HIPAA GUIDE · Updated October 15, 2026
HIPAA Basics Checklist for Small Wellness Practices (2026)
A short, practical list for a 1–10 person practice. Each item links to HHS.gov.
Not legal advice. This is general information for small practices, summarized from HHS.gov. Talk to a healthcare attorney or qualified compliance professional about your specific situation.
Privacy Rule (HHS)
- Designate a privacy official.
- Have a Notice of Privacy Practices and give it to patients.
- Use and share only the minimum necessary information.
- Have a process for patient requests to access their records.
Security Rule (HHS)
- Designate a security official.
- Complete and document a security risk analysis and update it periodically (HHS risk analysis guidance).
- Use access controls, unique logins and encryption on laptops and phones.
- Train all staff and keep records of training.
Breach Notification Rule (HHS)
- Have a written breach response procedure.
- Per HHS, notify affected individuals without unreasonable delay and no later than 60 days after discovery.
- Breaches affecting 500+ people require notice to HHS within 60 days (and media notice if more than 500 residents of a state); smaller breaches can be reported to HHS annually.
Vendors
Get a signed BAA from every vendor that creates, receives, stores or transmits patient information for you. See BAAs explained.
FAQ
Does HIPAA apply to cash-only practices?
HIPAA applies to covered entities, which generally includes providers who transmit health information electronically in connection with standard transactions such as insurance claims. Cash-only practices should confirm their status with an attorney; many follow HIPAA practices anyway.
How long do I have to report a breach?
Per HHS, individual notices are due without unreasonable delay and no later than 60 days after discovery.