HIPAA Security Rule Checklist for Small Practices (2026)

If your practice stores appointments, X-rays, charts, insurance details or billing records on a computer or in the cloud, the HIPAA Security Rule applies to you. It doesn't matter whether you have five employees or fifty. The rule is short on paper but broad in practice: it expects you to know where your patient data lives, figure out what could go wrong, and put reasonable protections in place — then prove it with documentation.

Most small practices we talk to aren't ignoring HIPAA. They have a privacy notice at the front desk, staff sign a confidentiality form, and someone once filled in a compliance binder. What's usually missing is the security side: a real risk analysis, multi-factor sign-in, encrypted laptops, tested backups, audit logs someone actually looks at, and a signed agreement with every vendor that touches patient data.

This checklist walks through every standard in the Security Rule, in plain English, in the order the regulation lists them. For each one you'll see what the rule actually says, whether it's "required" or "addressable," what it looks like in a 5–50 person dental or medical office, and how to do it with Microsoft 365. If you'd rather answer questions and get a score, try our free HIPAA Security Self-Assessment alongside this article.

What is the HIPAA Security Rule, and who has to follow it?

The HIPAA Security Rule is the federal regulation (45 CFR Part 164, Subpart C) that sets minimum safeguards for electronic protected health information. It applies to "covered entities" — health care providers that bill electronically, health plans and clearinghouses — and to their "business associates," the vendors that handle patient data on their behalf.

A few terms you'll see throughout:

• PHI (protected health information) is any individually identifiable health information: a name plus a diagnosis, an appointment date, a chart note, an insurance ID, an X-ray with a patient name on it.
• ePHI (electronic PHI) is PHI in electronic form — in your practice management system, EHR, imaging software, email, scanned documents, backups, phones and laptops. The Security Rule only covers ePHI. Paper charts fall under the Privacy Rule instead.
• Covered entity is you, the practice. Nearly every dental and medical office that submits claims electronically is one.
• Business associate is a vendor that creates, receives, maintains or transmits PHI for you — your IT provider, your cloud EHR, your backup company, your email provider. They must sign a business associate agreement (BAA). We cover that in detail in our BAA guide for IT vendors.

The rule's overall goal, set out in 45 CFR 164.306(a), is to protect the confidentiality, integrity and availability of ePHI. Confidentiality means only the right people see it. Integrity means it isn't altered or destroyed improperly. Availability means it's there when the hygienist needs the chart — which is why ransomware and internet outages are Security Rule problems, not just IT problems.

Why the rule is flexible (and why that's not a loophole)

The Security Rule was written to be "technology neutral." It doesn't say "buy this firewall" or "use this antivirus." Instead, 45 CFR 164.306(b) lets you choose security measures based on four factors:

1. Your size, complexity and capabilities
2. Your technical infrastructure, hardware and software security capabilities
3. The cost of security measures
4. The probability and criticality of potential risks to ePHI

That flexibility is real. A four-chair dental office doesn't need a 24-hour security operations center. But flexibility cuts both ways: because the rule doesn't hand you a list of products, you have to show your reasoning. That reasoning lives in your risk analysis, which is why it's the first item on the checklist and the first thing the HHS Office for Civil Rights (OCR) asks for in an investigation.

What's the difference between "required" and "addressable"?

"Required" specifications must be implemented as written. "Addressable" specifications must be assessed and either implemented, replaced with an equivalent alternative, or skipped only with a documented reason. Addressable never means optional.

Here's the exact process from 45 CFR 164.306(d)(3), in plain English:

1. Look at the addressable specification and decide whether it's a reasonable and appropriate safeguard for your practice.
2. If it is, implement it.
3. If it isn't, write down why it isn't reasonable and appropriate.
4. Implement an equivalent alternative measure, if one is reasonable and appropriate.

In practice, for a small office running Microsoft 365, almost every addressable specification is cheap or free to implement. Encryption is built into Windows and Microsoft 365. Automatic screen lock is a setting. Security reminders are a monthly email. It is very hard to write a convincing explanation of why turning on BitLocker wasn't "reasonable and appropriate" for a laptop full of patient records.

Heads-up: The proposed Security Rule update published in January 2025 would remove the distinction between required and addressable entirely, making nearly everything required. As of October 2026 that rule is still a proposal, not law. We explain the details in what the proposed HIPAA Security Rule changes mean.

