Purpose of This Checklist
You're starting a HIPAA compliance program or restarting one that's lapsed, and you need a concrete action plan to show auditors your efforts began with intention. This checklist documents your initial compliance kickoff during the final quarter of the year, creating a timeline that demonstrates due diligence before January 1.
The timing matters because auditors notice when you started. An organization that launches compliance efforts in December after a breach looks different from one that waits until March of the following year. This checklist gives you a documented framework that aligns your annual risk assessment cycle with the calendar year, eliminating compliance gaps.
Prerequisites
Before you use this checklist, confirm:
- You know your regulatory status. You're either a Covered Entity (healthcare provider, health plan, or clearinghouse) or a Business Associate handling Protected Health Information (PHI) on behalf of a Covered Entity.
- You have executive support. Compliance requires budget and staff time. Get written approval before you start assigning tasks.
- You can dedicate 15-20 hours in Q4. This isn't a one-afternoon project. Spread the work across November and December, using holiday downtimes when clinical or operational volume drops.
The Checklist
Copy this template into your project management system or shared document. Assign owners and target dates for each item.
Phase 1: Establish Accountability (Week 1)
☐ Designate a Privacy Official. Name the person responsible for developing and implementing privacy policies. Document the appointment in writing with role description and authority level.
☐ Designate a Security Official. Name the person responsible for developing and implementing security measures. This can be the same person as the Privacy Official in smaller organizations, but document the dual role explicitly.
☐ Create a compliance working group. Identify representatives from IT, HR, operations, and clinical leadership. Schedule a 30-minute kickoff meeting before December 15.
☐ Set your annual review schedule. Decide now: Will you conduct your annual risk assessment and policy review in Q4 each year, or Q1? Lock in the quarter and add recurring calendar holds for the next three years.
Phase 2: Inventory What You Have (Week 2)
☐ List all locations where PHI exists. Include: EHR systems, billing software, patient portals, email archives, paper charts, backup tapes, mobile devices, and any cloud storage. Create a spreadsheet with system name, vendor, data type, and current access controls.
☐ Identify all Business Associates. List every vendor, contractor, or service provider that creates, receives, maintains, or transmits PHI on your behalf. Include: EHR vendors, billing companies, IT support firms, cloud hosting providers, shredding services, and answering services.
☐ Check for existing Business Associate Agreements (BAAs). Review contracts with each Business Associate. Flag any vendor without a signed BAA, you'll need to obtain one before they touch PHI again.
☐ Document current security measures. What's already in place? List: firewall rules, antivirus software, encryption status for devices and email, password policies, backup procedures, and physical access controls (locks, badge systems, visitor logs).
Phase 3: Conduct Initial Risk Assessment (Weeks 3-4)
The HIPAA Security Rule requires a risk assessment but doesn't prescribe a specific methodology. Use this simplified approach to get started; you can refine it in subsequent years.
☐ For each PHI location identified in Phase 2, answer these questions:
- Who has access? (List roles, not individuals.)
- How is access controlled? (Password? Two-factor authentication? Physical key?)
- Is the data encrypted at rest and in transit?
- Where are backups stored, and who can access them?
- What happens if this system fails or is compromised?
☐ Identify your top five vulnerabilities. Based on the questions above, list the five areas where PHI is most exposed. Common examples: unencrypted laptops, weak passwords, missing audit logs, unsecured paper files, or lack of employee training.
☐ Prioritize remediation. Rank your vulnerabilities by likelihood and impact. Mark at least two as "address in Q1 2024" and assign owners.
☐ Document your assessment. Save your findings in a dated file: "HIPAA_Risk_Assessment_[YourOrgName]_Dec2023.pdf". This becomes your baseline. You'll update it annually.
Phase 4: Implement Recognized Security Practices (Week 4)
The Safe Harbor provision (reflecting changes from HR 7898 implemented in 2017) recognizes that organizations following established cybersecurity frameworks demonstrate stronger compliance. You don't need to achieve full certification, but documenting your alignment helps.
