and what you do instead.
The 2025 Security Rule changes are still proposed, with final action listed for July 2027. They are still a sensible target.
Keep the evidence for 6 years. In an investigation, the record matters as much as the control.

What a HIPAA compliance checklist needs to cover

If you already know the three rules and the difference between required and addressable, skip to the checklist.

HIPAA applies to covered entities and their business associates. Covered entities are health plans, healthcare clearinghouses and providers who send standard transactions, such as claims, electronically. Business associates are vendors that create, receive, store or send PHI for them. That can include IT providers, MSPs and cloud services that have access to PHI. If you are not sure which you are, see our guide to HIPAA compliance for small business.

A complete checklist covers three rules:

The Security Rule (45 CFR 164.302 to 164.318) protects electronic PHI with administrative, physical and technical safeguards. For IT, this is most of the work.
The Privacy Rule (164.500 to 164.534) sets who may use or disclose PHI, including the minimum necessary standard and patient access rights.
The Breach Notification Rule (164.400 to 164.414) says who you must notify after a breach, and how fast.

Each Security Rule specification is either required or addressable. Required means you do it. Addressable means you do it if it is reasonable and appropriate, or you document why not and put an equivalent measure in place. It never means optional (164.306(d)).

There is no official HIPAA certification. HHS says it does not endorse or recognize private certifications. What protects you is a working program and the records to show it.

Start here: a 90-day plan

That is too many controls to start at once, so split them into three phases. The first 30 days cover the items regulators ask about first: the risk analysis, encryption, MFA, business associate agreements and offboarding.

The checklist in three phases: days 1 to 30, days 31 to 90, and ongoing

In the Excel tracker, filter the Phase column to see each list. Give every item a named owner and a due date before you start.

The HIPAA compliance checklist, by area

Here is the full checklist. Start with the items marked "first 30 days". Required and addressable come from the rule text. Recommended items are not named in the rule, but they are how most teams meet the cited standard, often based on the HHS Cybersecurity Performance Goals. The PDF has the same list with checkboxes, owners and frequencies, and the Excel version adds status tracking.

76 controls across 12 areas, split into required, addressable and recommended

Governance and scope (7 controls)

Someone has to own the program, and you have to know where ePHI lives before you can protect it.

ID	What to do	45 CFR	Type	Evidence to keep
GOV-01	Name a security official who owns the Security Rule program (first 30 days)	164.308(a)(2)	Required	Signed appointment letter
GOV-02	Name a privacy official and a contact person for privacy questions (first 30 days)	164.530(a)	Required	Appointment letter; contact listed in your Notice of Privacy Practices
GOV-03	Decide in writing whether you are a covered entity, a business associate, or both (first 30 days)	160.103	Required	Short determination memo
GOV-04	Map where ePHI is created, stored and sent: systems, devices, cloud apps and vendors (first 30 days)	164.308(a)(1)(ii)(A)	Required	Data flow map and system list
GOV-05	Write security policies and procedures for every Security Rule standard	164.316(a)	Required	Policy set with version and approval dates
GOV-06	Keep HIPAA documentation for 6 years from creation or last effective date	164.316(b)(2)(i)	Required	Retention schedule; archive location
GOV-07	Run a periodic technical and nontechnical evaluation of your safeguards	164.308(a)(8)	Required	Dated evaluation report

Risk analysis and management (4 controls)

Everything else builds on the risk analysis. OCR's Risk Analysis Initiative has made it a central issue in its settlements since late 2024. In September 2026, OCR settled with Ambry Genetics for $700,000 after a phishing attack affecting about 225,000 people, citing an inaccurate risk analysis, missing termination procedures and no unique user IDs. Make yours thorough, dated and tied to fixes. Our risk management plan template covers RISK-02.

