HIPAA Compliance Checklist: Security Rule Requirements, Privacy and Breach Notification (2026)

This HIPAA compliance checklist walks through what the HIPAA rules require of covered entities and business associates as of September 2026: every Security Rule standard and implementation specification, marked required or addressable, followed by the Privacy Rule and Breach Notification Rule items, and the evidence to keep for each. It is written for practices, health-tech companies and the vendors that handle patient data for them, and it reflects the rule as it stands today, not the proposed update, which is covered separately below.

Two things up front. There is no official HIPAA certification: HHS does not require one, and it has said private “certifications” do not relieve an organization of its Security Rule obligations (HHS FAQ). And Invadel’s part in HIPAA is the testing: the penetration tests and scans that feed your risk analysis and your periodic evaluation. The checklist is useful whether or not you use us for that.

Who needs this HIPAA compliance checklist

You are	Examples	What applies
A covered entity	Health care providers that conduct standard transactions such as claims electronically, health plans, health care clearinghouses	Privacy Rule, Security Rule and Breach Notification Rule in full
A business associate	Billing companies, EHR and practice-management vendors, cloud hosts, IT and security providers, any vendor that creates, receives, maintains or transmits PHI for a covered entity	The Security Rule directly, the Privacy Rule uses and disclosures your business associate agreement allows, and breach notification to the covered entity
A subcontractor of a business associate	A hosting provider or developer working for a health-tech vendor	The same as a business associate, under a subcontractor agreement

The HIPAA rules this checklist covers

Rule	Where it lives	What it governs
Privacy Rule	45 CFR Part 164, Subpart E	Who may use and disclose protected health information (PHI), and patients’ rights over it
Security Rule	45 CFR Part 164, Subpart C	Administrative, physical and technical safeguards for electronic PHI (ePHI)
Breach Notification Rule	45 CFR Part 164, Subpart D	Who must be told about a breach of unsecured PHI, and how fast
Enforcement Rule	45 CFR Part 160	Investigations, penalties and hearings

The 2013 Omnibus Rule amended all of these, implementing the HITECH Act changes that made business associates directly liable under the Security Rule. HIPAA has no official list of “five rules”; when people ask for one, these four plus the Omnibus Rule are the usual answer, though some lists include the Transactions and Code Sets Rule instead. Penalty amounts are adjusted for inflation each year; our guide to data breach fines and penalties sets out the current tiers.

Step one: the risk analysis

Everything in the Security Rule hangs off one required implementation specification: an accurate and thorough assessment of the risks and vulnerabilities to the confidentiality, integrity and availability of the ePHI you hold (164.308(a)(1)(ii)(A)). The safeguards you choose, and the addressable ones you decide not to implement, are justified by it.

It is also the requirement OCR checks first. OCR has run a Risk Analysis Initiative, a series of enforcement actions focused on this single provision (HHS announcement of one such settlement), and a missing or superficial risk analysis is a recurring finding in its resolution agreements. A usable one:

• Covers every system, device and vendor that creates, receives, maintains or transmits ePHI, not only the EHR.
• Identifies realistic threats and existing vulnerabilities for each, with likelihood and impact.
• Is dated, owned, and updated after significant changes, not written once.
• Uses real evidence where it can. A penetration test turns “the patient portal might expose records” into a finding with proof, and the retest records the fix.

Our security risk assessment guide walks through the method step by step.

Administrative safeguards checklist (164.308)

(R) means required; (A) means addressable, explained further down. The last column is the evidence to have ready if OCR, an auditor or a customer asks.

