What to Do First When Your Clinic Has No HIPAA Program
A Step-by-Step HIPAA Compliance Starting Point for Small Practices
Start with a HIPAA Security Risk Assessment: identify where ePHI (electronic Protected Health Information: patient data stored, transmitted, or accessed electronically) lives, document threats and vulnerabilities, and prioritize fixes. That process is your SRA (Security Risk Assessment: the documented review of threats, vulnerabilities, and risk to ePHI). If your clinic has never completed a Security Risk Assessment or does not have written HIPAA policies, you are not alone. Most small practices start exactly here. This page tells you what to do first, in what order, and why each step matters.
What HHS Actually Requires
HHS says the Security Rule requires organizations to implement policies and procedures to prevent, detect, contain, and correct security violations. That is not optional guidance. It is a regulatory obligation under 45 CFR 164.306(a).
The short version: Start with a HIPAA Security Risk Assessment, then write and adopt the basic policies and procedures you are missing, assign ownership, train staff, and document the fixes. That sequence covers the foundations HHS expects to see if they ever investigate your practice.
The two most commonly cited deficiencies in OCR enforcement actions are (1) no documented Security Risk Assessment and (2) no written policies and procedures. If your clinic has neither, those are the first two things to fix.
Exactly What to Do First
Start: Security Risk Assessment (SRA)
This is where you start. Every covered entity and business associate must conduct a Security Risk Assessment regardless of size, as required by 45 CFR 164.308(a)(1)(ii)(A). There are no size-based exemptions.
“Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”
45 CFR 164.308(a)(1)(ii)(A), Risk analysis (Required)
The SRA identifies where electronic Protected Health Information (ePHI) lives in your practice - every system, device, and workflow that stores, transmits, or accesses patient data. You document the threats and vulnerabilities to each, rate the risk level, and create a plan to address the highest-risk items first. New to terms like ePHI and BAA (Business Associate Agreement: a contract governing a vendor's handling of PHI)? The HIPAA compliance glossary defines them in plain English.
If OCR investigates your practice, the SRA is the first document they ask for. Not having one is the single most common HIPAA violation found during audits and breach investigations.
Security Risk Assessment requirements and processSecurity Risk Assessment methodology
Running a small clinic? See how to conduct a risk assessment for a small practice.
Policies to Prioritize (the ten foundational policies)
45 CFR 164.316(a) requires written policies and procedures that comply with the Security Rule. Generic templates you downloaded and never customized do not satisfy this requirement.
At minimum, a small practice needs these ten foundational policies:
- Privacy Policy (Notice of Privacy Practices)
- Security Management Process
- Access Control and Authorization
- Workforce Training
- Device and Media Controls
- Incident Response and Breach Notification
- Business Associate Agreement Policy
- Facility Access Controls
- Contingency and Disaster Recovery
- Sanctions Policy
These policies must reflect how your practice actually operates - not how a generic template assumes you operate. Not sure which ones you need? See the complete list of required HIPAA written policies.
Assign Ownership: Privacy & Security Officer
HIPAA requires a designated Privacy Officer and Security Officer. In a small practice, one person can hold both roles. This person is responsible for maintaining your compliance program, responding to incidents, and serving as the point of contact for HIPAA-related questions from staff, patients, and - if it comes to it - OCR.
Without clear ownership, policies sit in a drawer, training does not happen, and vendor agreements go unsigned. Assigning a responsible person turns your compliance program from a stack of documents into an active, maintained system.
Staff Training Requirements and Documentation
45 CFR 164.308(a)(5)(i) requires "a security awareness and training program for all members of its workforce (including management)." The Privacy Rule requires training for each new workforce member "within a reasonable period of time after the person joins the covered entity's workforce" (45 CFR 164.530(b)(2)(i)(B)). Neither section sets a yearly schedule; an annual refresher is a schedule a practice may choose.
Training must cover the Privacy Rule, Security Rule, breach reporting procedures, phishing awareness, and your practice-specific policies. Completion must be documented with signed attestations - OCR does not accept "we trained them verbally."
Document Retention & What OCR Will Ask For
HIPAA requires you to retain all compliance documentation for at least six years under 45 CFR 164.530(j). This includes your completed SRA, written policies, training records with sign-off dates, your BAA inventory, and any incident reports.
If OCR investigates your practice, your documentation is your evidence that you took compliance seriously. A well-documented program - even an imperfect one - is treated far more favorably than no documentation at all.
The Five Steps and the Rules Behind Them
| Step | What it covers | Where the rule is | What to keep on file |
|---|---|---|---|
| 1. Security Risk Assessment | Find where ePHI lives, document the threats and vulnerabilities to it, and rate the risk. | 45 CFR 164.308(a)(1)(ii)(A) | The completed SRA and your plan for the highest-risk items. |
| 2. Written policies | Policies and procedures that match how your practice actually operates. | 45 CFR 164.316(a); 45 CFR 164.530(i)(1) | The adopted policies, in written or electronic form. |
| 3. Ownership | Designate a privacy official and a security official. | 45 CFR 164.530(a)(1); 45 CFR 164.308(a)(2) | A written record of who holds each role (the privacy official designation must be documented under 45 CFR 164.530(a)(2)). |
| 4. Staff training | Security awareness training for all workforce members, including management; Privacy Rule training for each new workforce member within a reasonable period of time. | 45 CFR 164.308(a)(5)(i); 45 CFR 164.530(b) | A record that the training was provided (45 CFR 164.530(b)(2)(ii)). |
| 5. Documentation | Keep the records each step above produces. | 45 CFR 164.316(b)(2)(i); 45 CFR 164.530(j)(2) | All of it, kept six years from the date it was created or last in effect, whichever is later. |
Practices That Started From Nothing
I worked with a mental health franchise office in Florida that had the exact problem this page is about: policies were never written, records had holes, and staff training was half done. A state auditor was due in days. We ran a fast gap analysis, built a ranked plan around what the auditor was most likely to ask for, and held a short check-in each day. The office got audit-ready in under a week and passed its state audit. Read Case 01.
I also worked with a solo eye doctor in a rural town with no compliance team and no IT staff. We cut the work into small, plain tasks he could finish one at a time, and he finished a full HIPAA program. Read Case 02.
The Cost of Waiting
The longer you operate without an SRA and written policies, the greater your exposure if a breach or patient complaint triggers an OCR investigation. Penalties for HIPAA violations range from $145 per violation for unknowing violations up to $2,190,294 per violation category per year for willful neglect.
Most small practice investigations start with one of two things: a reported breach or a patient complaint. In either case, the first thing OCR asks for is your Security Risk Assessment and your written policies. If you do not have them, the investigation gets worse from there.
Getting these five steps in place is the single highest-impact thing you can do to protect your practice. They are the front half of the complete HIPAA compliance process, which adds BAA management, incident response, evidence packaging, and annual review.
Frequently Asked Questions
01What should I do first?+
Complete a Security Risk Assessment.
02Which policies must a small practice have?+
At minimum, the ten foundational policies listed on this page (Privacy Policy, Security Management Process, Access Control, Workforce Training, Device and Media Controls, Incident Response, BAA Policy, Facility Access Controls, Contingency/DR, Sanctions Policy).
03Who should maintain the HIPAA program?+
Designate a Privacy Officer and a Security Officer; in small practices, one person may hold both roles.
04How long must I keep HIPAA compliance documentation?+
Retain compliance documentation for at least six years under 45 CFR 164.530(j).
One Guy Consulting in 37 seconds
Need Help Getting Started?
One Guy Consulting works directly with small practices to build HIPAA compliance programs from scratch. No platform to figure out on your own - Chuck walks you through every step.