ComplianceCheckup

Compliance Checklist

HIPAA Compliance Checklist (2026)

Authority: U.S. Department of Health & Human Services (HHS)Updated: 2026-01Official source
Disclaimer: This checklist is for informational purposes only and does not constitute legal advice. Compliance requirements vary by jurisdiction, business type, and circumstances. Always consult a qualified attorney or compliance professional before making compliance decisions.
0%
0 of 30 items complete

Privacy Rule

45 CFR §164.530(a)Official source
45 CFR §164.520Official source
45 CFR §164.530(i)Official source
45 CFR §164.502(b)Official source
45 CFR §§164.524, 164.526, 164.528Official source
45 CFR §164.530(d)Official source
45 CFR §164.530(b)Official source
45 CFR §164.530(j)Official source

Security Rule — Administrative Safeguards

45 CFR §164.308(a)(1)Official source
45 CFR §164.308(a)(1)(ii)(B)Official source
45 CFR §164.308(a)(2)Official source
45 CFR §164.308(a)(3)Official source
45 CFR §164.308(a)(5)Official source
45 CFR §164.308(a)(6)Official source
45 CFR §164.308(a)(7)Official source
45 CFR §164.308(b)Official source

Security Rule — Physical Safeguards

45 CFR §164.310(a)Official source
45 CFR §164.310(b)(c)Official source
45 CFR §164.310(d)Official source
45 CFR §164.310(d)(2)(iii)Official source

Security Rule — Technical Safeguards

45 CFR §164.312(a)(2)(i)Official source
45 CFR §164.312(a)(2)(iii)Official source
45 CFR §164.312(b)Official source
45 CFR §164.312(c)Official source
45 CFR §164.312(e)(2)(ii)Official source
45 CFR §164.312(d)Official source

Breach Notification Rule

45 CFR §164.402Official source
45 CFR §164.404Official source
45 CFR §164.408Official source
45 CFR §164.406Official source

What is HIPAA and who must comply?

The Health Insurance Portability and Accountability Act (HIPAA) of 1996, enforced by the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR), sets national standards for protecting individually identifiable health information, known as Protected Health Information (PHI). Two categories of organisations are directly subject to HIPAA: covered entities (healthcare providers, health plans, and healthcare clearinghouses) and business associates (any vendor or partner that creates, receives, maintains, or transmits PHI on behalf of a covered entity — such as cloud storage providers, billing companies, EHR vendors, and lawyers).

Modern health technology companies — including telehealth platforms, digital health apps, and health data analytics firms — frequently qualify as business associates and must sign a Business Associate Agreement (BAA) under 45 CFR §164.308(b) before handling any PHI. If your product touches patient data in any form, assume HIPAA applies and consult legal counsel to confirm your obligations.

HIPAA's three rules and their penalties

HIPAA comprises three main rules. The Privacy Rule (45 CFR Part 164, Subpart E) governs who may access PHI and grants patients rights to access and amend their health records. The Security Rule (45 CFR Part 164, Subpart C) requires covered entities and business associates to implement administrative, physical, and technical safeguards for electronic PHI (ePHI). The Breach Notification Rule (45 CFR §§164.400–414) requires notification to affected individuals, HHS, and sometimes the media when unsecured PHI is breached.

Penalties under 45 CFR §160.404 are tiered by culpability: $100–$50,000 per violation for unknowing violations up to a $1.9 million annual cap; up to $1.9 million per violation category per year for willful neglect not corrected. The largest fine to date was $16 million (Anthem, 2018). HHS OCR investigations are frequently triggered by breach reports and patient complaints — the Security Risk Analysis is the single most frequently cited deficiency in enforcement actions.

How to use this HIPAA compliance checklist

Start with the Security Risk Analysis (item hipaa-sa-1) — it is the foundation of all HIPAA security compliance and legally required under 45 CFR §164.308(a)(1). The SRA identifies the specific risks to ePHI that other controls must address. Without a completed SRA, all downstream security controls are built on an unverified foundation.

Note that some Security Rule requirements are marked "addressable" rather than "required." You must implement addressable specifications if reasonable and appropriate given your risk, or document why an equivalent alternative is in place. If you also handle payment card data, review our PCI DSS checklist; if you serve EU patients, review the GDPR checklist as well. Use the PDF export to document your compliance programme for auditors and business partners.

Frequently Asked Questions

What is the maximum penalty for HIPAA non-compliance?
Civil penalties reach up to $1.9 million per violation category per year. For wilful neglect not corrected, each violation can result in a $50,000 fine, up to the annual cap. Criminal penalties for knowingly obtaining or disclosing PHI can result in up to 10 years in prison. The largest single settlement to date was $16 million (Anthem, 2018).
Who does HIPAA apply to?
HIPAA applies to covered entities (healthcare providers that conduct certain electronic transactions, health plans, and healthcare clearinghouses) and their business associates — vendors or contractors who access, store, or process PHI on behalf of a covered entity, such as EHR vendors, billing services, cloud storage providers, and IT support companies.
What is a Business Associate Agreement (BAA)?
A BAA is a contract between a covered entity and a business associate that requires the business associate to appropriately safeguard PHI, use it only for the contracted purpose, report breaches, and comply with HIPAA's Security Rule. You must have a signed BAA with every vendor that accesses ePHI before allowing that access.
What is the Security Risk Analysis and why is it so important?
The Security Risk Analysis (SRA) is a required administrative safeguard under HIPAA's Security Rule (45 CFR §164.308(a)(1)). It is the most commonly cited violation in HHS enforcement actions. The SRA identifies all ePHI your organisation handles and assesses the risks to its confidentiality, integrity, and availability — it is the foundation for all other security decisions.
Is HIPAA required for health apps?
HIPAA applies to health apps only if they are developed by or work on behalf of a covered entity or business associate. Consumer-facing health apps not connected to a healthcare provider are generally not subject to HIPAA. The FTC Act and FTC Health Breach Notification Rule may apply instead.
What are the penalties for HIPAA violations?
Civil penalties range from $100 to $50,000 per violation (up to a cap of $1.9M per violation category per year), scaled by culpability. Criminal penalties for knowing violations can result in up to 10 years in prison. HHS increased enforcement activity significantly following the HITECH Act.

Related compliance checklists

GDPR ChecklistSOC 2 ChecklistPCI DSS ChecklistCCPA ChecklistADA / WCAG Checklist