HIPAA Compliance Checklist
Interactive checklist covering all HIPAA Security Rule requirements. Track your compliance progress as you build healthcare applications.
Administrative Safeguards
0/11Physical Safeguards
0/4Technical Safeguards
0/9Organizational Requirements
0/2Policies & Documentation
0/4Understanding HIPAA Security Rule
Administrative (11)
Policies, procedures, and workforce management for ePHI security
Physical (4)
Physical access controls for facilities and workstations
Technical (9)
Access control, encryption, audit, and transmission security
Disclaimer
This checklist is for informational purposes only and does not constitute legal advice. HIPAA compliance requirements may vary. Consult with a qualified healthcare compliance professional for specific guidance.
Frequently Asked Questions
What is HIPAA?
HIPAA (Health Insurance Portability and Accountability Act) is a US federal law that protects sensitive patient health information. The HIPAA Security Rule specifically establishes standards for protecting electronic protected health information (ePHI).
Who must comply with HIPAA?
Covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates that handle ePHI must comply with HIPAA. This includes healthcare app developers who handle patient data.
What is the difference between Required and Addressable specifications?
Required specifications must be implemented. Addressable specifications require you to assess whether the implementation is reasonable and appropriate. If not, you must document why and implement an equivalent alternative measure.
What are the penalties for HIPAA violations?
Penalties range from $100 to $50,000 per violation (up to $1.5 million per year) for civil violations. Criminal penalties can include fines up to $250,000 and imprisonment for willful neglect or wrongful disclosure.
What is ePHI?
Electronic Protected Health Information (ePHI) is any protected health information that is created, stored, transmitted, or received electronically. This includes patient records, lab results, billing information, and any data that could identify a patient.
Do I need a Business Associate Agreement?
Yes, if you work with any third party that will have access to ePHI (cloud providers, subcontractors, etc.), you need a signed Business Associate Agreement (BAA) that ensures they will also protect the data.
How often should I conduct a risk assessment?
HIPAA requires periodic risk assessments, but doesn't specify frequency. Best practice is to conduct assessments annually, and whenever significant changes occur to your systems, processes, or environment.
Is encryption required under HIPAA?
Encryption is 'addressable' under HIPAA, meaning you must implement it if reasonable and appropriate. Given modern standards and the cost of breaches, encryption at rest and in transit is considered essential for most healthcare applications.
Need Help Building a HIPAA-Compliant App?
We specialize in building secure, compliant healthcare applications. Let us help you navigate the technical requirements.