ID	What to do	45 CFR	Type	Evidence to keep
RISK-01	Complete an accurate, thorough risk analysis that covers all ePHI, including laptops, phones, backups and vendors (first 30 days)	164.308(a)(1)(ii)(A)	Required	Dated risk analysis report with scope
RISK-02	Turn every risk into a fix with an owner and a due date in a risk management plan (first 30 days)	164.308(a)(1)(ii)(B)	Required	Risk register showing owners, dates and status
RISK-03	Adopt a sanction policy for workforce members who break security rules, and apply it	164.308(a)(1)(ii)(C)	Required	Sanction policy; sanction records
RISK-04	Review system activity regularly: audit logs, access reports and incident tracking	164.308(a)(1)(ii)(D)	Required	Review log with reviewer and date

Workforce and training (6 controls)

Many incidents start with a person: a shared password, a phishing click, a laptop left in a car. Training and clear rules lower the odds.

ID	What to do	45 CFR	Type	Evidence to keep
PEOPLE-01	Authorize and supervise workforce members who work with ePHI	164.308(a)(3)(ii)(A)	Addressable	Access approval records
PEOPLE-02	Check that each person's access fits their role before granting it (clearance)	164.308(a)(3)(ii)(B)	Addressable	Clearance step in onboarding records
PEOPLE-03	Train every workforce member on security and privacy at hire and at least yearly (first 30 days)	164.308(a)(5)(i); 164.530(b)	Required	Training records and attestations
PEOPLE-04	Send security reminders, such as phishing alerts and policy changes	164.308(a)(5)(ii)(A)	Addressable	Copies of reminders sent
PEOPLE-05	Monitor login attempts and report discrepancies	164.308(a)(5)(ii)(C)	Addressable	Failed login report review
PEOPLE-06	Set password rules for creating, changing and protecting passwords (first 30 days)	164.308(a)(5)(ii)(D)	Addressable	Password policy; enforced settings

Access and identity (9 controls)

Every person gets their own login, only the access their job needs, and nothing left behind when they leave. Pair this section with our IT offboarding checklist.

ID	What to do	45 CFR	Type	Evidence to keep
ACCESS-01	Give every person a unique user ID; remove shared and generic logins (first 30 days)	164.312(a)(2)(i)	Required	User list with no shared accounts
ACCESS-02	Grant access by role, limited to the minimum necessary for the job	164.308(a)(4)(ii)(B)	Addressable	Role-to-access matrix
ACCESS-03	Use a documented process to create and change access (joiners and movers)	164.308(a)(4)(ii)(C)	Addressable	Access tickets with approvals
ACCESS-04	Review who has access to each ePHI system and remove what is no longer needed	164.308(a)(4)	Recommended	Signed access review
ACCESS-05	Verify the identity of every person or system before it can access ePHI (first 30 days)	164.312(d)	Required	Authentication settings per system
ACCESS-06	Write an emergency access (break-glass) procedure for ePHI	164.312(a)(2)(ii)	Required	Procedure and test record
ACCESS-07	Remove all access the day someone leaves: SSO, apps outside SSO, shared accounts, devices, keys (first 30 days)	164.308(a)(3)(ii)(C)	Addressable	Offboarding checklist with timestamps
ACCESS-08	Keep admin accounts separate from daily user accounts	HHS CPG	Recommended	List of admin accounts
ACCESS-09	Use multi-factor authentication for email, EHR, remote access and admin consoles (first 30 days)	164.312(d); HHS CPG	Recommended	MFA settings; MFA coverage report

Devices and endpoints: the HIPAA IT compliance checklist (17 controls)

This is the largest area, and the one most checklists skip. Laptops, desktops, phones and tablets hold or reach ePHI every day, and HHS lists loss or theft of equipment among the five main threats to healthcare organizations. These controls are the technical safeguards an IT team actually configures.

