If you run a small medical or dental practice — even just 2-10 employees — HIPAA compliance isn't optional. The Health Insurance Portability and Accountability Act requires any organization that handles protected health information (PHI) to implement specific safeguards. That includes solo practitioners, small clinics, dental offices, chiropractors, therapists, and any business that deals with patient health records.
The challenge for small practices: HIPAA was written with large hospitals in mind, and the regulations can feel overwhelming when you don't have a compliance department. This guide breaks down exactly what you need to do, in plain language.
Important Disclaimer
This guide provides general information about HIPAA requirements. It is not legal advice. HIPAA regulations change, and your specific requirements may vary based on your practice type and state. Consult a healthcare attorney for advice specific to your situation.
What Is PHI?
Protected Health Information (PHI) is any individually identifiable health information. This includes:
- Patient names, addresses, dates of birth, SSNs
- Medical records, diagnoses, treatment plans
- Insurance information and billing records
- Lab results and imaging
- Appointment records
- Any information that could be used to identify a patient in connection with their health
If you create, receive, maintain, or transmit PHI in any form (paper, electronic, verbal), HIPAA applies to you.
The 3 HIPAA Safeguards You Must Implement
1. Administrative Safeguards
These are the policies and procedures that govern how you handle PHI:
- Designate a Privacy Officer and Security Officer. These can be the same person (often the practice owner or office manager). This person is responsible for implementing and maintaining HIPAA compliance.
- Conduct a Risk Assessment. Identify where PHI is stored, transmitted, and accessed. Assess vulnerabilities. This is the foundation of your entire compliance program and must be documented. The HHS provides a free Risk Assessment Tool.
- Develop Written Policies. Create policies for: PHI access and use, breach notification, workstation security, device and media controls, and workforce training. Keep these documented — HHS will ask for them in an audit.
- Train Your Workforce. Every employee who handles PHI must receive HIPAA training upon hiring and annually thereafter. Document the training.
- Execute Business Associate Agreements (BAAs). Any vendor that accesses your PHI (billing service, IT provider, cloud storage, EHR vendor) must sign a BAA. This is a legal requirement, not optional.
- Create a Breach Response Plan. Document the steps you'll take if PHI is compromised, including notification procedures (patients must be notified within 60 days).
2. Technical Safeguards
These are the technology controls that protect electronic PHI (ePHI):
- Access Controls. Each user must have a unique login. No shared accounts. Implement role-based access so staff can only access the PHI they need for their job. NordLayer Business includes password management and access controls suitable for small practices.
- Audit Logs. Your EHR and other systems must log who accessed what, when, and from where. Review these logs regularly for unauthorized access.
- Encryption. All ePHI must be encrypted both in transit and at rest. This means: encrypted email for patient communications, encrypted storage for patient records, encrypted backups. BitLocker (Windows) and FileVault (Mac) provide full-disk encryption.
- Automatic Logoff. Systems must automatically log off after a period of inactivity. This prevents unauthorized access when a workstation is left unattended.
- Multi-Factor Authentication. Require MFA for all accounts that access ePHI. This is one of the most effective security controls and is increasingly expected by HHS auditors.
- Endpoint Protection. All devices that access ePHI need real-time malware protection. Webdefend Business provides this for your entire practice, including ransomware detection.
3. Physical Safeguards
These control physical access to systems and facilities where PHI is stored:
- Workstation security. Position screens away from public areas. Use privacy screens. Lock workstations when unattended (Windows key + L).
- Facility access controls. Server rooms and offices where paper records are stored should be locked. Limit access to authorized personnel only.
- Device and media controls. Track all devices that store PHI. Have a process for securely disposing of old devices (wipe or destroy hard drives). Don't throw old computers in the dumpster.
- Paper record security. Paper records containing PHI must be stored in locked cabinets. Shred (not trash) documents when disposing of them.
Protect Patient Data with Webdefend
Starting at $29/month — HIPAA-aligned security including endpoint protection, encrypted backups, and 24/7 monitoring for your practice
Start Free TrialThe HIPAA Risk Assessment (Start Here)
Your risk assessment is the foundation of compliance. Here's how to conduct one:
- Identify all PHI. Map where PHI is created, received, stored, and transmitted. Include EHR systems, email, paper records, billing systems, backups, and any cloud services.
- Identify threats and vulnerabilities. Consider: ransomware, phishing, lost devices, unauthorized access, natural disasters, and vendor breaches.
- Assess current security measures. What protections do you already have? Where are the gaps?
- Determine risk level. Rate each vulnerability by likelihood and impact. Focus on high-likelihood, high-impact risks first.