Standard	Implementation specification	R/A	Evidence to keep
Security management process (a)(1)	Risk analysis	R	Current, dated risk analysis covering all ePHI
	Risk management	R	Risk management plan with owners and dates
	Sanction policy	R	Written sanction policy and records of its use
	Information system activity review	R	Records of regular log and access report reviews
Assigned security responsibility (a)(2)	Designated security official	R	Named individual, in writing
Workforce security (a)(3)	Authorization and/or supervision	A	Role-based access procedures
	Workforce clearance procedure	A	Screening procedure for staff with ePHI access
	Termination procedures	A	Leaver checklist showing access removed
Information access management (a)(4)	Isolating health care clearinghouse functions	R	Where a clearinghouse is part of a larger organization
	Access authorization	A	Approval records for access to ePHI systems
	Access establishment and modification	A	Access reviews and change records
Security awareness and training (a)(5)	Security reminders	A	Periodic reminders sent to staff
	Protection from malicious software	A	Anti-malware policy and deployment evidence
	Log-in monitoring	A	Failed log-in alerting or review records
	Password management	A	Password policy and enforcement settings
Security incident procedures (a)(6)	Response and reporting	R	Incident response plan and incident log
Contingency plan (a)(7)	Data backup plan	R	Backup configuration and schedule
	Disaster recovery plan	R	Written recovery procedures
	Emergency mode operation plan	R	How ePHI is protected during an emergency
	Testing and revision procedures	A	Records of plan tests and changes
	Applications and data criticality analysis	A	Ranked list of critical systems
Evaluation (a)(8)	Periodic technical and nontechnical evaluation	R	Evaluation reports, including technical testing
Business associate contracts (b)(1)	Written contract or other arrangement	R	Signed business associate agreements for every vendor with ePHI

The evaluation standard (a)(8) is where independent testing earns its place. It requires a periodic technical evaluation of whether your safeguards meet the rule, and a penetration test with a retest is the most direct technical evidence you can produce.

Physical safeguards checklist (164.310)

Standard	Implementation specification	R/A	Evidence to keep
Facility access controls (a)(1)	Contingency operations	A	Facility access procedures during an emergency
	Facility security plan	A	Physical security plan for sites holding ePHI systems
	Access control and validation procedures	A	Badge or key records, visitor logs
	Maintenance records	A	Records of repairs to doors, locks and walls
Workstation use (b)	Workstation use	R	Policy on how workstations with ePHI access are used
Workstation security (c)	Workstation security	R	Physical protections for those workstations
Device and media controls (d)(1)	Disposal	R	Destruction certificates or wipe records
	Media re-use	R	Procedure to remove ePHI before re-use
	Accountability	A	Inventory of hardware and media movements
	Data backup and storage	A	Backup made before equipment is moved

Technical safeguards checklist (164.312)

The technical safeguards are where testing finds the gaps. This is the summary; our guide to HIPAA technical safeguards goes through each one in depth.

Standard	Implementation specification	R/A	What to verify
Access control (a)(1)	Unique user identification	R	No shared accounts on ePHI systems
	Emergency access procedure	R	A tested way to reach ePHI in an emergency
	Automatic logoff	A	Session timeouts on ePHI systems
	Encryption and decryption	A	Encryption of stored ePHI, or a documented reason and alternative
Audit controls (b)	Audit controls	R	Logging of activity on systems that hold ePHI
Integrity (c)(1)	Mechanism to authenticate ePHI	A	Controls that detect improper alteration or destruction
Person or entity authentication (d)	Person or entity authentication	R	Users and systems are who they claim to be; MFA on remote and privileged access is the usual way to show it
Transmission security (e)(1)	Integrity controls	A	Protection against alteration in transit
	Encryption	A	TLS or equivalent on every network path carrying ePHI

What “addressable” really means

Addressable does not mean optional. For each addressable specification you must assess whether it is reasonable and appropriate for your environment, then either implement it, or document why it is not reasonable and appropriate and implement an equivalent alternative measure where that is reasonable and appropriate (164.306(d)(3)). A decision not to encrypt a laptop fleet, with no documented reasoning, is a finding waiting to happen.

Organizational and documentation requirements (164.314 and 164.316)

• Business associate agreements with every vendor that handles ePHI, and subcontractor agreements down the chain, containing the terms the rule requires.
• Written policies and procedures for every standard above.
• Six-year retention. Keep required documentation for six years from when it was created or last in effect, whichever is later (164.316(b)(2)(i)).
• Availability. Documentation must be available to the people who carry out the procedures.
• Periodic review. Review and update documentation in response to environmental or operational changes that affect ePHI security.

Privacy Rule checklist (Subpart E)

• Privacy official and contact person designated in writing (164.530(a)).
• Notice of Privacy Practices published and provided as the rule requires (164.520).
• Minimum necessary. Uses, disclosures and requests limited to the minimum PHI needed (164.502(b) and 164.514(d)).
• Patient rights handled: access to records (164.524), amendment (164.526), accounting of disclosures (164.528), and requests for restrictions or confidential communications (164.522).
• Authorizations obtained where a use or disclosure requires one (164.508).
• Administrative requirements: workforce training on privacy policies (164.530(b)), safeguards for PHI in any form (164.530(c)), a complaints process (164.530(d)), sanctions (164.530(e)) and mitigation of harmful disclosures (164.530(f)).
• Documentation retained for six years (164.530(j)).