The eight core device controls for every laptop, desktop and phone with ePHI

ID	What to do	45 CFR	Type	Evidence to keep
DEV-01	Keep a live inventory of every device that touches ePHI: owner, OS version, encryption, last check-in (first 30 days)	164.310(d)(2)(iii)	Addressable	Inventory export
DEV-02	Encrypt every laptop and desktop (BitLocker, FileVault) and store recovery keys centrally (first 30 days)	164.312(a)(2)(iv)	Addressable	Encryption status report; key escrow record
DEV-03	Require a passcode on phones and tablets so built-in encryption is active (first 30 days)	164.312(a)(2)(iv)	Addressable	Passcode compliance report
DEV-04	Lock screens automatically after a set idle time, written in your policy (first 30 days)	164.312(a)(2)(iii)	Addressable	Screen lock settings per platform
DEV-05	Write a workstation use policy: which devices may access ePHI, where and how	164.310(b)	Required	Workstation use policy
DEV-06	Physically protect workstations: positioning, privacy screens, locked rooms	164.310(c)	Required	Walkthrough notes
DEV-07	Patch operating systems and apps on a set timeline, fastest for critical issues (first 30 days)	164.308(a)(1)(ii)(B)	Recommended	Patch compliance report
DEV-08	Run anti-malware on every endpoint and keep it current (first 30 days)	164.308(a)(5)(ii)(B)	Addressable	Anti-malware coverage report
DEV-09	Turn on host firewalls and block USB storage where it is not needed	164.308(a)(1)(ii)(B)	Recommended	Configuration report
DEV-10	Allow only approved apps on devices that hold ePHI	164.308(a)(1)(ii)(B)	Recommended	Approved app list
DEV-11	Write BYOD rules: whether personal devices may touch ePHI, and the controls they need	164.310(b); 164.308(a)(1)(ii)(B)	Required	BYOD policy; signed user agreements
DEV-12	Have a lost or stolen device procedure: lock, locate, wipe, then assess for breach (first 30 days)	164.308(a)(6)(ii)	Required	Procedure; lost device log
DEV-13	Wipe or destroy devices and drives before disposal, and keep proof	164.310(d)(2)(i)	Required	Wipe record or destruction certificate
DEV-14	Remove ePHI before a device is reissued to someone else	164.310(d)(2)(ii)	Required	Reissue record
DEV-15	Back up ePHI before moving equipment	164.310(d)(2)(iv)	Addressable	Backup confirmation
DEV-16	Set a secure configuration baseline for each platform and check for drift	164.308(a)(1)(ii)(B)	Recommended	Baseline document; compliance report
DEV-17	Replace unsupported operating systems, or isolate them with a documented exception	164.308(a)(1)(ii)(B)	Recommended	OS version report; exception log

Encryption is the control that changes the outcome of a loss. HHS breach guidance treats properly encrypted data as secured. If a device was encrypted to that standard and the key was not compromised, a lost laptop usually does not become a reportable breach. A login password is not encryption. Encryption also has to be on before the loss, so check status across the fleet, not one machine at a time.

Platform	What to turn on	Keys and checks
Windows	BitLocker (Pro, Enterprise and Education editions; Home has only basic device encryption)	Recovery key stored in your directory or device management tool
macOS	FileVault	Personal recovery key stored in your device management tool
iOS and iPadOS	Data protection, which turns on with a passcode	Enforce the passcode
Android	Encryption, on by default on current devices, plus a screen lock	Enforce the screen lock and a minimum OS version
Linux	LUKS full-disk encryption, set at install	Keep the passphrase or key in your vault

If a device reports encrypted but there is no recovery key in your console, the key was probably never escrowed. Rotate it and store the new one before you need it.

Patching has no fixed deadline in today's rule; it sits under risk management and protection from malicious software. The proposed rule would set one: critical risks within 15 days, high risks within 30. That is a sensible target now. If patches keep missing certain machines, look first at medical imaging workstations or front-desk PCs excluded from your update rings, and at anything still running an unsupported OS. Isolate those and record the exception until they are replaced. Our guide to patch management covers the mechanics.

Personal phones can touch ePHI only if your risk analysis and BYOD policy allow it, and only with the same baseline: a passcode, a supported OS, and a way to remove work data. Write the rules down with our BYOD policy template, and see our guide to HIPAA rules for PHI on mobile devices.

Network and transmission (5 controls)

ePHI moving across networks needs the same care as ePHI at rest.