What should you have in place before you start the checklist?

Before you work through individual safeguards, make sure five foundations exist: a named security official, an inventory of where ePHI lives, a current risk analysis, a set of written policies, and a place to keep evidence. Every item on the checklist depends on these.

1. A named security official. One person — usually the practice manager — who is responsible for the security program. Write their name down.
2. An inventory. Every computer, laptop, tablet, phone, server, imaging device, network device and cloud service that stores or touches ePHI. You can't protect what you don't know you have.
3. A risk analysis. A written assessment of what threats could affect your ePHI, how likely they are, and how bad the damage would be. Our step-by-step HIPAA risk assessment guide shows how.
4. Written policies and procedures. Short, specific documents that describe what you actually do — not a 200-page template with another practice's name still in it.
5. An evidence folder. A secure SharePoint site or locked folder where you keep the risk analysis, policies, training logs, BAAs, incident records and screenshots of key settings. Under 45 CFR 164.316(b)(2), documentation must be kept for six years from when it was created or last in effect, whichever is later.

With those in place, the checklist below becomes a series of "yes, here's the proof" answers instead of a scramble.

Administrative safeguards checklist (45 CFR 164.308)

Administrative safeguards are the policies, people and planning side of security — and they make up more than half of the Security Rule. They include the risk analysis, workforce access, training, incident response and contingency planning.

1. Security management process — 164.308(a)(1)

This is the heart of the rule. It has four implementation specifications, all required:

• Risk analysis (Required). An accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of all ePHI you hold. This is the single most-cited failure in OCR enforcement. Since late 2024, OCR has run a dedicated "Risk Analysis Initiative," and its enforcement actions under it consistently cite a missing or inadequate risk analysis.
• Risk management (Required). A plan to reduce the risks you found to a reasonable and appropriate level — with owners and dates. A risk analysis with no follow-through doesn't satisfy this.
• Sanction policy (Required). A written policy describing consequences for staff who violate security policies, and records showing you apply it.
• Information system activity review (Required). Regularly reviewing audit logs, access reports and security incident reports. "Regularly" should be defined in your policy — monthly is common for a small office.

What it looks like in a small practice: a risk analysis document updated at least yearly, a risk register (a table of risks, owners, due dates and status), a one-page sanction policy in the employee handbook, and a monthly 30-minute log review — for example, checking Microsoft 365 sign-in reports for failed logins from other countries and reviewing who accessed the EHR after hours.

In Microsoft 365: the Microsoft Entra sign-in logs, Microsoft Defender alerts and the Microsoft Purview audit log give you the raw material for activity review. Microsoft's documentation states that Audit (Standard) records are retained for 180 days by default (records generated since October 17, 2023), so set a monthly review rhythm and export anything you need to keep longer.

2. Assigned security responsibility — 164.308(a)(2)

• Name a security official (Required standard). One person responsible for developing and implementing your security policies.

In a small practice this is often the same person as the privacy official. The security official doesn't have to be technical; they have to make sure things get done and documented. If you use a managed IT provider, the provider does the technical work, but the responsibility stays with the practice.

3. Workforce security — 164.308(a)(3)

The standard: make sure staff who need access to ePHI have appropriate access, and those who don't, can't get it.

• Authorization and/or supervision (Addressable). Procedures for authorizing access and supervising people who work with ePHI — including cleaning crews, temps and students.
• Workforce clearance procedure (Addressable). A way to decide whether someone's access is appropriate — for example, a background check for staff with full EHR access.
• Termination procedures (Addressable). Removing access when someone leaves or changes roles.

What goes wrong: the most common real-world gap we find is departed employees whose Microsoft 365 accounts, EHR logins or remote-access tools still work months later. Build an offboarding checklist and run it the same day someone leaves: disable the Microsoft 365 account, revoke sessions, remove from the EHR and practice management system, collect devices and keys, change any shared passwords they knew, and record the date.

4. Information access management — 164.308(a)(4)

The standard: policies for authorizing access to ePHI, consistent with the Privacy Rule's "minimum necessary" idea.

• Isolating health care clearinghouse functions (Required) — only applies if part of your organization is a clearinghouse. Most practices can mark this "not applicable" with a one-line explanation.
• Access authorization (Addressable). Who decides what access each role gets.
• Access establishment and modification (Addressable). How access is granted, reviewed and changed.

