What Is Protected Health Information?

Protected Health Information, commonly called PHI, includes health-related information that can identify an individual. HIPAA requires organizations to protect PHI whether it is stored, transmitted, archived, printed, backed up, or accessed remotely.

• Patient names
• Dates of birth
• Medical record numbers
• Insurance information
• Billing records
• Diagnosis information
• Treatment records
• Prescription data
• Lab results
• Contact information tied to patient records

HIPAA Security Checklist

Need help reviewing your HIPAA security posture? Contact us for a free HIPAA compliance consultation and speak with an experienced healthcare cybersecurity professional.

1. Administrative Safeguards

• Perform regular HIPAA security risk assessments.
• Document vulnerabilities, risks, and remediation plans.
• Assign a HIPAA Security Officer or responsible security leader.
• Maintain written security policies and procedures.
• Review and update policies at least annually.
• Define acceptable use, remote access, password, retention, and disposal policies.
• Maintain Business Associate Agreements with vendors handling PHI.
• Establish incident response and breach notification procedures.

2. User Awareness Program

• Provide HIPAA security awareness training for all workforce members.
• Train employees to recognize phishing, ransomware, and social engineering attacks.
• Educate users on proper handling of PHI and ePHI.
• Conduct periodic security refresher training.
• Run phishing simulations and awareness campaigns.
• Train remote workers on secure access and device protection.

3. Workforce Security and Access Management

• Use role-based access control for systems containing PHI.
• Apply least-privilege access principles.
• Approve, review, and revoke access using documented procedures.
• Remove user access immediately when employees leave the organization.
• Monitor privileged accounts and administrator activity.
• Review inactive accounts and disable unnecessary access.

Technical Safeguards

Technical safeguards protect electronic PHI through cybersecurity controls, authentication, encryption, logging, monitoring, and system hardening.

Network Infrastructure Security

Network infrastructure must be secured to prevent unauthorized access to systems that store, process, or transmit PHI.

The team at OCsecurityAudit helps healthcare organizations evaluate firewall security, segmentation, remote access, vulnerability management, and network monitoring to improve HIPAA compliance readiness.

• Deploy and maintain enterprise firewalls.
• Segment networks to limit access to sensitive systems.
• Separate guest Wi-Fi from internal business networks.
• Secure wireless networks with strong encryption.
• Use VPNs or secure remote access tools.
• Disable insecure protocols and unnecessary services.
• Conduct internal and external vulnerability scans.
• Perform penetration testing where appropriate.
• Review firewall rules and exposed internet-facing services.
• Monitor network traffic for suspicious behavior.

PHI Data Security

PHI must be protected throughout its entire lifecycle, including creation, storage, transmission, backup, retention, and secure disposal.

Data at Rest

• Encrypt databases, file shares, servers, and cloud storage containing PHI.
• Restrict database and storage access to authorized users only.
• Secure archival systems and long-term storage locations.
• Apply file integrity monitoring where needed.
• Protect laptops, workstations, and portable storage devices.

Data in Transit

• Encrypt PHI transmitted through email, portals, APIs, and file transfers.
• Use secure protocols such as TLS, HTTPS, SFTP, or VPN tunnels.
• Validate SSL/TLS certificates.
• Protect APIs with authentication, authorization, and encryption.
• Use secure patient portals instead of unsecured email when possible.

Data Retention and Disposal

• Maintain written PHI retention policies.
• Define how long different categories of PHI must be retained.
• Securely archive records that must be preserved.
• Shred paper records when disposal is authorized.
• Wipe, sanitize, or destroy electronic media before disposal.
• Maintain documentation of data destruction activities.

Backup and Disaster Recovery

HIPAA security planning should include reliable backup, recovery, and continuity procedures to ensure PHI remains available during outages, cyberattacks, natural disasters, or system failures.

Visit our HIPAA Compliance Consulting services page to learn how we help healthcare providers strengthen backup security, disaster recovery planning, and PHI protection.

• Perform regular backups of systems containing PHI.
• Encrypt backup data at rest and in transit.
• Restrict access to backup systems.
• Store backups in secure, resilient locations.
• Test backup restoration procedures regularly.
• Monitor backup success and failure alerts.
• Maintain immutable or offline backups where possible.
• Define recovery time objectives and recovery point objectives.
• Document disaster recovery and emergency operations procedures.

Physical Safeguards

Physical safeguards protect facilities, workstations, servers, paper records, and devices that may contain or provide access to PHI.

• Restrict access to offices, server rooms, and records storage areas.
• Use badge access, locks, visitor logs, or surveillance where appropriate.
• Secure workstations and laptops from unauthorized physical access.
• Position screens to reduce public viewing of PHI.
• Use automatic screen locks.
• Maintain hardware and device inventory.
• Secure removable media and portable devices.
• Protect systems from environmental risks such as fire, water, and power failure.

Incident Response and Breach Management

• Maintain a written incident response plan.
• Define internal escalation procedures.
• Document breach investigation steps.
• Prepare breach notification procedures.
• Train incident response personnel.
• Conduct tabletop exercises.
• Preserve logs and evidence during security events.
• Review lessons learned after each incident.

Third-Party and Vendor Security

• Identify vendors and business associates that handle PHI.
• Maintain signed Business Associate Agreements.
• Review vendor security controls and compliance posture.
• Assess cloud providers, SaaS platforms, billing vendors, and IT service providers.
• Limit vendor access to the minimum necessary information.
• Monitor third-party access to sensitive systems.
• Review subcontractor and downstream vendor risks.

Common HIPAA Security Gaps

Why Work with OCsecurityAudit?

OCsecurityAudit, under the management of Ali Hassani, helps healthcare organizations become HIPAA compliant through a structured and step-by-step security and compliance process.

With more than 25 years of experience in cybersecurity, system administration, network security, and IT security management, we help hospitals, healthcare providers, clinics, doctor’s offices, and organizations handling PHI strengthen their HIPAA security posture.

• HIPAA risk assessments and gap analysis
• Security assessments and vulnerability assessments
• Administrative safeguard reviews
• Policy and procedure analysis
• Technical and physical control reviews
• Network infrastructure and PHI security evaluations
• Backup, disaster recovery, and data retention reviews
• Guidance for protecting PHI at rest and in transit

Ali Hassani is a CISSP and CISO-certified security expert backed by dozens of industry-standard IT certifications and extensive hands-on operational security experience.

Our goal is to help your organization avoid the common compliance gaps that lead to HIPAA violations while improving your cybersecurity readiness and protecting sensitive patient information.

Ready to improve your HIPAA compliance program? Contact OCsecurityAudit for a free HIPAA compliance consultation and speak with an experienced cybersecurity professional today.