The Complete HIPAA Compliance Process

1. 01

   Discovery & Scope Assessment

   Identify the boundaries of your compliance program: which locations, systems, and workforce members handle PHI. Document your current state against the requirements of 45 CFR 164.306(a). This determines what the remaining seven steps need to cover.

   HIPAA gap analysis services
   164.306(a)

   Key deliverablesPHI inventory, system inventory, workforce roster, scope document.
2. 02

   Security Risk Assessment

   Conduct a thorough SRA (Security Risk Assessment) as required by 45 CFR 164.308(a)(1)(ii)(A). Identify every system, device, and workflow that stores, transmits, or accesses ePHI. Document threats and vulnerabilities, rate risk levels, and create a prioritized remediation plan.

   The rule reads: Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate. (Source: 45 CFR 164.308(a)(1)(ii)(A))

   OCR runs a Risk Analysis Initiative focused on this requirement, and its 2016-2017 audits found most audited organizations had not met it. See how the gap analysis and remediation plan are built from the SRA.

   Security Risk Assessment requirements and process
   164.308(a)(1)(ii)(A)

   Key deliverablesCompleted SRA report, risk register, remediation plan with timelines.
3. 03

   Policy & Procedure Development

   Develop written policies and procedures that comply with the Security Rule as required by 45 CFR 164.316(a). Policies must reflect how your practice actually operates, not how a generic template assumes you operate. At minimum, cover privacy, security management, access control, training, device controls, incident response, BAA management, facility access, contingency planning, and sanctions.

   HIPAA policy templates for small practices
   164.316(a)

   Key deliverablesCustomized policy manual, procedure documents, adoption records.
4. 04

   Workforce Training

   Train every workforce member who handles PHI, as required by 45 CFR 164.308(a)(5)(i); new members within a reasonable period after joining (45 CFR 164.530(b)(2)(i)(B)). Training must cover the Privacy Rule, Security Rule, breach reporting, phishing awareness, and your practice-specific policies. Document completion with signed attestations and schedule annual refresher training.

   HIPAA training requirements and program details
   164.308(a)(5)(i)

   Key deliverablesTraining curriculum, completion records, signed attestations, refresher schedule.
5. 05

   BAA Management

   Identify every vendor and subcontractor that creates, receives, maintains, or transmits PHI on your behalf. Execute Business Associate Agreements as required by 45 CFR 164.502(e) and 164.308(b)(1). Maintain a current BAA inventory and review vendor compliance annually.

   BAA management and vendor compliance
   164.502(e)164.308(b)(1)

   Key deliverablesVendor inventory, executed BAAs, annual review schedule.
6. 06

   Incident Response & Breach Preparedness

   Establish an incident response plan covering breach identification, containment, risk assessment, notification timelines, and documentation. Meet the notification requirements of 45 CFR 164.404(b), 164.406, and 164.408. Conduct tabletop exercises so your team knows what to do before a breach occurs.

   The rule reads: Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach. (Source: 45 CFR 164.404(b))

   Incident response and breach management
   164.404(b)164.406164.408

   Key deliverablesIncident response plan, notification procedures, tabletop exercise records.
7. 07

   Evidence Packaging & Documentation

   Organize and retain all compliance documentation for at least six years as required by 45 CFR 164.530(j). This includes your completed SRA, written policies, training records, BAA inventory, incident reports, and remediation evidence. If OCR investigates, this documentation is your evidence of a systematic compliance effort.

   The rule reads: A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later. (Source: 45 CFR 164.530(j)(2))

   Documentation requirements and starting point
   164.530(j)

   Key deliverablesOrganized compliance binder, document retention schedule, evidence index.
8. 08

   Annual Review & Sustainment

   Review and update your entire compliance program on a regular schedule; once a year is a common cadence. HIPAA itself calls for a periodic evaluation (45 CFR 164.308(a)(8)) and periodic review of documentation (164.316(b)(2)(iii)), and again after environmental or operational changes. Reassess risks when systems or workflows change, update policies accordingly, retrain staff, verify BAA currency, and test your incident response plan. Compliance is not a one-time project.

   Vendor management and annual review services
   164.308(a)(8)164.316(b)(2)(iii)

   Key deliverablesAnnual review report, updated SRA, policy revision log, training refresher records.

Timelines vary based on practice size, complexity, and existing documentation. Larger organizations or those with multiple locations may need additional time.

Results from real engagements

Three anonymized before-and-after results from the case studies page, each from work Chuck did directly:

One Guy Consulting in 37 seconds

Secure checkout by Stripe. Your payment details go straight to Stripe and never touch our servers.