What it looks like: a simple role table. Front desk: scheduling, demographics, insurance. Hygienists and assistants: clinical charts and imaging. Billing: ledgers and claims. Doctor/owner: everything. Practice manager: everything plus admin. Review it twice a year. This is the principle of least privilege — people get the access they need for their job and no more.

In Microsoft 365: use security groups for each role and grant SharePoint and Teams access to groups, not individuals. Keep the number of Global Administrators to two or three, and don't use an admin account for daily email.

5. Security awareness and training — 164.308(a)(5)

The standard: a security awareness and training program for all workforce members, including management.

• Security reminders (Addressable). Periodic updates — a short monthly email about current scams works.
• Protection from malicious software (Addressable). Procedures for guarding against, detecting and reporting malware.
• Log-in monitoring (Addressable). Procedures for monitoring log-in attempts and reporting discrepancies.
• Password management (Addressable). Procedures for creating, changing and safeguarding passwords.

What it looks like: training at hire and at least annually, with sign-in sheets or completion records. Make it practical: how to spot a fake invoice email, what to do if you click a bad link, why you never share logins at the front desk, how to verify a caller asking for patient records. Our phishing and business email compromise guide and free Spot the Phish Quiz are good starting material.

In Microsoft 365: Microsoft Defender for Business (included in Microsoft 365 Business Premium) provides malware protection on devices; Defender for Office 365 filters malicious email and links. Entra ID sign-in logs and risky sign-in alerts handle log-in monitoring. For passwords, move toward multi-factor authentication everywhere and long passphrases rather than forced 90-day changes — see our MFA guide.

6. Security incident procedures — 164.308(a)(6)

• Response and reporting (Required). Identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes.

A security incident is broader than a breach: it includes attempted unauthorized access, a lost laptop, a phishing click, a ransomware alert. Every incident needs a record, even if it turned out to be nothing. A breach is a specific subset with notification deadlines. Our HIPAA breach response plan includes an incident log template and the 60-day notification timeline.

What it looks like: a one-page incident response plan with phone numbers (IT provider, cyber insurer, attorney), a simple incident log, and a rule that staff report anything suspicious immediately, without fear of blame.

7. Contingency plan — 164.308(a)(7)

This standard is about keeping patient care going and getting data back after an emergency — fire, flood, hurricane, ransomware, server failure.

• Data backup plan (Required). Create and maintain retrievable exact copies of ePHI.
• Disaster recovery plan (Required). Procedures to restore any loss of data.
• Emergency mode operation plan (Required). Procedures to keep critical business processes running while protecting ePHI during an emergency.
• Testing and revision procedures (Addressable). Periodically test and revise contingency plans.
• Applications and data criticality analysis (Addressable). Rank which systems matter most so you restore them first.

What it looks like: a 3-2-1 backup of your practice management and imaging data (three copies, two different media, one off-site), with at least one copy that ransomware can't alter — an immutable backup. A written recovery order: practice management first, imaging second, everything else after. A plan for the front desk when the internet is down — paper schedule printouts, a cellular failover, or both. And a restore test at least once or twice a year, with the result written down.

Our backup and disaster recovery guide and EHR downtime and internet failover plan cover this in depth. For Florida practices, add hurricane prep — see our hurricane IT preparedness guide.

A real example: one of our dental practice clients used to shut down the front desk whenever the internet provider had an outage. We added automatic cellular failover and moved patient data to encrypted cloud storage with backup and retention policies. That's an emergency mode operation plan in action — the practice keeps working when the connection drops.

Important: Microsoft 365 keeps your data available and has retention features, but it is not a full backup in the sense most practices need (point-in-time restore of an entire mailbox or SharePoint site after ransomware or a malicious deletion). Most practices add a third-party Microsoft 365 backup service — which, because it stores ePHI, needs its own BAA.

8. Evaluation — 164.308(a)(8)

• Periodic technical and nontechnical evaluation (Required standard). Evaluate how well your security policies and procedures meet the rule, initially and in response to environmental or operational changes.

What it looks like: an annual review of this checklist, plus a review whenever something big changes — new EHR, new office, move to the cloud, a merger, a security incident. Many practices pair this with an annual vulnerability scan of their network.

