HIPAA Compliance Checklist: Every Requirement and the Evidence to Prove It

HIPAA isn't one checklist, but it can be turned into one. Below are the requirements, grouped the way the rules are written, with the evidence you'll be asked for.

• ☐ Are you a covered entity (health plan, healthcare provider that bills electronically, or healthcare clearinghouse)?
• ☐ Do you create, receive, store or transmit PHI on behalf of a covered entity or another business associate? If yes, you're a business associate.
• ☐ List every system, vendor and location that stores or processes PHI.

• ☐ Risk analysis: a documented, organisation-wide assessment of risks to electronic PHI. This is the requirement regulators cite most often.
• ☐ Risk management plan: how you'll reduce the risks you found, with owners and dates.
• ☐ Security officer: a named person responsible for the security program.
• ☐ Workforce security: procedures for authorising, supervising and removing access.
• ☐ Security awareness training: for all staff, with records.
• ☐ Incident response procedures: how you identify, respond to and document security incidents.
• ☐ Contingency plan: data backup, disaster recovery and emergency mode operations.
• ☐ Periodic evaluation: a regular review of whether your safeguards still work.
• ☐ Business associate agreements: signed BAAs with every vendor that handles PHI for you.

• ☐ Facility access controls for offices and data centres.
• ☐ Workstation use and security policies.
• ☐ Device and media controls: disposal, re-use and tracking of hardware and storage media.

• ☐ Access control: unique user IDs, emergency access, automatic logoff, and encryption where appropriate.
• ☐ Audit controls: logging of activity on systems with PHI.
• ☐ Integrity controls: protecting PHI from improper change or destruction.
• ☐ Authentication: verifying that users are who they claim to be. Use multi-factor authentication.
• ☐ Transmission security: encryption of PHI in transit.

• ☐ Policies on uses and disclosures of PHI, including the minimum necessary standard.
• ☐ Notice of Privacy Practices (covered entities).
• ☐ Procedures for patient rights requests: access, amendment, accounting of disclosures.
• ☐ Privacy training for staff who handle PHI.

• ☐ A process to assess whether an incident is a reportable breach.
• ☐ Notification to affected individuals without unreasonable delay and within 60 days of discovery.
• ☐ Notification to HHS; for breaches affecting 500 or more people, also to prominent media in the affected state.
• ☐ Business associates: notify the covered entity as your BAA requires.

• ☐ Written policies and procedures for all of the above.
• ☐ Keep documentation for six years from creation or last effective date.
• ☐ Review and update policies when your environment changes.

No. HHS does not certify organisations as HIPAA compliant. When a customer asks for "HIPAA certification", they usually want evidence that you've done the work: a recent risk analysis, policies, BAAs, training records, and often an independent third-party assessment or attestation. For the difference between a HIPAA audit and an AT-C 315 attestation, see HIPAA audit vs AT-C 315.

Many Indian companies (medical billing and coding firms, healthcare BPOs, health-tech product companies and offshore development teams) handle PHI for US clients. They are business associates, and their US clients will expect a signed BAA and evidence of the safeguards above. Building a HIPAA program alongside ISO 27001 or SOC 2 avoids doing the same work twice.