☐ Enable multi-factor authentication (MFA) on at least one critical system. Start with your EHR or email. Document the implementation date and which users are enrolled.
☐ Establish a patch management process. Create a simple log: System | Patch Date | Installed By. Commit to monthly security updates for all PHI-containing systems.
☐ Enable audit logging. Turn on access logs for your EHR and any database containing PHI. Set a calendar reminder to review logs quarterly.
☐ Encrypt one category of PHI. If your laptops aren't encrypted, enable BitLocker (Windows) or FileVault (Mac). If email isn't encrypted, configure TLS. Document what you encrypted and when.
Phase 5: Launch Workforce Training (Week 4)
☐ Schedule annual HIPAA training for all workforce members. "All workforce members" includes employees, volunteers, trainees, and contractors with PHI access. Use the holiday period when clinical schedules lighten.
☐ Create a training completion tracker. Build a spreadsheet: Employee Name | Role | Training Date | Training Method | Acknowledgment Signed. Retain this for six years.
☐ Assign asynchronous training modules. Online courses let staff complete training during downtime between patients or during admin hours. Set a completion deadline of December 31.
☐ Document training content. Save a copy of the training materials you used (slides, videos, handouts) with a version date. You'll need to show auditors what was taught.
Phase 6: Validation and Documentation (Final Week of December)
☐ Compile your compliance evidence folder. Create a digital folder structure:
HIPAA_Compliance_2023/
├── Policies_and_Procedures/
├── Risk_Assessment_Dec2023/
├── Business_Associate_Agreements/
├── Training_Records/
├── Security_Implementation_Evidence/
└── Audit_Logs/
☐ Write a one-page compliance summary. Document: When you started, who's accountable, what you assessed, what you implemented, and what's planned for Q1 2024. Date and sign it. This is your "first impression" document for auditors.
☐ Schedule your Q1 2024 follow-up. Add calendar holds for: remediation of top vulnerabilities, first quarterly log review, and Business Associate Agreement renewals.
Customizing the Checklist
If you're a small practice (1-10 staff): Combine the Privacy Official and Security Official roles. Simplify the risk assessment to a two-page questionnaire. Use a shared spreadsheet instead of a project management system.
If you're a Business Associate: Add a step in Phase 2 to identify which Covered Entities you serve and confirm you have BAAs with each. In Phase 3, assess how you segregate PHI between different client organizations.
If you're a self-funded employer: Your group health plan is a Covered Entity. Focus Phase 2 on enrollment data, claims files, and any wellness program data. Ensure your third-party administrator (TPA) has a signed BAA.
If you became a Covered Entity mid-2023: Adjust your annual review cycle to match your establishment date, or align with the calendar year and accept a short first cycle. Document your reasoning in the compliance summary.
Validation Steps
Before you close out December, verify:
You can answer "yes" to these questions:
- Have you designated a Privacy Official and Security Official in writing?
- Do you have a current risk assessment dated within the last 12 months?
- Have all workforce members with PHI access completed training this year?
- Do you have signed BAAs with every Business Associate?
Your compliance evidence folder contains:
- At least one policy document (even if it's a draft)
- A dated risk assessment with identified vulnerabilities
- Training attendance records with signatures or completion confirmations
- Evidence of at least one security improvement implemented in Q4
You've scheduled your 2024 compliance calendar:
- Annual risk assessment (same quarter next year)
- Quarterly audit log reviews
- Annual workforce training
- Policy review and update cycle
If you can't answer "yes" to all items in step 1, you're not ready to close your kickoff. Prioritize the gaps and extend your timeline into early January, but document why the delay occurred. Auditors care about the explanation.
Starting before year-end doesn't make you fully compliant overnight, but it establishes a compliance timeline that demonstrates intention. When you face your first audit or, worse, respond to a breach, that December start date shows you were building defenses before trouble arrived.