9. Business associate contracts — 164.308(b)

• Written contract or other arrangement (Required). Get satisfactory written assurances (a BAA) from every business associate that creates, receives, maintains or transmits ePHI for you.

Keep a vendor list with the BAA signature date for each. Typical IT-related business associates: your managed IT provider, Microsoft, your cloud EHR or practice management vendor, your backup provider, your VoIP phone provider if voicemails and call recordings contain PHI, your e-fax service, and any secure email or patient-messaging tool. The BAA guide explains which vendors need one and what should be in it.

Physical safeguards checklist (45 CFR 164.310)

Physical safeguards protect the buildings, rooms, workstations and devices that hold ePHI. For a small practice, this is mostly about locked doors, screen privacy, and knowing where every device and drive is from purchase to disposal.

10. Facility access controls — 164.310(a)

The standard: limit physical access to your systems and the rooms they're in, while letting authorized people in.

• Contingency operations (Addressable). Procedures for allowing facility access to restore data during an emergency (who can get into the building after a hurricane to recover the server?).
• Facility security plan (Addressable). Safeguard the facility and equipment from unauthorized access, tampering and theft.
• Access control and validation procedures (Addressable). Control and validate people's access based on their role, including visitors and vendors.
• Maintenance records (Addressable). Document repairs and changes to physical security components (locks, doors, alarm codes).

What it looks like: the server or network closet is locked; the key list is short; alarm codes are personal and removed when people leave; vendors sign in; locks are re-keyed or codes changed after a departure. If your "server room" is a shelf in the break room with the door propped open, fix that first.

11. Workstation use — 164.310(b)

• Workstation use policy (Required standard). Specify how workstations that access ePHI should be used and their physical surroundings.

What it looks like: front-desk monitors angled away from the waiting room or fitted with privacy filters; operatory screens locked when the patient is alone in the room; no personal email or web browsing on PCs that run imaging software; staff don't save patient files to the desktop.

12. Workstation security — 164.310(c)

• Physical safeguards for workstations (Required standard). Restrict physical access to workstations to authorized users.

What it looks like: laptops that leave the office are encrypted and never left in cars; desktops in public areas are cable-locked or in locked enclosures; screens lock automatically when unattended.

13. Device and media controls — 164.310(d)

The standard: govern how hardware and electronic media containing ePHI come in, move around, and leave.

• Disposal (Required). Final disposition of ePHI and the hardware or media it's stored on — wipe or physically destroy drives and keep a certificate.
• Media re-use (Required). Remove ePHI before re-using media — a PC handed to a new employee is reset, not just given a new login.
• Accountability (Addressable). Keep a record of hardware and media movements and who is responsible.
• Data backup and storage (Addressable). Create a retrievable copy of ePHI before moving equipment.

What goes wrong: old PCs, copiers and imaging workstations get donated, recycled or thrown out with patient data still on the drive. Multifunction copiers and some digital X-ray systems have internal storage — include them. Keep a disposal log: device, serial number, date, method (wipe, shred, degauss), who did it, certificate on file.

Technical safeguards checklist (45 CFR 164.312)

Technical safeguards are the settings and tools that control who can get into systems holding ePHI, record what they do, and protect data as it's stored and sent. This is where Microsoft 365 and good device management do most of the work.

14. Access control — 164.312(a)

• Unique user identification (Required). Every person gets their own login. No shared "frontdesk" account, no shared EHR login.
• Emergency access procedure (Required). A way to get to ePHI during an emergency — for example, a sealed "break glass" admin account and a documented process for granting temporary access.
• Automatic logoff (Addressable). End sessions after a set period of inactivity.
• Encryption and decryption (Addressable). Encrypt ePHI stored on devices and systems.

The shared-login problem: front desks often run on one shared account because it's faster. It breaks unique user identification and makes your audit logs useless — you can't tell who looked at a record. Fixes that keep things fast: Windows Hello for Business (face or PIN sign-in), fast user switching, and EHR-level "tap to switch user" features if your vendor offers them.

