HIPAA IT Checklist for Small Medical and Dental Practices

If you run a small medical, dental, therapy or chiropractic practice, HIPAA can feel like something written for hospitals with an IT department and a compliance officer. It isn't. The HIPAA Security Rule applies to practices of every size that handle patient information electronically, and for most offices today that means almost everything: the EHR or practice management system, email, scanned documents, imaging, billing and the laptops and phones that connect to them.

The good news is that the rule doesn't expect a five-person practice to run like a hospital. It expects you to understand your own risks and take reasonable steps to reduce them. This checklist covers the IT side of that work in plain language. It isn't legal advice, and it doesn't replace the privacy and paperwork side of HIPAA, but it is where most small practices have the biggest gaps.

Where the rules stand right now

The Security Rule that is in effect today hasn't changed in years. In January 2025, the U.S. Department of Health and Human Services (HHS) proposed a major update that would make several safeguards more explicit, including multi-factor authentication, encryption, an up-to-date inventory of technology and regular testing of backups (Federal Register: HIPAA Security Rule proposed rule).

That proposal is not final. In July 2026, HHS moved it to its list of long-term actions, with a target date of July 2027 (LeadingAge: No action expected on HIPAA cybersecurity rule in the coming year). So nothing new is required yet. But waiting is a poor strategy: the items in the proposal are the same basics that protect a practice from ransomware and email fraud today, and they are what investigators already look for after a breach.

Why the risk analysis comes first

The Office for Civil Rights (OCR), the part of HHS that enforces HIPAA, has run a Risk Analysis Initiative focused on one question: did the organization do an accurate and thorough risk analysis? In one settlement with a small neurology practice that was hit by ransomware, OCR said the practice had failed to conduct one (HHS press release: Comprehensive Neurology settlement).

A risk analysis is simply a written review of where your electronic patient information is, what could go wrong with it, what protections you already have and what you plan to fix. HHS explains what it should cover in its guidance on risk analysis, and offers a free Security Risk Assessment Tool designed for small and medium providers. Everything else on this checklist should flow from it.

The HIPAA IT checklist for small practices

1. Do the risk analysis, and write it down

Cover every place patient data lives, rate each risk, and list what you'll do about it and by when. Keep the document, and revisit it whenever something changes: a new EHR, a new office, staff turnover or a security incident.

2. Know where patient data lives

Make a simple inventory of every system and device that stores or touches patient information: the EHR and practice management system, email, file shares, imaging and X-ray software, scanners and copiers that store images, laptops, tablets, staff phones that get work email, and any cloud apps for forms, scheduling or payments. You can't protect what you don't know about.

3. Sign business associate agreements

Every vendor that creates, receives, stores or sends patient information for you needs a business associate agreement (BAA): your EHR vendor, billing company, cloud email provider, backup service and IT provider. Check that the email and file-sharing service you use actually offers a BAA on the plan you're paying for. Free personal email accounts are not the place for patient information.

4. Give everyone their own login, protected with MFA

Shared front-desk logins make it impossible to know who looked at a record, and they're easy to abuse. Give each person their own account with access only to what their job needs, and turn on multi-factor authentication for email, the EHR and remote access. Our guide on rolling out MFA without frustrating your staff walks through how to do it.

5. Encrypt laptops, phones and email

A lost or stolen laptop with an encrypted drive is a much smaller problem than one without. Turn on full-disk encryption (BitLocker on Windows, FileVault on Mac), require a passcode and remote-wipe on phones that get work email, and use encrypted email whenever patient information leaves the office.

6. Keep systems updated, and retire what's unsupported

Set computers, servers, firewalls and Wi-Fi equipment to receive security updates, and check that they're actually installing. Systems that no longer get updates, such as PCs still running Windows 10 without Extended Security Updates, are an open door. See Still on Windows 10? for options.

7. Use modern endpoint and email protection

Basic antivirus isn't enough on its own anymore. Endpoint detection and response (EDR) watches for ransomware-like behavior and can isolate a computer before the damage spreads. Email filtering, plus SPF, DKIM and DMARC on your domain, cuts down on phishing and lookalike emails. We explain those three in SPF, DKIM and DMARC explained.

8. Keep backups you have actually tested

HIPAA expects a contingency plan, which includes data backup and a way to recover. Keep at least one backup copy that ransomware can't reach or change, protect cloud data like Microsoft 365 as well as local servers, and test a real restore on a schedule. Our article on Microsoft 365 backup explains why the cloud doesn't back itself up the way most people assume.

9. Review access and remove it quickly

When someone leaves, disable their accounts the same day, collect their devices and change any shared codes they knew. Every few months, review who has access to what, and make sure the audit logs in your EHR and email are turned on and kept.

10. Train your staff, briefly and often

Most incidents start with a person: a convincing phishing email, a fake invoice or a phone call pretending to be IT. Short, regular training works better than one long session a year. Make sure everyone knows how to spot fake invoice and payment-change emails, and who to call when something looks wrong.

11. Write down your policies and your incident plan

HIPAA expects written security policies and procedures. Keep them short and true to how your office works. Include a one-page incident plan: who to call, how to disconnect an affected computer, who decides whether a breach must be reported and how to reach your IT provider, insurer and attorney after hours.

12. Don't forget the physical side

Lock the room or closet where servers and network equipment live, position screens so patients can't read them, set computers to lock automatically when unattended, and keep the guest Wi-Fi in the waiting room completely separate from the network your clinical systems use.

How CyberArm can help

We help small practices in Lake Mary, Orlando and across Central Florida with the IT side of HIPAA: the risk analysis, the technical safeguards in our cybersecurity packages (MFA, EDR, email protection and monitoring), and HIPAA readiness work that prepares your environment, policies and evidence. Backup is a separate add-on that we set up, monitor and test for you. This is readiness work, not a formal audit, and we work alongside your compliance advisor or attorney on the legal side.

The bottom line

HIPAA's IT requirements come down to knowing your risks and handling the basics well: a documented risk analysis, business associate agreements, individual logins with MFA, encryption, updates, tested backups and trained staff. The proposed update isn't final, but practices that cover these basics now will be ready for it. If you'd like to know where your practice stands, our free IT and security assessment reviews your systems and gives you a written Executive Summary with the fixes that matter most.