ID	What to do	45 CFR	Type	Evidence to keep
NET-01	Encrypt ePHI in transit: TLS for web and email, VPN for remote access (first 30 days)	164.312(e)(2)(ii)	Addressable	TLS and VPN settings
NET-02	Protect ePHI from being changed in transit without detection	164.312(e)(2)(i)	Addressable	Integrity control settings
NET-03	Secure Wi-Fi with WPA2 or WPA3, and keep guests on a separate network	164.308(a)(1)(ii)(B)	Recommended	Wi-Fi configuration
NET-04	Segment the network: keep medical devices, guests and legacy systems apart	164.308(a)(1)(ii)(B)	Recommended	Network map with segments
NET-05	Scan for vulnerabilities and run penetration tests	164.308(a)(8)	Recommended	Scan and test reports

Audit logs and integrity (3 controls)

Logs answer the question an investigator asks first: who accessed what, and when.

ID	What to do	45 CFR	Type	Evidence to keep
AUDIT-01	Turn on audit logging in every system that holds ePHI: EHR, email, file storage, endpoints (first 30 days)	164.312(b)	Required	Logging settings; sample log export
AUDIT-02	Set how long logs are kept and protect them from editing	164.312(b); 164.316(b)	Required	Log retention settings
AUDIT-03	Protect ePHI from improper change or destruction, and be able to prove it	164.312(c)(1)	Addressable	Integrity controls description

Backup and contingency (6 controls)

Ransomware made this section urgent. You need backups you have actually restored, and a plan for running while systems are down. See our disaster recovery plan template.

ID	What to do	45 CFR	Type	Evidence to keep
CONT-01	Back up ePHI so you can restore an exact copy (first 30 days)	164.308(a)(7)(ii)(A)	Required	Backup job reports
CONT-02	Write a disaster recovery plan to restore lost data	164.308(a)(7)(ii)(B)	Required	Disaster recovery plan
CONT-03	Plan how to keep protecting ePHI while running in emergency mode	164.308(a)(7)(ii)(C)	Required	Emergency mode plan
CONT-04	Test restores and contingency plans, then fix what failed	164.308(a)(7)(ii)(D)	Addressable	Test results with date
CONT-05	Rank which applications and data matter most for recovery	164.308(a)(7)(ii)(E)	Addressable	Criticality list
CONT-06	Allow facility access to restore data during an emergency	164.310(a)(2)(i)	Addressable	Contingency access procedure

Facility security (3 controls)

Physical security still matters for server rooms, front desks and records storage.

ID	What to do	45 CFR	Type	Evidence to keep
FAC-01	Write a facility security plan for areas with ePHI systems	164.310(a)(2)(ii)	Addressable	Facility security plan
FAC-02	Control and validate physical access: badges, keys, visitor logs	164.310(a)(2)(iii)	Addressable	Badge and visitor logs
FAC-03	Record repairs to physical security: doors, locks, walls	164.310(a)(2)(iv)	Addressable	Maintenance records

Vendors and business associates (4 controls)

If a vendor touches PHI, it needs a business associate agreement before the first record moves. That includes your EHR, email, cloud storage, billing service and IT provider.

ID	What to do	45 CFR	Type	Evidence to keep
VEND-01	List every vendor that creates, receives, stores or sends PHI for you (first 30 days)	164.308(b)(1)	Required	Vendor list
VEND-02	Sign a business associate agreement with each one before PHI flows (first 30 days)	164.308(b)(1); 164.502(e); 164.504(e)	Required	Signed BAAs
VEND-03	If you are a business associate, sign BAAs with your own subcontractors	164.308(b)(2); 164.314(a)	Required	Subcontractor BAAs
VEND-04	Review each business associate's security safeguards	164.308(b)(1)	Recommended	Vendor review notes or attestations

Incidents and breach notification (6 controls)

Decide the steps before you need them. Our data breach response plan template covers the full process.