In Microsoft 365: every staff member has a named account in Entra ID (Microsoft's identity service — the system that controls who can sign in). Create two emergency-access ("break glass") admin accounts with long passwords stored securely, as Microsoft recommends, and monitor every time they are used. Use Intune (Microsoft's device-management service) to enforce screen lock after a few minutes of inactivity and to turn on BitLocker disk encryption on every Windows PC. Encryption is one of the most valuable controls on this list: under the Breach Notification Rule, properly encrypted data that is lost or stolen is not "unsecured PHI," so a stolen encrypted laptop is generally not a reportable breach.

15. Audit controls — 164.312(b)

• Record and examine activity (Required standard). Hardware, software or procedures that record and examine activity in systems containing ePHI.

What it looks like: audit logging turned on in your EHR/practice management system, in Microsoft 365, and on servers; someone reviews them on a schedule (this ties back to information system activity review in the administrative section). Check that your EHR actually logs who viewed which chart — most do, but the feature isn't always on.

In Microsoft 365: confirm the unified audit log is on in Microsoft Purview (it is on by default for most tenants, but verify). Mailbox auditing is on by default. Remember the retention limits for your license and export reports you need for longer-term evidence.

16. Integrity — 164.312(c)

• Protect ePHI from improper alteration or destruction (Required standard).
• Mechanism to authenticate ePHI (Addressable). Electronic ways to confirm ePHI hasn't been altered or destroyed in an unauthorized way.

What it looks like: endpoint protection that stops ransomware from encrypting files, version history on SharePoint and OneDrive, immutable backups, and EHR features that track amendments to clinical notes. Restricting who can delete or edit records (access control) also supports integrity.

17. Person or entity authentication — 164.312(d)

• Verify identity (Required standard). Procedures to verify that a person or entity seeking access to ePHI is who they claim to be.

What it looks like in 2026: passwords alone don't cut it. Turn on multi-factor authentication (MFA) for Microsoft 365, the EHR, remote access, your IT provider's tools and any cloud system with patient data. Prefer the Microsoft Authenticator app, passkeys or Windows Hello over text-message codes. Cyber insurers now commonly ask about MFA on email and remote access — see our cyber insurance requirements checklist.

In Microsoft 365: use Conditional Access (rules that decide whether a sign-in is allowed based on who, where and what device) to require MFA for all users and to block sign-ins from devices that aren't managed and compliant. Conditional Access requires Entra ID P1, which is included in Microsoft 365 Business Premium. If you're on Business Basic or Standard, at minimum turn on Microsoft's free "security defaults," which enforce MFA.

18. Transmission security — 164.312(e)

• Guard ePHI sent over networks (Required standard).
• Integrity controls (Addressable). Make sure transmitted ePHI isn't improperly modified without detection.
• Encryption (Addressable). Encrypt ePHI in transit whenever deemed appropriate.

What it looks like: websites and portals use HTTPS; remote access goes through an encrypted VPN or a secure remote-access tool with MFA (never an open Remote Desktop port on the internet); Wi-Fi uses WPA2 or WPA3 with a separate guest network; email containing PHI to outside parties is encrypted.

In Microsoft 365: Microsoft Purview Message Encryption lets staff send encrypted email that recipients open in Outlook or a web portal. According to Microsoft's documentation, it's included in Microsoft 365 Business Premium; Business Basic and Business Standard need an add-on (Azure Information Protection Plan 1). You can also create a rule that automatically encrypts messages containing sensitive information. Our HIPAA-compliant email encryption guide walks through the options.

Organizational and documentation requirements (164.314 and 164.316)

Beyond the three safeguard categories, the rule requires correct business associate contracts and written, retained, up-to-date documentation. These are often the easiest items to fix and the most embarrassing to miss.

• Business associate contracts (164.314(a)). Each BAA must require the vendor to comply with the Security Rule, make sure its own subcontractors agree to the same, and report security incidents — including breaches — to you.
• Policies and procedures (164.316(a)). Written, reasonable and appropriate policies to comply with each standard.
• Documentation (164.316(b)). Written (which can be electronic) records of policies, actions, activities and assessments.
• Time limit (Required). Keep documentation six years from creation or last effective date, whichever is later.
• Availability (Required). Make documentation available to the people responsible for carrying it out.
• Updates (Required). Review periodically and update in response to environmental or operational changes.

Tip: keep policies short and true. OCR investigators compare what your policy says with what you do. A two-page policy you follow beats a hundred-page template you don't.