Breach Notification Rule checklist (Subpart D)

Obligation	Deadline
Notify affected individuals	Without unreasonable delay and no later than 60 calendar days after discovery (164.404)
Notify HHS, breaches of 500 or more individuals	At the same time as the individual notices (164.408(b))
Notify HHS, breaches of fewer than 500	Log them, and report no later than 60 days after the end of the calendar year (164.408(c))
Notify prominent media outlets, for breaches affecting more than 500 residents of a state or jurisdiction	Without unreasonable delay and no later than 60 calendar days after discovery (164.406)
Business associate notifies the covered entity	Without unreasonable delay and no later than 60 days after discovery (164.410)

Keep a breach risk assessment for every incident you decide was not a reportable breach. The burden of showing that notification was not required sits with you (164.414(b)).

What changes if the proposed Security Rule update is finalized

HHS published a proposed rule to strengthen the Security Rule on January 6, 2025 (90 FR 898). As of September 2026 it has not been finalized, and the current rule above is still the one enforced. Among other changes, the proposal would:

• Remove the distinction between required and addressable specifications.
• Require a written technology asset inventory and a network map of systems that affect ePHI, reviewed at least every 12 months.
• Require vulnerability scanning at least every six months and penetration testing at least every 12 months, by a qualified person.
• Require written procedures to restore critical systems and data within 72 hours.
• Require an audit of compliance with the Security Rule at least every 12 months.

Adopting the proposed testing cadence now costs little extra, and the results are already strong evidence for the current rule’s risk analysis and evaluation standard. Our guide to HIPAA penetration testing requirements tracks the proposal section by section.

Where testing fits in HIPAA compliance

Testing is the technical evidence behind three checklist rows: the risk analysis (findings become the vulnerabilities you rate), the evaluation standard (the test is the technical evaluation), and the technical safeguards (the test checks whether access control, authentication and transmission security actually hold). What that looks like in practice:

• A HIPAA penetration test of the systems that handle ePHI: patient portals, EHR integrations, the internal network and the perimeter. Our HIPAA penetration testing engagements start at $4,200, with a report mapped to the Security Rule and a free retest.
• Validated vulnerability scanning on a cadence, the six-monthly scanning the proposal names. Vulnerability scanning starts at $1,500 per scan.

For organizations with clinical environments, testing is scoped around patient safety: staging environments where possible, no disruptive testing of clinical systems, and a stop contact throughout. Our healthcare penetration testing page covers how. General hospitals in New York also answer to a state hospital cybersecurity regulation on top of HIPAA, covered in our guide to the New York hospital cybersecurity regulation.

Frequently asked questions

What are the HIPAA compliance requirements? Protect PHI under the Privacy Rule, safeguard ePHI under the Security Rule’s administrative, physical and technical standards, and notify individuals, HHS and sometimes the media after a breach. The checklist above lists each requirement with the evidence to keep.

What are the 5 basic rules of HIPAA? There is no official list, but the usual answer is the Privacy Rule, the Security Rule, the Breach Notification Rule, the Enforcement Rule and the 2013 Omnibus Rule that amended them and extended direct liability to business associates. Some lists swap in the Transactions and Code Sets Rule.

What is the new HIPAA rule in 2026? There is a proposed update to the Security Rule, published in January 2025, that would require annual penetration testing, scanning every six months, an asset inventory and network map, and more. As of September 2026 it is still a proposal; the current rule remains in force.

Is there a HIPAA certification? No official one. HHS does not certify organizations, and a private certification does not satisfy the Security Rule on its own. What protects you is a current risk analysis, implemented safeguards and the documentation to prove both.

How often should we do a HIPAA risk analysis? The current rule does not set a fixed interval; it requires the analysis to be accurate and thorough and kept current as your environment changes. An annual review, plus a review after significant changes, is a sensible baseline, and it is what the proposed update would require.

Do business associates need to follow this checklist? Yes. Business associates are directly subject to the Security Rule and must also meet the Privacy Rule terms of their agreements and notify the covered entity of breaches.

Need the technical evidence for your risk analysis or evaluation? Scope a HIPAA test and we will focus it on the systems that actually handle ePHI, at a fixed price with a free retest.