ID	What to do	45 CFR	Type	Evidence to keep
INC-01	Write and test an incident response procedure: identify, respond, mitigate, document (first 30 days)	164.308(a)(6)(ii)	Required	Procedure; incident log
INC-02	Assess every possible breach using the four-factor risk assessment	164.402	Required	Completed risk assessments
INC-03	Notify affected individuals without unreasonable delay, and no later than 60 days after discovery	164.404	Required	Copies of notices and dates
INC-04	Notify prominent media when a breach affects more than 500 residents of a state	164.406	Required	Media notice
INC-05	Notify HHS: at the same time for 500 or more people; yearly log within 60 days of year end for fewer	164.408	Required	HHS submission receipts
INC-06	Business associates: report breaches to the covered entity within 60 days, or sooner if the BAA says so	164.410	Required	Notice to covered entity

Privacy Rule essentials (6 controls)

The Privacy Rule is mostly a job for your privacy official, but IT supports several of these items.

ID	What to do	45 CFR	Type	Evidence to keep
PRIV-01	Confirm your Notice of Privacy Practices includes the changes due February 16, 2026, and post it in your office and on your website (first 30 days)	164.520	Required	Current notice with date
PRIV-02	Limit uses and disclosures of PHI to the minimum necessary	164.502(b); 164.514(d)	Required	Minimum necessary policy
PRIV-03	Answer patient access requests within 30 days (one 30-day extension allowed)	164.524	Required	Request log with dates
PRIV-04	Run a complaints process, and never retaliate against people who complain	164.530(d); 164.530(g)	Required	Complaint log
PRIV-05	Get written authorization for uses that need it, such as marketing	164.508	Required	Signed authorizations
PRIV-06	Protect PHI in every form, including paper and conversations	164.530(c)	Required	Walkthrough notes

Lost or stolen device: the 7-step runbook

When a device goes missing, the first hour matters. The 60-day notification clock starts when the loss is discovered. Agree on these steps in advance:

Seven steps for a lost or stolen device: report, lock and locate, wipe, check encryption, assess, notify if needed, log it

Report. Staff tell IT the same day, with no penalty for reporting.
Lock and locate. Send a remote lock and check the last known location.
Wipe. If the device is not recovered quickly, wipe it.
Check encryption. Confirm from your console records that it was encrypted, and that the key was not stored on or with the device.
Assess. Run the four-factor breach risk assessment from 164.402: what PHI was involved, who may have it, whether it was actually acquired or viewed, and how far the risk has been reduced.
Notify if needed. If you cannot show a low probability of compromise, notify without unreasonable delay, and no later than 60 days after discovery.
Log it. Record the decision, even when it is "not a breach". The Excel tracker has a lost device log for this.

Breach notification deadlines for individuals, HHS and the media

Notices go to affected individuals without unreasonable delay, and no later than 60 days after discovery. Breaches affecting 500 or more people are also reported to HHS at the same time. Smaller breaches go in a yearly log, due within 60 days of the end of the year. If more than 500 residents of one state are affected, prominent media outlets must be notified too.

What auditors ask for: the evidence pack

OCR investigators and outside auditors ask for records, not intentions. Keep these current and dated, and keep them for 6 years (164.316(b); 164.530(j) for Privacy Rule records).

Control	Evidence	Suggested refresh
Risk analysis	Dated report covering every system and device with ePHI	Yearly
Risk management plan	Risk register with owners, fixes and due dates	Quarterly
Device encryption	Encryption status per device, with recovery keys escrowed	Monthly
Patching	Patch compliance report by device and severity	Monthly
Device inventory	Every device with owner, OS version and last check-in	Quarterly
Access reviews	Signed review of who can reach each ePHI system	Quarterly
Audit log review	Review record with reviewer, date and findings	Monthly
Offboarding	Checklist per leaver with timestamps	Every departure
Training	Attendance records and signed attestations	Yearly
Business associates	Signed BAA for every vendor on the vendor list	Yearly
Backups	Backup reports and the last restore test	Quarterly
Incidents	Incident log and breach risk assessments	Every incident

Generate device reports on a schedule, not on request. A dated monthly encryption and patch report shows a control working over time. A screenshot taken the week before an audit shows only that week.

