HIPAA IT COMPLIANCE CHECKLIST
Simply IT — 2026
0 / 48 Complete
Compliance Progress0%
Access Control & Authentication
HIPAA Required
0/7
Unique user IDs assigned to every employee — no shared logins
Multi-Factor Authentication (MFA) enabled on all systems accessing PHI
Automatic logoff enabled after period of inactivity (recommended 15 minutes)
Role-based access — employees only access PHI required for their job
Emergency access procedure documented and tested
Terminated employee accounts disabled within 24 hours of departure
Password policy enforced — minimum length complexity and expiration
Device & Endpoint Security
HIPAA Required
0/7
All devices with access to PHI inventoried and tracked
Business-grade endpoint security installed on all computers and laptops
Full disk encryption enabled on all laptops and mobile devices
Remote wipe capability enabled on mobile devices accessing PHI
Screen lock required on all devices accessing PHI
Personal devices prohibited from accessing PHI without MDM enrollment
Workstations positioned to prevent unauthorized viewing of PHI
Email & Communication Security
HIPAA Required
0/6
PHI never transmitted via unencrypted standard email
Secure encrypted email or patient portal used for PHI transmission
Email filtering in place to block phishing and malicious attachments
Business Associate Agreement (BAA) in place with email provider (Microsoft/Google)
Staff trained on identifying phishing emails targeting healthcare organizations
Email retention policy documented and enforced
Data Backup & Disaster Recovery
HIPAA Required
0/7
Automated daily backups of all systems containing PHI
Backups stored in separate location from primary data (offsite or cloud)
Backup restoration tested at minimum quarterly
Recovery Time Objective (RTO) and Recovery Point Objective (RPO) documented
Ransomware-resistant backup solution in place (immutable backups)
EHR/EMR system backup verified independently of vendor backup claims
Business continuity plan documented for technology outages
Network Security
HIPAA Required
0/7
Business-grade firewall installed and actively managed
Guest WiFi network separate from clinical/business network
Network access control — only authorized devices can connect
Network security assessment completed in last 12 months
VPN required for remote access to practice systems
Medical devices (imaging equipment etc.) on isolated network segment
Wireless networks using WPA3 or WPA2-Enterprise encryption
Audit Controls & Monitoring
HIPAA Required
0/7
Audit logs enabled on all systems accessing PHI
Audit logs reviewed regularly for unauthorized access attempts
Audit logs retained for minimum 6 years per HIPAA requirements
System activity monitoring in place to detect abnormal behavior
Failed login attempt alerts configured
Business Associate Agreements in place with ALL vendors accessing PHI
HIPAA Security Risk Assessment completed and documented within last 12 months
Incident Response & Training
HIPAA Required
0/7
All staff completed HIPAA Security Awareness Training within last 12 months
New employee HIPAA training completed before accessing PHI
Security incident response plan documented and tested
Breach notification procedures documented — 60-day HHS notification requirement understood
Ransomware response plan specifically documented
Staff know who to contact immediately if they suspect a breach
Annual HIPAA training completion records maintained
// Need Help?
ANY BOXES YOU COULDN'T CHECK?
Simply IT provides HIPAA-compliant managed IT services for medical and dental practices across North Central Florida. We can help you address every gap on this checklist.
Schedule a Free Assessment →// Learn More
HIPAA IT FOR MEDICAL PRACTICES.
See how Simply IT helps medical and dental practices across Ocala, The Villages, and Gainesville achieve and maintain HIPAA compliance.
Learn About HIPAA IT →WANT HELP WITH ANY ITEMS YOU COULDN'T CHECK?
Enter your details and a Simply IT HIPAA specialist will follow up within one business day with specific guidance for your practice. No obligation.
We follow up once with personalized advice. No spam.
//Also Relevant For
SERVING HEALTHCARE PRACTICES
ACROSS NORTH CENTRAL FLORIDA.
//Frequently Asked Questions
COMMON QUESTIONS
ABOUT HIPAA IT COMPLIANCE.
WANT HELP WITH YOUR RESULTS?
Our team reviews every submission personally and responds within one business day — no obligation.
Or call us directly: 352-723-5003