If your practice handles patient information, the HIPAA Security Rule expects you to protect it with reasonable administrative, physical, and technical safeguards. For a busy medical or dental office, that can feel overwhelming.

This checklist breaks the technology side into practical steps. Use it to spot gaps and start conversations with your team and your IT provider.

Note: This guide is general information, not legal advice. HIPAA compliance also involves policies, training, and documentation beyond technology. Talk with your compliance advisor or attorney about your specific obligations.

1. Start with a risk assessment

  • ☐ Complete a security risk analysis that identifies where patient data lives and what could put it at risk
  • ☐ Review and update it regularly, and whenever you add new systems, locations, or vendors
  • ☐ Document what you find and what you plan to do about it

The risk analysis is the foundation. Most of the items below come out of it.

2. Get Business Associate Agreements in place

  • ☐ Identify every vendor that can access patient data: IT providers, cloud services, phone and texting providers, billing companies, and others
  • ☐ Make sure each one has signed a Business Associate Agreement (BAA)
  • ☐ Keep copies of your BAAs on file

3. Control who can access what

  • ☐ Every staff member has their own login, with no shared accounts or passwords
  • ☐ Multi-factor authentication (MFA) is turned on for email, remote access, and practice systems wherever possible
  • ☐ People only have access to the systems and data they need for their role
  • ☐ Accounts are disabled promptly when someone leaves
  • ☐ Computers lock automatically when left unattended

4. Protect every device

  • ☐ Keep an up-to-date inventory of computers, laptops, tablets, and phones that access patient data
  • ☐ Encrypt laptops and other portable devices
  • ☐ Use endpoint detection and response (EDR), not just basic antivirus
  • ☐ Apply security updates promptly, and replace computers running unsupported operating systems (Windows 10 reached end of support in October 2025)
  • ☐ Securely wipe or destroy drives before old equipment is discarded

5. Secure email and communication

  • ☐ Use advanced email security to filter phishing and malicious attachments
  • ☐ Use secure methods when sending patient information by email
  • ☐ Make sure patient texting and phone systems are provided by vendors who will sign a BAA

6. Separate and secure your network

  • ☐ Keep guest and patient Wi-Fi completely separate from the network your practice systems use
  • ☐ Use a properly configured business firewall
  • ☐ Require secure, encrypted connections for anyone working remotely
  • ☐ Keep imaging equipment and other specialized devices on appropriately segmented networks

7. Back up and plan for the worst

  • ☐ Back up practice data, including servers, workstations, and cloud services like Microsoft 365
  • ☐ Keep backups protected so ransomware can’t reach them
  • ☐ Test restoring data on a regular schedule
  • ☐ Have a written plan for keeping the practice running during an outage

8. Monitor, log, and respond

  • ☐ Turn on audit logging for systems that store patient information
  • ☐ Make sure someone is actually reviewing security alerts
  • ☐ Have an incident response plan that covers who to call and what to do if you suspect a breach

9. Train your team

  • ☐ Provide HIPAA and security awareness training when staff are hired and on a regular basis
  • ☐ Teach staff how to spot phishing emails and suspicious calls
  • ☐ Make it easy and safe for staff to report mistakes or suspicious activity quickly

10. Document everything

  • ☐ Keep written security policies and procedures
  • ☐ Record your risk assessments, training, and incidents
  • ☐ Keep required HIPAA documentation for at least six years

Keep an eye on changing requirements

HHS has proposed updates to the HIPAA Security Rule that would make some safeguards, such as MFA and encryption, more explicitly required. Requirements can change, so check the current rules or ask your compliance advisor. Either way, the items on this checklist are widely considered good practice.

How CTS helps healthcare practices

Creative Tech Solutions helps medical, dental, and specialty practices implement and manage the technology safeguards that support their HIPAA obligations. We sign Business Associate Agreements, follow written security policies, train our team on HIPAA, and perform regular risk assessments. Our services include managed IT, EDR and email security, secure networks, backup, and practice phone systems.

Want help working through this checklist? Schedule a free consultation, or learn more about our IT services for medical and dental practices.