The master checklist at a glance

The table below maps every Security Rule standard to what a small practice typically uses to meet it, with Microsoft 365 tools where they apply. Use it as a one-page summary for your evidence folder.

How do you implement the Security Rule in Microsoft 365?

For most 5–50 person practices, Microsoft 365 Business Premium plus a handful of configuration steps covers the majority of the technical safeguards. The license matters less than the setup — an unconfigured Business Premium tenant is no safer than a Basic one.

Before anything else: Microsoft offers a HIPAA business associate agreement through its Data Protection Addendum, by default, to customers who are covered entities or business associates (per Microsoft Learn). You don't have to request a special form, but you should download a copy from the Microsoft Service Trust Portal and keep it in your evidence folder. Microsoft is also clear that the BAA does not make you compliant on its own — configuration and policies are your responsibility. For more, see is Microsoft 365 HIPAA compliant?

Which Microsoft 365 plan do you need?

Microsoft 365 Business Premium is the plan we recommend for practices because it bundles the security pieces the checklist needs: Intune for device management, Entra ID P1 for Conditional Access, Defender for Business for endpoint protection and response, and Purview Message Encryption. Business Standard is fine for productivity but lacks device management and Conditional Access, so you'd have to buy those separately or accept weaker controls. Our Microsoft 365 plan comparison and plan picker tool can help you decide. Check Microsoft's site for current pricing; we don't quote list prices here because they change.

A 12-step Microsoft 365 hardening sequence for practices

1. Confirm the BAA is in place and file a copy.
2. Create two break-glass admin accounts, store their credentials securely (sealed envelope in a safe, or a password manager vault the owner controls), and monitor their use.
3. Separate admin and daily accounts. The practice manager reads email as a regular user and only uses an admin account for admin tasks.
4. Turn on MFA for everyone via Conditional Access (Business Premium) or security defaults (other plans). Block legacy authentication, which can't do MFA.
5. Enroll every Windows PC in Intune, ideally with Autopilot (Microsoft's zero-touch setup) for new devices, as we did for a fast-growing startup client.
6. Push compliance policies: BitLocker on, firewall on, screen lock at 5–15 minutes, supported Windows version, Defender running.
7. Require compliant devices for access to Microsoft 365 and, where possible, the EHR — so a stolen password alone can't open patient email from a stranger's computer.
8. Onboard devices to Defender for Business, Microsoft's EDR (endpoint detection and response) tool, which watches for suspicious behavior like ransomware and can isolate an infected PC.
9. Configure email protection: Defender for Office 365 safe links and attachments, plus SPF, DKIM and DMARC on your domain so criminals can't easily spoof your practice. Check yours with our email security checker.
10. Set up message encryption and a DLP (data loss prevention) rule that flags or encrypts outbound email containing patient identifiers.
11. Verify audit logging and set a monthly review routine.
12. Add third-party backup for Exchange, OneDrive, SharePoint and Teams, with a signed BAA from the backup vendor.

None of this is exotic. It's what our accounting firm client needed to pass its own client security reviews, and the same building blocks apply to a practice.

What Microsoft 365 doesn't cover

Microsoft 365 doesn't secure your EHR or imaging software, your network firewall, your Wi-Fi, your phones, your copier or your paper charts. It doesn't write your risk analysis or train your staff. And it doesn't automatically back up your on-site imaging server. A practice-wide checklist needs all of those.

Scenario: an eight-person dental office

A small dental office can meet the Security Rule in a few months with a focused plan — most of the work is setup and paperwork, not expensive equipment. Here's a realistic walk-through.

The practice: one dentist, two hygienists, two assistants, two front-desk staff and an office manager. Practice management and imaging on a small on-site server. Four operatory PCs, two front-desk PCs, one office manager laptop, one dentist laptop. Microsoft 365 Business Standard for email. Paper consent forms scanned into the chart. A cloud-based fax service. A VoIP phone system with voicemail-to-email.

What we'd typically find:

• One shared login on the two front-desk PCs.
• No encryption on the dentist's laptop, which goes home every night with exported reports on the desktop.
• Server backups to a USB drive that's never been test-restored and sits next to the server.
• A former assistant's email account still active.
• No BAA on file with the fax service or the phone provider.
• No written risk analysis since the practice opened.

