1
Confirm scope and applicability
Determine regulated status and map PHI/ePHI, systems, workflows, devices, cloud services, locations, and vendors.
HIPAA Readiness
HIPAA Action Plan: Eight Priorities to Verify
Build a practical HIPAA action plan: eight priorities to verify sequence around risk, dependencies, ownership, evidence, and the work the organization can safely complete.
CISO-led guidance from Ali Hassani, backed by 25+ years of IT, cybersecurity, compliance, and infrastructure experience.
Core roadmap
Eight actions that work together
A policy binder alone is not enough. The organization should be able to show how responsibilities, safeguards, evidence, testing, and corrective action operate.
2
Conduct a risk analysis
Assess threats and vulnerabilities affecting the confidentiality, integrity, and availability of every ePHI location.
3
Manage and reduce risk
Prioritize findings, assign owners and deadlines, record decisions, and retain proof that corrective actions were completed.
4
Establish governance
Designate Privacy and Security Officials, approve procedures, manage complaints and sanctions, and retain required documentation.
5
Apply privacy controls
Address minimum necessary use, permitted disclosures, authorizations, Notices of Privacy Practices, and patient rights.
6
Implement security safeguards
Use administrative, physical, and technical controls for access, authentication, logs, integrity, transmission, facilities, and devices.
7
Train people and manage vendors
Use role-based access, workforce training, termination procedures, BAAs, due diligence, and documented vendor oversight.
8
Prepare, respond, and recover
Maintain incident response, breach assessment, notification, backups, disaster recovery, emergency operations, and periodic evaluation.
Implementation references: HHS Security Rule Summary, HHS Risk Analysis Guidance, and NIST SP 800-66 Rev. 2.
Evidence of compliance
Be ready to show that controls operate
Current records should connect policy, responsibility, technical operation, review, correction, and management decisions.
- PHI/ePHI scope, system inventory, and data-flow records
- Current risk analysis and risk-management register
- Approved policies, procedures, revisions, and decisions
- Workforce training, acknowledgments, and access changes
- Vendor inventory, due diligence, and executed BAAs
- Access approvals, reviews, audit logs, and terminations
- Configuration, patching, vulnerability, and safeguard evidence
- Backup results, restore tests, and recovery exercises
- Incident assessments, notifications, and lessons learned
- Periodic evaluations and remediation tracking
Review rhythm
Keep the program current
HIPAA does not set one universal risk-analysis frequency. Review cadence should respond to the organization's environment, changes, and risk.
Continuous or monthly
Security alerts, vulnerabilities, patch status, backup results, access events, and corrective actions.
Quarterly
Access reviews, vendor follow-up, remediation status, selected control tests, and evidence completeness.
Annually and after change
Update risk analysis as appropriate, review procedures and training, test contingency plans, and perform periodic evaluation.
Small medical practices can continue with the HIPAA requirements for medical practices; dental teams can use the HIPAA compliance guide for dental offices.
Turn the action plan into verified work
OC Security Audit can assess safeguards, review risk and evidence, and perform technical validation such as a network vulnerability assessment or cybersecurity risk assessment where appropriate. A scan is one technical input; it does not independently establish HIPAA compliance. IT Perfection can support healthcare IT implementation and ongoing operations when findings require technical follow-through.