The HIPAA compliance checklist for private practice

Most “HIPAA compliance” advice is written for IT departments. This is the version for a therapist who just wants to know: what do I actually need, and am I missing anything that could get me fined?

1. 01Confirm whether you are a covered entity
2. 02Complete and document a Security Risk Analysis (required, annual)
3. 03Adopt written Privacy & Security Policies and Procedures
4. 04Provide and post a current Notice of Privacy Practices
5. 05Sign BAAs with every vendor touching client data (EHR, billing, email, scheduling, cloud, AI notes)
6. 06Designate a Privacy Officer and a Security Officer
7. 07Train yourself and staff, and keep a training log plus a sanctions policy
8. 08Set up a breach-notification procedure and log
9. 09Implement basic safeguards: encryption, access controls, unique logins, auto-logoff
10. 10Handle psychotherapy notes under their heightened protection

Where practices most often fail

In OCR enforcement, the recurring deficiencies are a missing or stale risk analysis, vendors without signed BAAs, and impermissible disclosures. The good news: each one maps to a specific document on the list above, which is exactly what the binder produces for you.

Two of those you can knock out right now: item 2 has a live wizard that structures and documents your own risk analysis at Document your Security Risk Analysis, and item 5’s BAAs generate the same way at Generate your BAA.