A HIPAA compliance checklist is useful when it leads to evidence and follow-up. A checked box should point to a current policy, risk record, training log, access review, vendor agreement, test result, or documented decision—not only a verbal assurance that “IT handles it.”
This 2026 checklist reflects the current HIPAA Privacy, Security, and Breach Notification framework and HHS guidance available when published. The December 2024 Security Rule update remains a proposed rule unless and until HHS issues a final rule. Dental practices should track official updates without treating proposals as current requirements.
1. Governance and assigned responsibility
- A privacy official and a security official are designated.
- HIPAA policies match actual systems, roles, and workflows.
- Policies and required documentation are retained for the applicable period.
- Leadership receives open-risk, incident, training, and remediation updates.
- A regular evaluation cycle and change-based review triggers are defined.
2. Security risk analysis and risk management
- Every location and source of ePHI is in scope, including cloud services, email, imaging, backups, and vendors.
- Threats and vulnerabilities cover administrative, physical, and technical conditions.
- Existing safeguards are verified with evidence.
- Likelihood and impact use documented rating definitions.
- Findings have owners, target dates, treatment decisions, and tracked status.
- The analysis is updated after major system, location, vendor, or workflow changes.
HHS calls risk analysis foundational and does not require one specific methodology. Completeness, accuracy, documentation, and an active risk-management process matter more than the brand of template.
3. Workforce access and training
- Each workforce member uses a unique account.
- Access is approved according to role and the minimum necessary standard where applicable.
- New hires receive security and privacy training, and completion is documented.
- Role changes trigger an access review.
- Terminations disable access promptly and recover devices, keys, and credentials.
- Sanctions and incident-reporting expectations are documented and consistently applied.
4. Technical safeguards
- MFA protects email, remote access, privileged accounts, and critical cloud services.
- Portable devices and appropriate data stores use encryption.
- Supported systems receive security updates on a defined schedule.
- Endpoint and email protections are monitored and escalated.
- Audit logging is enabled where appropriate, protected, and reviewed.
- Sessions, remote access, and administrative privileges are controlled.
- Backups are separated from production access and restoration is tested.
5. Physical safeguards and device lifecycle
- Facility access and after-hours access are controlled.
- Workstations are positioned and configured to reduce inappropriate viewing or use.
- Laptops, tablets, removable media, and clinical devices are inventoried.
- Repairs, reuse, transfer, and disposal follow documented media-handling procedures.
- Lost devices can be reported quickly and investigated with reliable inventory records.
6. Vendors and Business Associate Agreements
- Vendors that create, receive, maintain, or transmit PHI are identified.
- Required BAAs are executed before access or data handling begins.
- Agreements define permitted uses, safeguards, incident reporting, subcontractors, and return or destruction of PHI.
- Vendor access is unique, limited, reviewed, and disabled when no longer needed.
- Cloud and tracking technology use is included in the risk analysis.
7. Privacy operations
- The Notice of Privacy Practices is current, available, and acknowledged as required.
- Patient access, amendment, restriction, and accounting requests follow documented workflows.
- Uses and disclosures are evaluated against permitted purposes and authorization requirements.
- Front-desk, phone, email, texting, and record-release workflows apply appropriate privacy safeguards.
- Complaints are documented and routed without retaliation.
8. Incident response and breach notification
- Staff know how and where to report a suspected incident.
- The response plan assigns technical, privacy, leadership, legal, insurance, and communications roles.
- Evidence is preserved while containment decisions are documented.
- Impermissible uses or disclosures receive the required breach risk assessment.
- Notification decisions, timelines, recipients, and rationale are documented.
- Lessons learned update risk analysis, safeguards, policies, and training.
9. Build a defensible evidence file
Organize risk analyses, risk registers, policies, training records, access reviews, BAAs, backup and restore tests, incident records, breach assessments, device inventories, vulnerability results, and remediation evidence. Assign a record owner and review date so documents do not become stale.
A practical quarterly review can focus on new systems and vendors, open high-risk items, terminated-user access, failed backups, security events, training exceptions, and upcoming policy reviews.
Authoritative resources
- HHS: Security Rule Guidance Material
- HHS: Guidance on Risk Analysis
- HHS: HIPAA Audit Protocol
- HHS: HIPAA Security Rule Notice of Proposed Rulemaking
This educational checklist is not legal advice and does not guarantee compliance. Confirm current requirements and apply them to your organization, contracts, systems, and applicable law.
Related resources
HIPAA Incident Response
Learn More about dental HIPAA incident response