HIPAA Compliance Checklist for HR

In 1996, the United States Government passed a legislation for the privacy and safeguarding of all medical data. 

This legislation is known as the Health Insurance Portability and Accountability Act, but is more commonly referred to as HIPPA (which is thankfully, easier to remember).

Anyone in the healthcare industry who deals with Protected Health Information (PHI), must comply with HIPAA Rules.

What happens if you don’t comply with HIPAA rules? 

You have to pay out a lot of money. And I mean a lot. The following healthcare providers didn't fully comply with HIPPA and are great examples of the kind of money we're talking about: 

The University of California Los Angeles Health System was fined $865,000 for failing to restrict access to medical records.

North Memorial Health Care of Minnesota had to pay $1.55 million in a settlement, for failing to enter into a Business Associate Agreement with a major contractor.

The Memorial Healthcare System received a $5,500,000 penalty for insufficient ePHI access controls.

The Memorial Hermann Health System had to pay $2.4 million in a settlement for disclosing a patient’s PHI in a press release.

It clearly pays to be compliant.

What do you have to do to be HIPAA compliant? 

HIPAA compliance is a series of regulatory standards which outline the lawful use and disclosure of PHI. 

Healthcare entities must perform ongoing technical and non-technical evaluations to establish if their security policies and procedures meet these regulatory standards.

Don’t be fooled though.

It may sound simple, but HIPAA compliance is never 100% complete.

Changes to medical processes, technology, policies, procedures, staffing, HIPAA rules, and business practices all mean a change to the environment and will easily render a HIPAA certification invalid.

To prove this point, researchers found, in the first 6 months of 2019, a total of 285 incidents were reported.

Luckily, Process Street is here to help. 

HIPAA requires transparency first and foremost, which means activity revolving around regulated data systems may be audited at any time. 

The HIPAA compliance checklist that Process Street has created will make sure you are ready for an audit. 

We’ve created a series of tasks and questions, based on the advice given by the HHS’ Office for Civil Rights and the HIPAA Journal, about the measures your organization should have in place to keep you HIPAA compliant. 

A word of warning!

This checklist allows you to self-evaluate HIPAA compliance in your organization.

However, successfully completing this checklist does not guarantee you are HIPAA compliant.

To be safe, you should always consult a HIPAA compliance expert.  

Process Street is super-powered checklists. It’s the easiest way to manage your recurring tasks, procedures and workflows. Create a template and run individual checklists for each member of your team. You can check tasks off as you work through them, set deadlines, add approvals, assign tasks, and track each team member's progress. You can also connect to thousands of Apps through Zapier and automate your workflows even more.

Fill out the checklist information in the fields below.

The date of the next audit should be 1 year after the date of the assessment.

You can either select the next audit date in the field below, or you can use the dynamic due dates feature to automatically set the date.

Find out more about setting dynamic due dates here. 

Assign the below tasks to the relevant internal HIPAA representatives so they can ensure that their department / assigned area of focus is compliant.

Assign task 12 to the designated HIPAA Compliance, Privacy, and/or Security Officer

Assign tasks 18 - 26 to the IT lead

Complete and upload the security audit for this year's assessment.

Identify the gaps found during the audit and create and upload a remediation plan to address these gaps.

Current Year

Upload the security audits and remediation plans from the last six years. 

Year 1

Year 2

Year 3

Year 4

Year 5

Year 6

Complete and upload the privacy assessment for this year.

Identify any gaps found during the assessment and create and upload a remediation plan to address these gaps.

Current Year

Upload the privacy assessments and remediation plans from the last six years. 

Year 1

Year 2

Year 3

Year 4

Year 5

Year 6

Complete and upload the HITECH subtitle D audit for this year.

Identify any gaps found during the audit and create and upload a remediation plan to address these gaps.

Current Year

Upload the HITECH subtitle D audits and remediation plans from the last six years. 

