HIPAA compliance generates significant confusion for small and mid-sized healthcare practices. The regulation is dense, the requirements span administrative, physical, and technical domains, and there is a lot of bad information about what compliance actually requires.
What HIPAA Actually Requires
For most healthcare practices, the relevant rules are the Privacy Rule, the Security Rule, and the Breach Notification Rule. The Security Rule — where most IT-related requirements live — specifies administrative, physical, and technical safeguards for electronic protected health information.
The Security Rule Is Not a Checklist
The Security Rule does not tell you to use a specific encryption standard or software product. It establishes required and addressable standards and requires covered entities to implement those that are reasonable and appropriate for their size and risk environment. This means compliance requires genuine analysis of your environment — not just checking boxes on a template.
The Risk Assessment: Why It Matters
HIPAA explicitly requires covered entities to conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI. This is not optional, and it is not a one-time exercise.
Common gap: Many practices completed a HIPAA risk assessment once — often years ago — and have not updated it since. A five-year-old assessment for an environment that has moved to cloud services and changed vendors is not a meaningful compliance document.
Technical Safeguards: What You Actually Need
Access Controls
Each user must have a unique identifier. Access to ePHI must be limited to the minimum necessary for the user's role. Automatic logoff should be implemented on systems that access ePHI.
Audit Controls
Systems that contain or access ePHI must have audit logging enabled — capturing who accessed what data and when. Those logs must be retained and reviewed.
Transmission Security
ePHI transmitted over networks must be encrypted. This applies to email containing PHI, data transferred between systems, and any remote access to systems containing ePHI.
Business Associate Agreements
Any vendor that creates, receives, maintains, or transmits PHI on your behalf must sign a Business Associate Agreement before they have access. This includes your IT provider, cloud storage provider, billing company, and EHR vendor. BAA management is an area where practices frequently have gaps — either missing agreements with vendors, or agreements that are outdated.
Building a Compliance Program That Holds Up
Compliance is not a destination — it is an ongoing program. The practices with the most defensible posture treat HIPAA as a continuous operational responsibility rather than an annual documentation exercise. Pal Forge IT provides HIPAA compliance support including risk assessments, technical safeguard implementation, continuous monitoring through Vanta, and policy documentation.