If your practice handles patient data, HIPAA is not optional — and most breaches at small practices come down to a handful of IT gaps that are very fixable. Use this checklist to see where your medical or dental practice stands, whether you are in Greenville, Anderson, Spartanburg, or anywhere across the Upstate.
The HIPAA IT compliance checklist
- Access controls — every user has a unique login, strong passwords, and access only to the data they need. No shared accounts.
- Multi-factor authentication (MFA) — enabled on email, your EHR/practice-management system, and remote access.
- Encryption — data encrypted on laptops, servers, and backups, and in transit.
- Encrypted, tested backups — automated backups of imaging and records, with restores you have actually tested.
- Audit logging — you can see who accessed what and when.
- Business Associate Agreements (BAAs) — signed with every vendor that touches PHI, including your IT provider.
- Patch management — operating systems and software kept current so known vulnerabilities are closed.
- Endpoint protection — modern antivirus/EDR on every device.
- Security awareness training — staff trained to spot phishing, the #1 way PHI gets exposed.
- A written incident response plan — you know exactly what to do if a breach happens.
- Risk assessment — a documented security risk analysis, which HIPAA specifically requires.
Where practices usually slip
The most common gaps we see are missing MFA, backups that were never tested, no signed BAA with a vendor, and no documented risk assessment. Any one of these can turn a small incident into a reportable breach with real penalties.
You do not have to do this alone
A good IT partner builds these safeguards in, documents them for audits, and signs a BAA so your compliance is a shared responsibility, not a solo scramble.
Frequently Asked Questions
Does HIPAA require a specific IT setup?
HIPAA does not name specific products, but it requires safeguards: access controls, encryption, audit logs, a risk assessment, and more. The checklist above maps to those requirements in plain language.
Do I need a BAA with my IT company?
Yes. Any vendor that can access, store, or transmit protected health information must sign a Business Associate Agreement. safeIT signs a BAA with every healthcare client.
How often should we do a HIPAA risk assessment?
At least annually, and any time you make a major change — a new system, a new location, or a move to the cloud. It is one of the most commonly missed HIPAA requirements.
Not sure where your practice stands? Get a free assessment and we will walk the checklist with you. See how we support cybersecurity for Upstate practices.