The plan, in order:

1. Week 1–2: Run the risk analysis (the SRA Tool from HHS works well for an office this size). Name the office manager as security official. Disable the former employee's account. Sign BAAs with Microsoft (download), the IT provider, the fax service, the phone provider and the imaging software vendor if they have remote access.
2. Week 2–4: Upgrade to Business Premium. Turn on MFA. Enroll all PCs in Intune and enable BitLocker. Give each front-desk person a unique login with Windows Hello for fast sign-in.
3. Week 4–6: Replace the USB backup with an image-based backup to a local appliance plus an immutable cloud copy. Test a full restore of the practice management database on a spare PC and record the result. Add cellular internet failover so the front desk can keep checking patients in during an outage.
4. Week 6–8: Write short policies (access, workstation use, devices and disposal, incidents, contingency, sanctions). Run a one-hour staff training session with a phishing demo. Set up the evidence folder.
5. Ongoing: monthly log review (30 minutes), quarterly access review, annual risk analysis update and restore test.

Typical costs: this is mostly labor and licensing. The Business Premium upgrade is a per-user monthly cost; a backup appliance plus cloud storage and a cellular failover device are modest one-time and monthly costs. We'd rather give you a quote based on your actual setup than a made-up average — our managed IT cost guide explains what drives the numbers. Dental-specific considerations are in our dental office IT guide and dental imaging network guide.

Scenario: a 22-person medical office

A larger practice has the same checklist but more moving parts: more vendors, more remote access, more devices, and more people who come and go. The priorities shift toward access management, vendor management and monitoring.

The practice: three physicians, two nurse practitioners, medical assistants, a lab tech, billing staff, front desk and a practice administrator. Cloud EHR. A lab interface. Two satellite exam rooms in another building. Physicians who chart from home. Microsoft 365 for email and file sharing. An outsourced billing company.

Where the risk concentrates:

• Remote charting. Providers log into the cloud EHR from home computers that the practice doesn't manage. One infected home PC with a keystroke logger can capture EHR credentials.
• Vendor sprawl. The EHR, billing company, lab interface vendor, transcription service, patient reminder service, answering service and IT provider all touch PHI. Some BAAs are missing; others are years old and predate current practices.
• Turnover. Medical assistants and front-desk staff change more often, so offboarding gaps grow.
• Email. Billing and referral coordinators email PHI to outside offices every day.

What the checklist looks like in practice:

1. Require managed devices for remote access. Issue practice-owned laptops enrolled in Intune for anyone who charts from home, and use Conditional Access so Microsoft 365 (and the EHR, if it supports single sign-on with Entra ID) only opens on compliant devices.
2. Build a vendor register. Every vendor, what PHI they touch, BAA date, contact for incidents, and whether they use subcontractors. Re-review yearly.
3. Automate offboarding. A checklist in Microsoft Planner or your help desk, triggered by HR, that covers Microsoft 365, the EHR, building access, the billing portal and shared passwords.
4. Encrypt outbound PHI email automatically with a DLP rule, and train billing staff to use it.
5. Turn on EHR audit reports and review "break the glass" or VIP chart access monthly — snooping by staff is a common privacy complaint.
6. Write and test an EHR downtime procedure: printed schedules, paper encounter forms, and how charts get reconciled afterward.
7. Run an annual tabletop exercise — walk through "it's Monday at 8 a.m. and ransomware has locked every PC" with the administrator, a physician and IT.

More detail for this kind of practice is in our medical office IT guide.

What about the proposed HIPAA Security Rule changes?

OCR proposed a major update to the Security Rule in a notice of proposed rulemaking published January 6, 2025, but as of October 2026 it has not been finalized. Industry trackers reported in mid-2026 that the federal regulatory agenda now targets a final rule around 2027; check HHS for the latest before making decisions based on it.

The proposal would, among other things:

• Remove the "addressable" category so almost every specification becomes required
• Require a written technology asset inventory and network map, reviewed at least every 12 months
• Require encryption of ePHI at rest and in transit, and multi-factor authentication, with limited exceptions
• Require vulnerability scanning at least every six months and penetration testing at least every 12 months
• Require the ability to restore critical systems within 72 hours
• Require an annual compliance audit
• Require business associates to verify their safeguards in writing at least annually

The practical takeaway: almost everything in the proposal is already good practice, and most of it is already expected under the current risk-analysis-driven rule. If you implement this checklist the way we've described — MFA, encryption, inventory, tested backups, vendor management — you'll be most of the way there whatever the final rule says. We track the details in HIPAA Security Rule proposed changes.

