HIPAA Compliance Guide for Modern Healthcare Practices

HIPAA compliance isn't optional. Breaches are expensive: IBM's 2023 Cost of a Data Breach report put the average healthcare breach at $10.93 million, the highest of any industry. Small practices face the same rules as large systems, so understanding and maintaining compliance matters for everyone.

Understanding HIPAA Basics

The Core Rules

1. Privacy Rule

Protects individually identifiable health information (PHI)
Controls how PHI can be used and disclosed
Gives patients rights over their information, including access to their records

2. Security Rule

Sets safeguards for electronic PHI (ePHI)
Requires administrative, physical and technical protections
Requires a documented risk analysis

3. Breach Notification Rule

Requires notifying affected individuals after a breach of unsecured PHI
Requires reporting breaches to HHS, and to the media when 500 or more residents of a state or jurisdiction are affected
Defines what counts as a breach and how to assess the risk

Essential HIPAA Requirements

Administrative Safeguards

Security Management Process

Conduct a risk analysis and update it regularly
Put security measures in place to reduce the risks you find
Document your policies and procedures

Workforce Security

Control which staff can access ePHI
Have clear authorization procedures
Remove access promptly when someone leaves

Information Access Management

Grant access based on each person's role
Give people only the access their job requires
Review who has access and what they viewed

Security Awareness Training

Train all staff on HIPAA requirements
Provide regular refresher training
Document training completion

Contingency Planning

Have a data backup plan
Write disaster recovery procedures
Plan how you'll keep operating in an emergency

Physical Safeguards

Facility Access Controls

Limit physical access to servers and workstations
Use visitor sign-in procedures
Secure areas where records are kept

Workstation Security

Position screens away from public view
Use privacy filters where needed
Lock computers when unattended

Device and Media Controls

Encrypt laptops, phones and portable drives
Have disposal procedures for old equipment
Track hardware that holds ePHI

Technical Safeguards

Access Controls

Unique user IDs for every staff member
Automatic log-off after inactivity
Encryption for data at rest and in transit

Audit Controls

Record activity in systems that hold ePHI
Review access logs regularly
Investigate anything unusual

Integrity Controls

Protect ePHI from improper changes or deletion
Keep a record of changes to clinical documentation

Transmission Security

Encrypt data sent over networks
Use secure messaging for PHI
Use secure connections for remote access

Common HIPAA Violations to Avoid

Unencrypted devices
- Laptops, phones and tablets without encryption
- Solution: turn on device encryption and remote wipe
Unauthorized access
- Staff looking at records they have no reason to see
- Solution: role-based access and regular access-log reviews
Improper disposal
- Throwing away printed PHI without shredding
- Solution: secure shredding and a written disposal policy
Missing Business Associate Agreements
- Working with vendors that handle PHI without a BAA
- Solution: get a BAA from every vendor that handles PHI
Insufficient training
- Staff unaware of their obligations
- Solution: regular, documented training
Poor password practices
- Weak or shared passwords
- Solution: strong password policies and multi-factor authentication where available
Unsecured email and texting
- Sending PHI through channels without safeguards
- Solution: secure patient portals or encrypted messaging, and documented patient preferences
Personal device risks
- Staff using personal phones or laptops without protection
- Solution: a clear bring-your-own-device policy and device management
Missing risk analysis
- Never assessing security risks, or never updating the assessment
- Solution: regular risk analysis with a remediation plan
No incident response plan
- Unprepared when something goes wrong
- Solution: written incident response procedures that staff know

How Jogaza Protects Patient Data

Jogaza EHR is designed with HIPAA safeguards in mind. It supports the technical side of your program:

Separate data per practitioner: each practitioner's data is kept separate, and every request is checked against the signed-in user
Access logging: every chart view and note change is recorded in an access log, and each patient has a record-access history you can review
Encryption: data is encrypted in transit and at rest
Locked notes: signed notes are locked, and corrections are added as dated addenda
Limited recording retention: AI scribe audio is deleted once it has been transcribed, and a practice can choose to remove the full transcript when a note is signed
Recording consent: the clinician confirms the patient agreed to be recorded before the AI scribe starts, and the chart shows whether an AI-consent form is on file
Secure portal messaging: patients sign in to the web portal with a one-time email code and message the practice there instead of through regular email

Software is only one part of compliance. Your risk analysis, policies, training and vendor agreements are still your practice's responsibility.

