HIPAA Readiness
Translate HIPAA compliance requirements for small medical practices into clear scope, owned controls, current evidence, practical remediation, and a readiness position the organization can support.
CISO-led guidance from Ali Hassani, backed by 25+ years of IT, cybersecurity, compliance, and infrastructure experience.
A small practice still needs a complete view of where ePHI is created, received, maintained, and transmitted. The video helps practice managers define the boundary before recurring tasks, owners, evidence, and review frequencies are assigned.
Presented by Ali Hassani, CISO and cybersecurity consultant, with 25+ years of IT, cybersecurity, compliance, infrastructure, and healthcare technology experience.
A small practice rarely has a large compliance department. The program must fit real clinical work while still producing defensible decisions and evidence. Following one operating day exposes the handoffs where patient information is copied, discussed, printed, transmitted, and left waiting.
Confirm who unlocks the office, starts workstations, handles overnight messages, reviews failed backups or security alerts, and activates downtime procedures. Shared opening accounts, unattended screens, unreviewed alerts, and unclear recovery authority create risk before the first patient arrives.
Observe registration, ID and insurance scanning, portal enrollment, phone verification, interpreter access, front-desk conversations, paper forms, and queue visibility. Compare workforce roles with actual EHR, scheduling, billing, and file-share permissions.
Trace lab orders, imaging, prescriptions, referrals, prior authorizations, faxing, secure messaging, email, and patient-directed transmission. Identify manual workarounds, downloaded reports, misaddress risk, failed interface queues, and the people responsible for reconciling them.
Look for printed schedules, labels, intake sheets, voicemail notes, exports, local downloads, unlocked cabinets, remote sessions, portable media, and uncompleted chart work. Define closing checks that are short enough to perform and specific enough to record.
Daily checks might cover backups, alerts, physical closure, and failed interfaces. Monthly work can cover user changes, privileged access, vendor access, incidents, and unresolved risks. Quarterly reviews can examine access, restore exercises, phishing training, and policy exceptions. Annual work should refresh risk analysis, inventories, BAAs, policies, training, contingency assumptions, and leadership approval—plus event-driven review after major change.
Use a single workforce change process covering EHR, scheduling, billing, e-prescribing, Microsoft 365, file shares, VPN, remote support, physical access, portals, and vendor accounts. Require role approval, unique identity, prompt termination, privileged-account review, and evidence that access actually changed.
Maintain ownership, location, operating system, encryption, endpoint protection, patch status, local PHI, remote access, backup, support status, and disposal for workstations, laptops, tablets, phones, servers, diagnostic devices, and appliances. Include new purchases before they reach patient care.
Before purchase, determine PHI scope, BAA need, security evidence, authentication, support access, backup responsibility, incident notice, subcontractors, and exit options. During operation, review material changes and issues. At termination, export and validate data, remove access, and obtain appropriate return or destruction confirmation.
Give every finding an owner, due date, risk basis, interim protection, evidence requirement, and approval. Track overdue actions openly. Exceptions should expire unless leadership reviews the current facts and accepts continued residual risk.
A small practice may rely on an IT provider, EHR vendor, privacy consultant, billing service, or legal counsel. Define which decisions remain with leadership, who can authorize access or downtime, who preserves evidence, who contacts insurance and counsel, and who verifies that contracted tasks were completed.
A focused video briefing for leaders and IT teams working through this page.
HIPAA Compliance Video Series · Episode 11
Use this concise briefing alongside the guidance on this page to connect hipaa accountability with clear evidence, accountable ownership, and a practical next action.
A small medical practice needs a current security risk analysis, risk management plan, written policies, assigned security responsibility, workforce training, access authorization, termination process, audit-log review, contingency planning, backup testing, incident response, facility controls, device controls, and vendor oversight.
The practice should know where ePHI is created, received, maintained, and transmitted. This includes the EHR, billing platform, lab portal, e-prescribing, email, scanner folders, local downloads, cloud drives, backup systems, mobile devices, and legacy servers.
Common gaps include shared user accounts, inactive accounts left enabled, missing MFA, unencrypted laptops, weak backup testing, no written incident-response plan, unmanaged medical devices, unsupported Windows systems, cloud storage outside policy, and vendor access that is not reviewed.
Another frequent weakness is evidence. Staff may be doing some correct work, but there is no documented proof of training, access reviews, backup tests, risk decisions, vendor reviews, or remediation ownership.
Collect EHR user lists, Microsoft 365 admin settings, MFA status, endpoint encryption proof, antivirus/EDR status, firewall configuration, backup job reports, restore-test records, security awareness training logs, BAAs, device inventory, network diagram, vulnerability scan results, policies, incident logs, and risk acceptance notes.
Keep evidence organized by safeguard category so leadership can see where compliance, cybersecurity, and operations connect.
Review intake forms, portal invitations, eligibility checks, photo IDs, insurance cards, call recordings, voicemail, text reminders, printed schedules, kiosk use, and conversations at reception. Confirm screen positioning, privacy, secure disposal, and role-based access.
Map EHR notes, e-prescribing, lab and imaging interfaces, medical device exports, referral records, telehealth, mobile workstations, emergency access, shared treatment rooms, and downtime procedures.
Trace claims, remittance, clearinghouse files, coding, collections, payment portals, spreadsheet work queues, remote billers, and report exports. Restrict downloads and verify vendor and subcontractor access.
Review Microsoft 365, endpoints, local servers, cloud drives, backups, remote support, privileged accounts, patching, vulnerability management, logging, incident response, and staff termination.
Monthly work can include failed-backup review, endpoint and vulnerability exceptions, privileged-account changes, and security incidents. Quarterly work can include user-access certification, vendor-access review, phishing or awareness reinforcement, restore testing, and risk-register updates. Annual work should include risk-analysis refresh, policy approval, workforce training, contingency and incident exercises, BAA inventory review, asset reconciliation, and leadership review.
Frequency should follow risk, legal requirements, system changes, incidents, and policy—not a generic calendar alone. Every review should create a dated record showing reviewer, scope, exceptions, decisions, and follow-up ownership.
Prioritize unsupported clinical systems, exposed remote access, missing MFA, shared accounts, unencrypted portable devices, ineffective backups, absent incident procedures, and vendor access that cannot be attributed. Then address evidence gaps, policy mismatch, training quality, and longer-term architecture. Technical implementation support may follow through Managed IT Services or Backup and Disaster Recovery Support when those services directly match the remediation plan.
Use the federal guidance to build proportionate processes; do not confuse limited staff with limited responsibility.
HHS explains the foundational risk-analysis requirement and common implementation considerations. Read HHS risk-analysis guidance
NIST provides implementation activities that practices can adapt to their size, complexity, and risks. Use NIST SP 800-66r2
Yes. A security risk analysis is a foundational HIPAA Security Rule expectation for regulated entities.
Yes. Email, OneDrive, SharePoint, Teams, and admin access may all touch ePHI or business operations tied to PHI.
Start with PHI inventory, user access, MFA, backup and restore testing, endpoint encryption, vendor access, and incident-response readiness.
OC Security Audit can help a small medical practice identify ePHI, evaluate realistic threats, review safeguards, assign ownership, and build evidence without burying staff in a generic enterprise template.
IT Perfection can support technical follow-through for Microsoft 365, endpoints, backups, servers, networks, monitoring, patching, and help desk operations when findings require implementation.