- Develop a remediation plan. Prioritize fixing the highest risks. Document your plan and timeline.
- Document everything. HHS wants to see your written risk assessment. A documented plan shows good faith effort even if you haven't fixed everything yet.
HIPAA Compliance Checklist for Small Practices
- Privacy Officer and Security Officer designated
- Risk assessment completed and documented
- Written HIPAA policies and procedures in place
- All workforce members trained (documented)
- Business Associate Agreements signed with all vendors
- Unique user logins for all systems
- Multi-factor authentication enabled
- All devices encrypted (full-disk encryption)
- PHI encrypted in transit (email, file transfer)
- Automatic logoff configured on all workstations
- Endpoint protection on all devices
- Audit logs enabled and reviewed regularly
- Automatic daily backups with encryption
- Physical access controls in place
- Breach response plan documented
- Paper records secured in locked storage
- Document disposal process (shredding)
Common HIPAA Mistakes Small Practices Make
- Using personal email for patient communication. Personal Gmail, Yahoo, and Outlook accounts are not HIPAA-compliant. Use encrypted email services designed for healthcare.
- No Business Associate Agreements. Your IT guy, your billing service, your cloud storage — if they touch PHI, they need a BAA.
- Shared login credentials. Every person needs their own login. "Frontdesk" is not a valid username.
- Unencrypted devices. A stolen laptop with unencrypted patient records is a reportable breach. Enable full-disk encryption on every device.
- Ignoring the risk assessment. You can't fix what you haven't identified. The risk assessment is not optional — it's the first thing HHS asks for.
About Our Security Experts
The Small Business Security Guide editorial team is composed of independent cybersecurity analysts, risk assessment consultants, and technology writers. We focus exclusively on making enterprise-level security simple and accessible for small businesses. Our recommendations are entirely independent and based on rigorous, real-world testing of tools and security practices.
How We Review Products
Small Business Security Guide is fully independent. We evaluate security software over a 4-week testing protocol on dedicated business systems, measuring protection capability, system speed impact, setup complexity, and overall cost-per-device value. We may earn a commission if you sign up through our links, but commercial partnerships never influence our editorial scoring.
Don't Wait for an Audit
HHS audits small practices, and penalties for HIPAA violations can reach $1.5 million per violation category per year. Webdefend Business helps you meet the technical safeguard requirements with endpoint protection, encrypted backups, and 24/7 monitoring.
Start Your Free TrialFrequently Asked Questions
Do I need HIPAA compliance if I'm not a healthcare provider?
If you handle Protected Health Information (PHI) for patients - even as a dental office, massage therapy practice, wellness coach, or billing service - HIPAA applies to you. PHI includes any information that can identify a patient and relates to their health condition, treatment, or payment. This includes appointment schedules, treatment notes, lab results, and even patient photos. If in doubt, consult a HIPAA compliance expert - the penalties for violations are severe.
What's a Business Associate Agreement (BAA)?
A BAA is a legally binding contract between your practice and any vendor who accesses PHI on your behalf. This includes: cloud storage providers, email services, payment processors, billing services, and even some security vendors. Without a BAA, using these services is a HIPAA violation. Get BAAs from ALL vendors before they access any PHI. Most reputable vendors offer standard BAA templates - review them carefully or consult legal counsel.
How much does HIPAA compliance cost?
Costs vary by practice size. Budget for: (1) Risk assessment ($1,000-5,000), (2) Encryption tools (often included in business software), (3) Staff training ($500-2,000 annually), (4) Compliance monitoring tools ($50-500/month), (5) Legal consultation ($200-500/hour as needed). Many costs are one-time setup costs with ongoing maintenance. The average cost is $10-50 per patient record annually, which is negligible compared to HIPAA violation penalties ($100-$50,000 per record).
What are the HIPAA security rules I need to follow?
HIPAA Security Rule requires: (1) Administrative safeguards - security policies, workforce training, and risk management, (2) Physical safeguards - facility access controls, workstation security, device and media controls, (3) Technical safeguards - access controls, audit controls, integrity controls, transmission security. Key technical measures include: unique user IDs, emergency access procedures, automatic logoff, encryption of PHI at rest and in transit, and regular security reviews.
Can I use consumer cloud services for HIPAA compliance?
No. Consumer cloud services (Dropbox, Google Drive, iCloud) are not HIPAA compliant and cannot sign BAAs. Use HIPAA-compliant alternatives: Google Workspace for Business, Microsoft 365 Business, Box for Business, or specialized healthcare cloud providers. These services offer BAA signing, audit logs, encryption, and compliance certifications. Always verify current compliance status before uploading any PHI.