Mistakes we see most often

The most common Security Rule failures in small practices aren't exotic hacks — they're basic gaps that are cheap to close. Here are the ones we run into again and again.

1. No real risk analysis. A checklist or a vendor's "HIPAA compliance certificate" is not a risk analysis. OCR wants an assessment of your risks to your ePHI.
2. A risk analysis with no risk management. Findings sit in a binder with no owner, no date, no follow-up.
3. Shared logins at the front desk or in operatories.
4. Former employees with live accounts.
5. Unencrypted laptops and USB drives. Encryption is the cheapest insurance you can buy against a reportable breach.
6. Backups that have never been restored. A backup you haven't tested is a hope, not a plan.
7. Missing BAAs, especially with phone, fax, and backup vendors.
8. Open Remote Desktop to the internet so the doctor can work from home — a well-known ransomware entry point.
9. Treating Microsoft 365 as compliant out of the box. The BAA is the start, not the finish.
10. Template policies that describe systems you don't have.
11. Old computers still running unsupported Windows versions — see our Windows 10 end-of-support guide.
12. No incident log. Every phishing click and lost phone should be written down, even when nothing bad happened.

How long does it take, and what does it cost?

A small practice starting from scratch typically needs two to four months to work through the full checklist, then a few hours a month to maintain it. The cost depends far more on how many devices and vendors you have than on the size of the patient base.

These are typical ranges from our experience, not guarantees — an office with an aging on-site server and ten unknown vendors will take longer than a cloud-first practice. Use our managed IT cost calculator to compare doing it in-house versus with a provider.

Is it worth doing yourself?

You can absolutely do much of this yourself — the HHS SRA Tool is free, NIST SP 800-66 Revision 2 (February 2024) is free and maps each standard to concrete practices, and the HHS 405(d) program publishes free Health Industry Cybersecurity Practices guidance aimed at small practices. Where most offices need help is the technical configuration (Conditional Access, Intune, backup design) and keeping it maintained month after month.

There's also a financial reason to do it properly. A 2021 amendment to the HITECH Act (Public Law 116-321) requires HHS to consider whether a practice had "recognized security practices" — such as the NIST Cybersecurity Framework or the 405(d) HICP guidance — in place for the previous 12 months when deciding penalties and audit outcomes. Twelve months of documented good practice can work in your favor if something ever goes wrong.

Questions to ask your IT provider

If someone else manages your IT, these questions tell you quickly whether they understand the Security Rule. Good answers are specific; vague answers are a warning sign.

1. Will you sign a business associate agreement? (If not, stop here.)
2. Do you require MFA on your own remote-access and management tools?
3. Which of our devices are encrypted right now, and can you show me a report?
4. When did you last test-restore our practice management data, and how long did it take?
5. Is any of our backup data immutable or offline, so ransomware can't reach it?
6. Who reviews our Microsoft 365 sign-in and audit logs, and how often?
7. How do you handle offboarding when we tell you someone has left?
8. Do you help with the risk analysis, or just the technology?
9. What happens if you detect a security incident at 2 a.m.?
10. Which subcontractors do you use that could access our data, and do they have BAAs with you?

For more on choosing a provider, see how to choose a managed IT provider.

The bottom line

The HIPAA Security Rule isn't a mystery, and it isn't designed only for hospitals. It asks every practice to do the same handful of things: understand its risks, protect patient data with reasonable administrative, physical and technical safeguards, plan for emergencies, sign agreements with vendors, and write it all down. "Addressable" means "decide and document," not "skip."

For a 5–50 person dental or medical office, Microsoft 365 Business Premium configured properly — MFA, Conditional Access, Intune, BitLocker, Defender and message encryption — plus a real risk analysis, short accurate policies, annual training, tested backups and signed BAAs gets you through the vast majority of the checklist.

Start with the free HIPAA Security Self-Assessment to see where you stand. If you'd like help closing the gaps, we work with medical and dental practices across Volusia and Flagler counties and remotely across the US — book a free 20-minute call and we'll tell you honestly what you need and what you don't.