What HIPAA Compliance Requires From a Practice

Three definitions from 45 CFR 160.103 run through everything below. PHI (protected health information: individually identifiable health information, transmitted or maintained in any form or medium) is what HIPAA protects. ePHI (electronic protected health information: PHI transmitted by or maintained in electronic media) is the part the Security Rule covers. A business associate (a person or company, other than a member of your workforce, that creates, receives, maintains, or transmits PHI on a covered entity's behalf) carries its own Security Rule duties.

Every covered entity and business associate must satisfy five core obligations under the HIPAA Privacy and Security Rules (45 CFR Parts 160 and 164):

1. Security Risk Assessment (SRA, the documented risk analysis the Security Rule requires). An accurate, thorough analysis of risks to electronic PHI, required by 45 CFR 164.308(a)(1)(ii)(A). OCR runs a Risk Analysis Initiative focused on this requirement.
2. Written policies and procedures. Reasonable and appropriate policies, kept in writing and tailored to your operations, per 45 CFR 164.316(a). Because 164.316(a) ties policies to the factors in 164.306(b)(2), such as the practice's size and complexity, a template has to be adapted to the practice.
3. Workforce training. Security awareness and training for every workforce member, per 45 CFR 164.308(a)(5)(i), with a written record that it was provided (45 CFR 164.530(b)(2)(ii) for Privacy Rule training).
4. Business associate agreements. A signed BAA (business associate agreement, the written contract that documents a vendor's promise to safeguard PHI) with every vendor that creates, receives, maintains, or transmits PHI on your behalf, per 45 CFR 164.308(b)(1) and 45 CFR 164.502(e).
5. Technical safeguards. Access controls, audit controls, integrity controls, authentication, and transmission security, per 45 CFR 164.312.

Compliance documentation must be retained for six years from creation or the date it was last in effect, whichever is later, per 45 CFR 164.316(b)(2). One Guy Consulting's software and 1:1 implementation calls walk a practice through building each of these records.

Two results from my case studies. In Case 01, a Florida mental health franchise office whose policies were never written got audit-ready in under a week and passed its state audit. In Case 03, a health group with more than 100 offices lifted take-up of its HIPAA compliance program by about 17% after office-by-office outreach.

Official guidance: HHS: HIPAA, HHS: the Security Rule, and HHS OCR: compliance and enforcement.

Each obligation below lists who owns it, what the rule text asks for, when it happens, and what to keep on file. When I walk a practice through the One Guy Consulting software and process, these five obligations are what the work produces.

1. Security Risk Assessment

• Who: the security official your practice must identify under 45 CFR 164.308(a)(2), the person responsible for developing and implementing the Security Rule policies and procedures.
• What: list every system and device that creates, receives, maintains, or transmits ePHI (the EHR, email, laptops, phones, backups, cloud apps). For each one, assess the potential risks and vulnerabilities to the confidentiality, integrity, and availability of that ePHI. Then implement security measures that reduce those risks to a reasonable and appropriate level, the risk management step in 164.308(a)(1)(ii)(B).
• When: the Security Rule text sets no fixed calendar interval for the assessment. It does require a periodic evaluation in response to environmental or operational changes affecting the security of ePHI (164.308(a)(8)) and review of security measures as needed (164.306(e)), so a new EHR, a new office, or a new vendor is a reason to revisit it.
• Keep on file: the written assessment and the risk management plan. 164.316(b)(1)(ii) requires a written record of any action, activity, or assessment the Security Rule requires to be documented.

Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.

45 CFR 164.308(a)(1)(ii)(A), Risk analysis (Required)

2. Written policies and procedures

• Who: the security official for Security Rule policies, and the privacy official a covered entity must designate under 45 CFR 164.530(a)(1)(i) for Privacy Rule policies.
• What: write policies that fit your practice, taking into account its size, complexity, and capabilities, its technical infrastructure, the costs of security measures, and the probability and criticality of risks to ePHI (164.306(b)(2)). Keep them in written form, which may be electronic (164.316(b)(1)(i)), and make them available to the people who carry out the procedures (164.316(b)(2)(ii)).
• When: review documentation periodically and update it as needed in response to environmental or operational changes affecting the security of ePHI (164.316(b)(2)(iii)). A policy can change at any time, provided the change is documented and implemented (164.316(a)).
• Keep on file: each version of each policy, for six years from the date it was created or last in effect, whichever is later (164.316(b)(2)(i)).

