If you run a small medical or dental practice — even just 2-10 employees — HIPAA compliance isn't optional. The Health Insurance Portability and Accountability Act requires any organization that handles protected health information (PHI) to implement specific safeguards. That includes solo practitioners, small clinics, dental offices, chiropractors, therapists, and any business that deals with patient health records.
The challenge for small practices: HIPAA was written with large hospitals in mind, and the regulations can feel overwhelming when you don't have a compliance department. This guide breaks down practical safeguards in plain language, then points you to the wider small-business security checklist and email-security guidance for controls that support the wider practice environment.
Important Disclaimer
This guide provides general information about HIPAA requirements. It is not legal advice. HIPAA regulations change, and your specific requirements may vary based on your practice type and state. Consult a healthcare attorney for advice specific to your situation.
What Is PHI?
Protected Health Information (PHI) is any individually identifiable health information. This includes:
- Patient names, addresses, dates of birth, SSNs
- Medical records, diagnoses, treatment plans
- Insurance information and billing records
- Lab results and imaging
- Appointment records
- Any information that could be used to identify a patient in connection with their health
If you create, receive, maintain, or transmit PHI in any form (paper, electronic, verbal), HIPAA applies to you.
The 3 HIPAA Safeguards You Must Implement
1. Administrative Safeguards
These are the policies and procedures that govern how you handle PHI:
- Designate a Privacy Officer and Security Officer. These can be the same person (often the practice owner or office manager). This person is responsible for implementing and maintaining HIPAA compliance.
- Conduct a Risk Assessment. Identify where PHI is stored, transmitted, and accessed. Assess vulnerabilities. This is the foundation of your entire compliance program and must be documented. The HHS provides a free Risk Assessment Tool.
- Develop Written Policies. Create policies for: PHI access and use, breach notification, workstation security, device and media controls, and workforce training. Keep these documented — HHS will ask for them in an audit.
- Train Your Workforce. Every employee who handles PHI must receive HIPAA training upon hiring and annually thereafter. Document the training.
- Execute Business Associate Agreements (BAAs). Any vendor that accesses your PHI (billing service, IT provider, cloud storage, EHR vendor) must sign a BAA. This is a legal requirement, not optional.
- Create a Breach Response Plan. Document the steps you'll take if PHI is compromised, including notification procedures (patients must be notified within 60 days).
2. Technical Safeguards
These are the technology controls that protect electronic PHI (ePHI):
- Access Controls. Each user must have a unique login. No shared accounts. Implement role-based access so staff can only access the PHI they need for their job. NordLayer Business includes password management and access controls suitable for small practices.
- Audit Logs. Your EHR and other systems must log who accessed what, when, and from where. Review these logs regularly for unauthorized access.
- Encryption. All ePHI must be encrypted both in transit and at rest. This means: encrypted email for patient communications, encrypted storage for patient records, encrypted backups. BitLocker (Windows) and FileVault (Mac) provide full-disk encryption.
- Automatic Logoff. Systems must automatically log off after a period of inactivity. This prevents unauthorized access when a workstation is left unattended.
- Multi-Factor Authentication. Require MFA for all accounts that access ePHI. This is one of the most effective security controls and is increasingly expected by HHS auditors.
- Endpoint Protection. All devices that access ePHI need real-time malware protection. Verify current coverage, administration, logging, and whether any required vendor agreement is available.
3. Physical Safeguards
These control physical access to systems and facilities where PHI is stored:
- Workstation security. Position screens away from public areas. Use privacy screens. Lock workstations when unattended (Windows key + L).
- Facility access controls. Server rooms and offices where paper records are stored should be locked. Limit access to authorized personnel only.
- Device and media controls. Track all devices that store PHI. Have a process for securely disposing of old devices (wipe or destroy hard drives). Don't throw old computers in the dumpster.
- Paper record security. Paper records containing PHI must be stored in locked cabinets. Shred (not trash) documents when disposing of them.
Protect Patient Data with Practical Safeguards
Use the safeguards in this guide to identify owners, evidence, and questions for your compliance and security advisors.
Jump to the safeguards checklist →The HIPAA Risk Assessment (Start Here)
Your risk assessment is the foundation of compliance. Here's how to conduct one:
- Identify all PHI. Map where PHI is created, received, stored, and transmitted. Include EHR systems, email, paper records, billing systems, backups, and any cloud services.
- Identify threats and vulnerabilities. Consider: ransomware, phishing, lost devices, unauthorized access, natural disasters, and vendor breaches.
- Assess current security measures. What protections do you already have? Where are the gaps?
- Determine risk level. Rate each vulnerability by likelihood and impact. Focus on high-likelihood, high-impact risks first.
- Develop a remediation plan. Prioritize fixing the highest risks. Document your plan and timeline.
- Document everything. HHS wants to see your written risk assessment. A documented plan shows good faith effort even if you haven't fixed everything yet.
HIPAA Compliance Checklist for Small Practices
Common HIPAA Mistakes Small Practices Make
- Using personal email for patient communication. Personal email may not provide the safeguards your practice needs; review your HIPAA obligations with qualified counsel. Use encrypted email services designed for healthcare.
- No Business Associate Agreements. Your IT guy, your billing service, your cloud storage — if they touch PHI, they need a BAA.
- Shared login credentials. Every person needs their own login. "Frontdesk" is not a valid username.
- Unencrypted devices. A stolen laptop with unencrypted patient records is a reportable breach. Enable full-disk encryption on every device.
- Ignoring the risk assessment. You can't fix what you haven't identified. The risk assessment is not optional — it's the first thing HHS asks for.
How We Review Products
Small Business Security Guide is fully independent. We use structured editorial comparison based on documented vendor information and independently published sources. We record the review focus and last-reviewed date, and readers should verify current features and pricing with the provider. We may earn a commission if you sign up through our links, but commercial partnerships never influence our editorial scoring.
Don't Wait for an Audit
Security products may support parts of a compliance program, but no product makes a practice compliant by itself. Document your safeguards, assign owners, and review the result with qualified counsel.
Review the safeguards checklist →