Preparing for an OCR audit or investigation

A HIPAA audit is a review by HHS's Office for Civil Rights (OCR) of whether a covered entity or business associate follows the Privacy, Security and Breach Notification Rules. Most organizations never get a random audit. They meet OCR through an investigation, after a complaint or a breach report. Either way, the request looks much the same.

How OCR actually reaches you

In 2024, OCR received 30,256 complaints and opened 730 compliance reviews. It started no audits that year, citing a lack of funding. It also investigates every reported breach affecting 500 or more people, and there were 663 of those in 2024. If you report a large breach, expect OCR to ask for your records.

The OCR audit program in 2026

2016 to 2017: OCR audited 207 organizations. In its industry report, only 14% of covered entities substantially met the risk analysis requirement, and 94% failed on risk management.
November 2024: HHS's Inspector General found that those audits tested only 8 of 180 HIPAA requirements and no physical or technical safeguards. It recommended that future audits cover them.
2024 to 2025: OCR announced a new round covering 50 covered entities and business associates, focused on the Security Rule provisions most relevant to hacking and ransomware. As of October 2026, OCR has not published the results.

The direction is clear: the next audits look at technical controls, which means the device and access evidence in this checklist.

What the request letter asks for

In the 2016 to 2017 audits, organizations had 10 business days to upload documents. OCR's desk audit guidance asked for the current risk analysis and the one before it, policies as they stood six years before the letter, records from the previous calendar year, and proof that staff could reach the documents and that they were reviewed. Investigation letters set their own deadlines, but they ask for the same kinds of records. The full list of what OCR can test is in its audit protocol.

The most common gap is not a missing policy. It is a missing record that the policy was followed.

HIPAA audit checklist: 15 things to have ready

The IDs point to the items in the checklist above, and in the PDF and Excel tracker.

#	Have ready	Checklist IDs	What to have on file
1	Name one person to handle OCR letters and track the response deadline	GOV-01, GOV-02	Named security and privacy officials; a contact for OCR
2	Your current risk analysis and the one before it	RISK-01, GOV-04	Both dated, both covering all ePHI: systems, devices, vendors
3	The risk management plan, and proof the fixes happened	RISK-02	Each risk with its fix, owner and date, plus the change records or reports
4	Security, privacy and breach policies, with their history	GOV-05, GOV-06	Version history going back 6 years
5	Proof staff can reach the policies and that you review them	GOV-06	Folder permissions or intranet page, and a review log
6	Your most recent evaluation of the safeguards	GOV-07	Dated report, technical and nontechnical
7	Training and security reminder records for the past year	PEOPLE-03, PEOPLE-04	Attendance, attestations, reminder emails
8	Vendor list with a signed BAA for each	VEND-01, VEND-02, VEND-03	Including subcontractors if you are a business associate
9	Access reviews, offboarding records and MFA coverage	ACCESS-04, ACCESS-07, ACCESS-09	Signed reviews, leaver checklists with times, MFA enrollment report
10	Audit log settings and log review records	RISK-04, AUDIT-01, AUDIT-02	Retention settings and a dated review log
11	Device inventory and monthly encryption and patch reports	DEV-01, DEV-02, DEV-07	Twelve months of dated reports, not one screenshot
12	Backup reports and the last restore test	CONT-01, CONT-04	Result and date of the most recent test
13	Incident log, breach risk assessments and notices for the past year	INC-01, INC-02, INC-03, INC-05	Including incidents you decided were not breaches
14	Notice of Privacy Practices and the patient access request log	PRIV-01, PRIV-03	Current NPP; requests with response dates
15	Your recognized security practices file	GOV-05, RISK-01, DEV-01	The framework you follow and 12 months of evidence it was in use

Get credit for recognized security practices

Since 2021, the law has required OCR to consider whether you had recognized security practices in place for the previous 12 months, such as the NIST Cybersecurity Framework or HHS's 405(d) practices, when it decides on fines and audit outcomes. OCR has said the practices must be "actively and consistently in use", so a policy adopted last month doesn't count. Keep a short file: which framework you follow, and dated evidence from the past year that you followed it. It is not a safe harbor, but OCR must weigh it.