Year 1

Year 2

Year 3

Year 4

Year 5

Year 6

Complete and upload the security standards audit for this year.

Identify any gaps found during the audit and create and upload a remediation plan to address these gaps.

Current Year

Upload the security standards audits and remediation plans from the last six years. 

Year 1

Year 2

Year 3

Year 4

Year 5

Year 6

Complete and upload the asset and device audit for this year.

Identify any gaps found during the audit and create and upload a remediation plan to address these gaps.

Current Year

Upload the asset and device audits and remediation plans from the last six years. 

Year 1

Year 2

Year 3

Year 4

Year 5

Year 6

Complete and upload the physical site audit for this year.

Identify any gaps found during the audit and create and upload a remediation plan to address these gaps.

Current Year

Upload the physical site audits and remediation plans from the last six years. 

Year 1

Year 2

Year 3

Year 4

Year 5

Year 6

Send an email to all staff about the annual HIPAA training and deadline.

Upload a registration document, once all staff members have completed the training.

Send an email to all staff about the security awareness training and deadline. 

Upload a registration document, once all staff members have completed the training.

The date of the next security awareness training should be 3 months after the completion of the current security awareness training.

You can either select the next security awareness training date in the field below, or you can use the dynamic due dates feature to automatically set the date.

Find out more about setting dynamic due dates here. 

Develop and upload contingency plans for the below situations. 

Responding to Emergencies 

Upload your policy for responding to general emergency situations and select the date of the policy upload.

You will need to review, test & re-upload this policy, 6 months after the policy was uploaded.

You can either select the date to review, test & re-upload in the field below, or you can use the dynamic due dates feature to automatically set the date.

Find out more about setting dynamic due dates here. 

Continuing Critical Business Processes 

Upload your policy for continuing with critical business processes during emergency situations and select the date of the policy upload.

You will need to review, test & re-upload this policy, 6 months after the policy was uploaded.

You can either select the date to review, test & re-upload in the field below, or you can use the dynamic due dates feature to automatically set the date.

Find out more about setting dynamic due dates here. 

Security Incidents & Breaches

Upload your policy for dealing with security incidents and data breaches and select the date of the policy upload.

Within the security incidents & data breaches policy, make sure you include the following information:

1. a process for tracking and managing investigations for all incidents

2. a process for staff members to anonymously report a privacy/security incident or potential HIPAA violation.

Upload a risk analysis that determines if the encryption of ePHI is needed and confirm the answer in the fields below. 

As encryption is not needed, you will need to implement alternative measures to ensure the confidentiality, integrity, and availability of ePHI.

Create and upload a policy which covers these alternative measures.

As encryption is needed, you will need to guard against unauthorized access of ePHI during electronic transmission. 

Create and upload a policy that covers how you will guard against unauthorized access to ePHI.

Answer the following questions on identity management and upload policies for terminating access to ePHI and device recovery.  

Answer Yes/No to the following questions on ePHI access logs. 

Upload a policy for rendering physical PHI unreadable, indecipherable, and incapable of being reconstructed when no longer required.

Upload a policy for permanently erasing ePHI on electronic devices when they are no longer required, or the devices reach end of life.

Answer the following question to establish if devices containing ePHI/ PHI are stored securely.

Create and upload a policy for providing patients with access to their health information.

This policy must include detailed processes around:

1. providing individuals with access to their health information or copies of their health information on request  

2. providing copies of PHI in the format requested by the individual

3. providing copies of PHI in the format requested by the individual

4. providing individuals with copies of their health information in a timely manner and within 30 days

5. reasonable and cost-based fees

Upload HIPAA authorizations for uses and disclosures of PHI, not otherwise permitted by the HIPAA Privacy Rule.

Stored authorizations must: 

1. be written in plain language

2. state the classes of people to whom PHI will be disclosed

3. include an expiry date 

4. contain the individual’s signature and date of signature

Create and upload the notice of privacy in the field below and answer the following questions about the notice of privacy. 

