What the HIPAA Security Rule asks of a small practice
The HIPAA Security Rule sets national standards for protecting electronic protected health information (ePHI) — every chart, X-ray, appointment, claim and email about a patient that lives on a computer or in the cloud. It applies to medical and dental practices of every size, from a solo dentist to a multi-location group.
The rule is deliberately flexible. It doesn't tell you which products to buy. It tells you what outcomes you need, and expects you to choose safeguards that fit your size and risks. That flexibility is helpful, but it also makes it hard to know whether you've done enough. This self-assessment turns the rule's main standards into plain questions so you can see where you stand.
The three kinds of safeguards
The questions are grouped the same way the regulation is organized:
| Safeguard | Regulation | What it covers | Examples |
|---|---|---|---|
| Administrative | 45 CFR 164.308 | Policies, people, training and planning | Risk analysis, Security Official, training, backups, incident plan, BAAs |
| Physical | 45 CFR 164.310 | Buildings, rooms and devices | Locked server closet, screen placement, device disposal, inventory |
| Technical | 45 CFR 164.312 | Technology settings that protect data | Unique logins, auto-lock, encryption, audit logs, MFA |
Each question shows the specific citation it relates to, so you or your compliance advisor can look up the exact wording. A couple of questions — like keeping systems updated — go slightly beyond the literal text of the rule. We've noted where that's the case; they're included because they're among the most common ways practices actually get hurt.
Required vs. addressable: a common misunderstanding
Some parts of the Security Rule are labeled required and others addressable. Many people read "addressable" as "optional." It isn't. For an addressable item, you must assess whether it's reasonable and appropriate for your practice. If it is, you implement it. If it isn't, you document why and what you do instead. Encryption of laptops is the classic example: it's addressable, but for almost every practice it's reasonable, inexpensive and built into Windows.
How to read your score
Your overall score is simply the share of questions where you answered Yes. Section scores show where your gaps cluster. As a rough guide:
- 80% and above — a solid foundation. Focus on documentation and keeping things current.
- 50–79% — the basics are partly in place, but there are gaps an auditor or attacker would likely find.
- Below 50% — start with the high-priority items in your gap list. They are the ones most likely to prevent a breach or show good faith if something goes wrong.
"Not sure" counts as a gap. If no one in the practice knows whether backups are tested or laptops are encrypted, you can't show that they are — and showing it is what matters when HHS's Office for Civil Rights (OCR) asks.
What to do with your gap list
- Print it or save it as a PDF and keep it with your HIPAA records. It's a useful snapshot of where you started.
- Work the high-priority items first. Risk analysis, access removal, multi-factor authentication, encryption, backups and business associate agreements carry the most weight.
- Do (or update) your formal risk analysis. Our HIPAA security risk assessment guide walks through it step by step, and HHS offers a free Security Risk Assessment Tool.
- Assign owners and dates. A gap list with no owner tends to look the same a year later.
- Repeat the check yearly and after big changes.
Who should fill it in
The best results come from a short conversation rather than one person guessing. Sit down with your practice manager, whoever handles IT (in-house or your IT provider) and, if you have one, your designated Security Official. Many questions — like whether backups are tested or laptops are encrypted — are quick for your IT provider to confirm and hard for anyone else to know. Allow about 20 minutes. Your answers are saved in this browser, so you can stop and come back.
Where Microsoft 365 fits
Many practices already pay for tools that cover several of these safeguards. Microsoft signs a business associate agreement for Microsoft 365, and plans like Microsoft 365 Business Premium include multi-factor authentication and Conditional Access, device management with Intune, BitLocker encryption, Defender for Business and email encryption. They just need to be turned on and configured correctly. Read Is Microsoft 365 HIPAA compliant? for details.
Proposed changes to the Security Rule
HHS published a proposed update to the Security Rule in the Federal Register on January 6, 2025. It would make several practices that are now flexible — like multi-factor authentication, encryption and regular vulnerability scanning — more explicit. As of this writing the rule has not been finalized, so check HHS.gov for the latest. Our article on proposed HIPAA Security Rule changes explains what may be coming. Fixing the gaps in this checklist now puts you in a good position either way.
Related reading
- HIPAA Security Rule checklist for small practices
- Business associate agreements: an IT guide
- How to build a HIPAA breach response plan
- HIPAA-compliant email encryption
Beefed Up IT helps medical and dental practices put these safeguards in place and keep them running as part of our managed IT services. If your gap list is longer than you'd like, book a free call and we'll help you decide what to tackle first.