Creating Your HIPAA Compliance Program

Step 1: Conduct a Risk Analysis

Identify everywhere PHI is created, stored or sent
Evaluate your current safeguards
Identify threats and vulnerabilities
Document findings and prioritize risks

Step 2: Develop Policies and Procedures

Write your security and privacy policies
Set incident response procedures
Define training requirements
Document your sanction policy

Step 3: Implement Security Measures

Encrypt devices
Set up role-based access
Turn on audit logging
Put backups in place

Step 4: Train Your Staff

Train everyone when they start
Add role-specific training
Schedule regular refreshers
Keep records of completion

Step 5: Put BAAs in Place

Identify every business associate
Sign a BAA with each one
Review agreements periodically

Step 6: Monitor and Audit

Review access logs regularly
Hold periodic security reviews
Update your risk analysis when things change
Update policies as needed

HIPAA Breach Response

Immediate Steps

Contain the incident
Notify your privacy or security officer
Assess what data and which patients were involved
Document everything
Preserve evidence

Notification Requirements

Affected individuals: without unreasonable delay, and no later than 60 days after discovery
HHS, 500 or more affected: within 60 days of discovery
HHS, fewer than 500 affected: within 60 days after the end of the calendar year
Media: within 60 days when 500 or more residents of a state or jurisdiction are affected
Business associates: must notify the covered entity without unreasonable delay, and no later than 60 days after discovery

State laws may add their own requirements, so check yours.

Breach Investigation

Determine the cause
Identify what data was exposed
Assess the risk of harm to individuals
Document your findings
Put corrective actions in place

Cost of Non-Compliance

Civil Penalties

HHS uses four penalty tiers based on the level of culpability:

Tier 1: the entity did not know and could not reasonably have known of the violation
Tier 2: reasonable cause, but not willful neglect
Tier 3: willful neglect, corrected within 30 days
Tier 4: willful neglect, not corrected

Penalty amounts are adjusted each year for inflation, so check HHS for the current figures. Serious cases can also bring criminal penalties.

Additional Costs

Legal fees
Forensic investigation
Credit monitoring for affected patients
Damage to your reputation and patient trust
State penalties
Civil lawsuits

HIPAA Compliance Checklist

Annual Tasks

Update your risk analysis
Review and update policies
Provide staff HIPAA training
Review business associate agreements
Test your disaster recovery plan
Review access permissions
Document compliance activities

Monthly Tasks

Review access logs
Check for unusual activity
Apply software and system updates
Review incident reports
Confirm backups are working

Daily Habits

Lock workstations when away
Dispose of printed PHI securely
Use secure channels for PHI
Report security incidents right away

What's Changing

Telehealth: the COVID-era enforcement flexibility for telehealth platforms has ended, so use video tools that meet HIPAA requirements and sign a BAA with the vendor
AI tools: any AI service that handles PHI, such as an ambient scribe, is a business associate and needs the same scrutiny as any other vendor
Security Rule update: HHS proposed changes to the Security Rule in January 2025, including stricter requirements for encryption and multi-factor authentication; check its current status

Conclusion

HIPAA compliance isn't a one-time checklist. It's an ongoing program of risk analysis, safeguards, training and documentation. The right software can make the technical safeguards easier, but the program itself belongs to your practice.

Key takeaways:

Put administrative, physical and technical safeguards in place
Train staff regularly
Keep your risk analysis current
Get a BAA from every vendor that handles PHI
Document your compliance activities
Have an incident response plan and test it

Start your 14-day free trial →