Upload a procedure for dealing with complaints about failures to comply with the NPP

Create and upload policies for the following:

• HIPPA privacy rules
• Security rules 
• Breach notification rules

All uploaded policies must include an ‘’updates’’ section, for annual reviews.

HIPPA Privacy Rules Policy

The HIPPA privacy rules policy must be reviewed 1 year after the date of the upload.

You can either select the next review date in the field below, or you can use the dynamic due dates feature to automatically set the date.

Find out more about setting dynamic due dates here. 

Security Rules Policy

The security rules policy must be reviewed 1 year after the date of the upload.

You can either select the next review date in the field below, or you can use the dynamic due dates feature to automatically set the date.

Find out more about setting dynamic due dates here. 

Breach Notification Rules Policy

The breach notification rules policy must be reviewed 1 year after the date of the upload.

You can either select the next review date in the field below, or you can use the dynamic due dates feature to automatically set the date.

Find out more about setting dynamic due dates here. 

Upload documentation to prove that all staff members have read and legally attested to the HIPAA policies and procedures.

List all your vendors and business associates in the field below. 

Upload Business Associate Agreements (BAA's) for all business associates

All BAA's must be reviewed after 1 year.

You can either select the next review date in the field below, or you can use the dynamic due dates feature to automatically set the date.

Find out more about setting dynamic due dates here. 

Upload business associates HIPAA compliance assessments.

Upload confidentiality agreements for non-business associate vendors here:

Sources 

• Phoenix Nap - HIPAA Compliance Checklist: How Do I Become Compliant?
• True Vault - How do I become HIPAA compliant? (a checklist)
• Security Metrics - HIPAA FAQ: What Is HIPAA?
• HIPAA Journal - What is HIPAA Certification?
• HIPAA Journal - HIPAA Compliance Checklist
• HHS.Gov - HIPAA Enforcement
• Health IT Security - 32M Patient Records Breached in First Half of 2019, 88% Caused by Hacking
• Security Metrics - What Is HIPAA Compliance, And How Long Will It Take?
• Covering Kids & Families - Questions and Answers about the HIPAA Privacy Rule and CKF Participants
• Compliancy Group - What is HIPAA Compliance?
• eVisit - The Ultimate HIPAA Guide
• HIPAA Journal - Memorial Hermann Health System Hit with $2.4 Million HIPAA Fine
• HIPAA Journal - Who Does HIPAA Apply To?
• HIPAA Journal - UCLA Hospitals Receives $865K HIPAA Fine for Failing to Protect Celebrity Medical Records
• HIPAA Journal  - $1.55 Million HIPAA Settlement for Lack of BAA and Risk Analysis Failures
• HIPAA Journal - Record HIPAA Settlement Announced: $5.5 Million Paid by Memorial Healthcare System

Related Checklists

• Employee Background Check
• Employee Relations
• Performance Management
• Performance Review Template
• Recruitment Process
• Ari Meisel's How to Streamline the Hiring Process Guide
• Diversity Checklist Process
• Diversity Management Monthly Audit
• Diversity Questions Survey
• Diversity Training Process
• Copywriter Job Description Template
• Customer Service Manager Job Description Template
• Customer Service Representative Job Description Template
• Editor Job Description Template
• Graphic Designer Job Description Template
• HR Manager Job Description Template
• IT Manager Job Description Template
• Marketing Manager Job Description Template
• Receptionist Job Description Template
• Sales Manager Job Description Template
• Software Developer Job Description Template
• Web Designer Job Description Template
• Web Developer Job Description Template

• Training Plan Template

• Employee Evaluation Form

• Employee Transition Plan

• Gap Analysis Template

• HR Strategic Plan

• Employee Satisfaction Survey

• Workforce Planning Template

• Employee Development Plan Template

• Holiday Leave Application Checklist

• Vacation Request Form

• Business Needs Assessment