3. Workforce training

• Who: all members of the workforce, including management (164.308(a)(5)(i)). Workforce (employees, volunteers, trainees, and other people whose work is under the practice's direct control, paid or not, per 45 CFR 160.103) is broader than payroll.
• What: a security awareness and training program. Its addressable parts are security reminders, protection from malicious software, log-in monitoring, and password management (164.308(a)(5)(ii)). A covered entity must also train its workforce on its privacy policies and procedures as needed for each person's job (164.530(b)(1)).
• When: each new workforce member within a reasonable period of time after joining, and each member whose job is affected by a material change in the policies, within a reasonable period after the change takes effect (164.530(b)(2)(i)).
• Keep on file: proof that the training was provided (164.530(b)(2)(ii)), such as who completed it and on what date.

4. Business associate agreements

• Who: the covered entity signs with each business associate, and a business associate signs with each subcontractor that handles ePHI on its behalf (164.308(b)(2)).
• What: list every outside vendor (tech, billing, software, advice, admin work) and sort out which ones create, receive, maintain, or transmit PHI on your behalf. Each of those needs a written contract in which the vendor agrees, among other terms, to comply with the Security Rule, to bind its own subcontractors to the same terms, and to report any security incident, including breaches of unsecured PHI (164.314(a)(2)(i)).
• When: before the vendor handles PHI. The rule lets a business associate handle ePHI only if the covered entity obtains satisfactory assurances that it will safeguard the information (164.308(b)(1)), so the agreement comes first.
• Keep on file: every signed agreement, plus the vendor list that shows which vendors needed one.

5. Technical safeguards

• Who: the security official, together with whoever runs the practice's computers and software.
• What: access control (unique user identification and an emergency access procedure are required; automatic logoff and encryption are addressable), audit controls that record and examine activity in systems that contain or use ePHI, integrity controls, person or entity authentication, and transmission security for ePHI sent over an electronic communications network (164.312(a) through (e)).
• Addressable items: assess whether each one is reasonable and appropriate in your environment. If it is, implement it. If it is not, document why and implement an equivalent alternative measure if reasonable and appropriate (164.306(d)(3)). Addressable does not mean optional.
• Keep on file: the written decision for each addressable item and the records that show the controls are in place.

The same five obligations in one view. Every cite is to 45 CFR.

In Case 01, I was working with a mental health franchise office in Florida that had a state auditor due in days. Its policies were never written, its records had holes, and staff training was half done. Working from a ranked action plan with daily check-ins, the office got audit-ready in under a week and passed its state audit.

In Case 05, a single-location practice found several vendors handling PHI with no BAA in place. It got every missing BAA signed and set up a vendor review it can run again, which is obligation 4 above.

To see where your practice stands on all five, book a free 30-minute intro call.

What are the five core HIPAA obligations for a practice?

A Security Risk Assessment, written policies and procedures, workforce training, business associate agreements, and technical safeguards, drawn from the HIPAA Privacy and Security Rules in 45 CFR Parts 160 and 164.

How long does HIPAA documentation have to be kept?

Six years from the date it was created or the date it was last in effect, whichever is later. That is 45 CFR 164.316(b)(2)(i) for Security Rule documentation and 45 CFR 164.530(j)(2) for Privacy Rule documentation.

How often does a Security Risk Assessment have to be updated?

The Security Rule text sets no fixed calendar interval. It requires a periodic evaluation in response to environmental or operational changes affecting the security of ePHI (45 CFR 164.308(a)(8)), and periodic review and update of documentation (45 CFR 164.316(b)(2)(iii)).

Which vendors need a business associate agreement?

Any vendor that creates, receives, maintains, or transmits PHI on your behalf (45 CFR 160.103 and 164.502(e)). A business associate needs the same written assurances from its own subcontractors (45 CFR 164.308(b)(2)).

Is One Guy Consulting a law firm?

No. Chuck Weiselberg is not an attorney and One Guy Consulting is not a law firm. Content on this site is not legal advice.