HIPAA Compliance Guide for Practice Admins (Short)
A short HIPAA compliance guide for practice admins and owners at 5 to 100 staff clinics. What to keep current, what to ignore, and when to scope a flat-fee assessment.
You are not a full-time compliance officer. You are a practice admin or owner keeping the doors open for roughly 5 to 100 staff. HIPAA still expects a current security risk analysis, workable policies, training records, and evidence that matches how you actually operate.
This is the short version.
Keep these five things current
- 1Security risk analysis. Dated, owned, and usable. Not a three-year-old binder.
- 2Access and MFA. Unique logins. Multifactor on email, EHR, VPN, and remote desktop where those apply.
- 3Backups with a restore test. A dated test beats a marketing claim that backups exist.
- 4Training log. Matches today's roster, not last year's org chart.
- 5Business associate inventory. Who touches PHI, and which BAAs are on file.
Ignore these traps
- 1Free HIPAA assessments that are really lead magnets. Harborline does not offer free assessments. Content and a 30-minute scoping call are free. Paid work is a fixed fee, scoped on a short call.
- 2Buying only a penetration test when the ask is a risk analysis. Different tools. Different outputs.
- 3Waiting for OCR or renewal to invent evidence you do not have.
When to call Harborline
- 1Insurance renewal is 60 to 90 days out and the evidence pack is thin
- 2You received an OCR or auditor letter and need a calm first plan (alongside counsel)
- 3A payer or hospital questionnaire asks for a current risk analysis
- 4You want annual rhythm so next year is not a scramble
Book a 30-minute scoping call
Harborline · Contact · harborlinesec.com
Further reading
HIPAA Security Risk Analysis: What Practices Get Wrong
The most common HIPAA security risk analysis mistakes for practices with 5 to 100 staff, and how to fix them without a free assessment or a checkbox PDF.
HIPAA Security Rule: What Good Looks Like for Practices with 5 to 100 Staff
A practical picture of HIPAA Security Rule readiness for outpatient practices. Administrative, physical, and technical safeguards without enterprise theater.
Ready to talk?
A 30-minute scoping call covers your setup, your deadlines, and what a fixed-fee engagement would look like.