HIPAA Compliance Checklist for Solo Therapists

Identify who is responsible for the practice's HIPAA program, including risk analysis, training, and incident response.

Document annual HIPAA training for yourself, any employees, contractors, billing services, or virtual assistants with PHI access.

Define who can access PHI, how access is granted, modified, and revoked, and how you verify identity before access is granted.

Plan for how you respond to a ransomware attack, natural disaster, or extended outage, including data backup and recovery steps.

Identify threats and vulnerabilities to the confidentiality, integrity, and availability of PHI in your practice.

Apply consistent consequences for HIPAA violations by employees, contractors, or business associates.

Document where and how workstations, laptops, and mobile devices may be used to access PHI, including rules for shared spaces.

Maintain an inventory of every laptop, phone, tablet, and external drive that contains PHI, and label them.

Enable screen lock, privacy filters, and policies that prevent unauthorized viewing during in-person or remote work.

Shred paper records, wipe or destroy hard drives, and document the disposal method for each device and record type.

Use locks, alarm systems, and visitor policies to limit who can enter the space where PHI is stored or discussed.

Every account that touches PHI should have a unique login, a strong password, and multi-factor authentication where possible.

Turn on access logs in your EHR, cloud storage, and email. Review the logs periodically for unusual activity.

Use checksums, version history, and write-once storage to ensure ePHI cannot be silently modified or deleted.

Use TLS for email and messaging, full-disk encryption on devices, and HIPAA-compliant cloud storage for backups.

Set a short inactivity timeout (typically 15 minutes or less) for any device or app that displays PHI.

List your EHR, telehealth platform, billing service, cloud storage, transcription, and any other vendor that touches PHI.

Store the BAA, including the date signed and version, and renew whenever the vendor updates their terms.

Ask vendors that subcontract (e.g., cloud hosting) whether they flow down HIPAA obligations to their subcontractors.

Configure alerts for failed logins, mass downloads, or unusual access patterns in your EHR and cloud storage.

Document who you call, what you preserve, how you investigate, and how you document the incident for HHS.

A breach affecting more than 500 individuals must be reported to HHS within 60 days, with media notice in jurisdictions where required.

For every suspected incident, document the four-factor risk assessment that determines whether a breach is reportable.

Cover administrative, physical, and technical safeguards in a single accessible policy binder (digital or printed).

Make the NPP available on your website, in your intake paperwork, and posted in your office if applicable.

Store signed BAAs, SOC 2 reports, and vendor security questionnaires in a single, organized location.

Record every suspected incident, the investigation, the outcome, and any corrective action, even if it is not reportable.

Re-run the risk analysis, refresh training, and update policies at least once per year or whenever you add a new vendor or service.