The HIPAA IT checklist for a small practice

A clinic IT assessment should identify risks, responsible people and evidence. A product or a completed checklist does not certify HIPAA compliance. Use this guide to prepare a conversation with your IT provider and compliance adviser.

Start with the practice risk analysis

HHS describes administrative, physical and technical safeguards for electronic protected health information. Risk analysis informs the protections appropriate to the organization. Technical work supports this process; it does not replace policies, training or legal advice.

Questions to bring to an IT assessment

• Which systems store or transmit patient information, and who maintains the inventory?
• Who approves staff access, and how is access removed when a person leaves?
• Which devices leave the office, and how are they protected?
• Who can retrieve activity logs and investigate an incident?
• Which backups have been restored successfully, and who records the test?
• Which vendors handle patient information, and which business associate agreements are needed?

Agree a practical work scope

For each identified issue, ask for an owner, proposed action and evidence of completion. Bring system names and vendor contacts to the discussion; do not put patient records or passwords in a website inquiry. Net-Tech can discuss the business network, access and backup work your practice needs. Confirm BAA requirements and responsibilities before granting access.

Request a practice IT assessment

Net-Tech serves commercial customers within 100 miles of New Albany, Mississippi. Describe your practice location, number of sites and the system concerns you want assessed. Scheduling, scope and any travel arrangements are agreed before work begins.