The proposed 2025 HIPAA Security Rule: what would change

Status in October 2026: proposed, not law. HHS published the proposal on January 6, 2025. The current regulatory agenda lists it as a long-term action, with final action in July 2027. The rule in force today is the existing Security Rule.

The main changes in the proposal:

Area	What the proposal would require
Required vs addressable	The difference goes away; almost every specification becomes required
Asset inventory and network map	Written, reviewed at least every 12 months
Encryption	ePHI encrypted at rest and in transit, with limited exceptions
Multi-factor authentication	Required, with limited exceptions
Patching	Critical risks within 15 days, high risks within 30 days
Vulnerability scans and pen tests	Scans at least every 6 months; pen test every 12 months
Backups and restore	Backups no more than 48 hours old; restore critical systems within 72 hours
Compliance audit	Against every Security Rule standard, at least every 12 months
Access termination	Notify other regulated entities within 24 hours
Business associates	Written verification of safeguards at least every 12 months

None of this is required yet, and the final rule may differ. Much of it matches what OCR already looks for after an incident. In the PDF and Excel tracker, 22 items are marked "Proposed": they already move you in this direction, so you can build toward it without waiting.

HIPAA penalties at a glance

Civil penalties depend on what the organization knew and how fast it fixed the problem. These are the per-violation ranges as adjusted on January 28, 2026, with a calendar-year cap of $2,190,294 for identical violations.

Culpability	Minimum	Maximum
Did not know	$145	$73,011
Reasonable cause	$1,461	$73,011
Willful neglect, corrected within 30 days	$14,602	$73,011
Willful neglect, not corrected	$73,011	$2,190,294

For real cases and how fines are set, see HIPAA violation fines and penalties.

Common mistakes that fail an audit

Treating addressable as optional. Every addressable item needs either the control or a written reason and an alternative.
A risk analysis that skips devices. Laptops, phones, backups and messaging apps belong in scope, not just the EHR.
Encryption with no stored recovery key. You lose the data if the user forgets the password, and you cannot prove the key was safe.
Offboarding that stops at single sign-on. Scheduling, texting and billing portals outside SSO are where former staff keep access.
Assuming a big vendor makes you compliant. A business associate agreement covers the vendor's part. Your configuration and your staff are still your part.
No record of the incident that was "not a breach". Document the assessment either way.

More HIPAA guides for IT teams

How trio.so helps with the device items

trio.so covers many of the device controls in this checklist from one console:

Encryption: enforce BitLocker on Windows and FileVault on Mac, and see encryption status for every device (DEV-02).
Passcodes and screen lock: set passcode rules and inactivity locks on Windows, macOS, iOS and Android (DEV-03, DEV-04, PEOPLE-06).
Patching: enforce OS updates on Windows, macOS, iOS and Android, and see vulnerability findings scored by CVSS, EPSS and CISA KEV (DEV-07).
Inventory: hardware, software and OS versions for every enrolled device, including Linux (DEV-01, DEV-17).
Lost devices: lock and locate lost Macs, iPhones and Android devices, and wipe company-owned devices remotely (DEV-12, DEV-14).
Offboarding: wipe or unenroll a departing employee's company device (ACCESS-07).
Configuration: firewall and USB rules on Mac and Windows, app allow and block lists, and compliance checks against a baseline (DEV-09, DEV-10, DEV-16).
Records: an admin event log that shows who changed what, and when, with export, plus device logs (RISK-04).

Compliance stays your organization's responsibility: the risk analysis, policies, training and agreements are yours to run. What trio.so gives you is control of the device settings this checklist asks for, plus the device reports that show they are working. Learn more about device management for healthcare and compliance automation.

Start free trial Book a demo

14 day free trial. No credit card required.

Sources. Last reviewed October 2026. This article is for information only and is not legal advice.