Medical Office HIPAA Compliance Walk-Through Checklist [FREE PDF]

HIPAA's Privacy Rule (45 CFR Part 164, Subpart E) and Security Rule (45 CFR Part 164, Subpart C) require medical offices to implement administrative, physical, and technical safeguards protecting all forms of Protected Health Information (PHI). The HHS Office for Civil Rights conducts routine audits and can impose penalties up to $1.9 million per violation category per year. This walk-through checklist helps Practice Managers and Compliance Officers identify gaps before an OCR audit or accredita

  • Industry: Urgent Care
  • Frequency: Quarterly
  • Estimated Time: 45-60 minutes
  • Role: Compliance Officer
  • Total Items: 34
  • Compliance: HIPAA Privacy Rule 45 CFR Part 164 Subpart E, HIPAA Security Rule 45 CFR Part 164 Subpart C, HITECH Act 42 U.S.C. § 17931, Joint Commission Standard IM.02.01.01, ADA Title III 28 CFR Part 36

Physical Safeguards & Facility Access Controls

Assess physical barriers and access controls that protect PHI from unauthorized viewing or removal.

  • Are workstations positioned so PHI on screens cannot be viewed by unauthorized individuals or patients in waiting areas?
  • Are all areas where PHI is stored or processed locked when unattended?
  • Is there a visitor sign-in log maintained at all access-controlled entry points?
  • Are paper PHI documents stored in locked filing cabinets when not in use?
  • Is a secure shredding container or locked bin available for paper PHI disposal?

Technical Safeguards & Electronic PHI Security

Evaluate technical controls protecting electronic PHI (ePHI) on workstations, servers, and portable devices.

  • Are all workstations configured to auto-lock after no more than 10 minutes of inactivity?
  • Is multi-factor authentication (MFA) enabled for all EHR and ePHI systems?
  • Are all portable devices (laptops, tablets, USB drives) containing ePHI encrypted?
  • Are audit logs enabled and regularly reviewed for all systems accessing ePHI?
  • Is the organization's network protected by an active, monitored firewall with current rule sets?
  • Have all default passwords been changed on network equipment, routers, and clinical devices?

Administrative Safeguards & Policies

Review policies, workforce training, and administrative procedures required by the HIPAA Security Rule.

  • Has a formal, documented HIPAA Security Risk Analysis been completed within the past 12 months?
  • Does the practice have a designated HIPAA Privacy Officer and Security Officer?
  • Have all workforce members completed HIPAA training within the past 12 months?
  • Is there a documented and tested Breach Notification Policy aligned with 45 CFR §164.400–414?
  • Are Business Associate Agreements (BAAs) in place and current with all vendors handling PHI?

Patient Rights & Notice of Privacy Practices

Confirm that patient rights processes and Notice of Privacy Practices (NPP) meet HIPAA Privacy Rule requirements.

  • Is a current Notice of Privacy Practices (NPP) prominently displayed and available at the front desk?
  • Is there a documented process for patients to request access to their PHI within 30 days?
  • Are patient authorization forms for non-TPO PHI disclosures compliant with all eight required elements?
  • Is there a documented process for handling patient complaints related to privacy?
  • Are patient amendments to their PHI handled and documented per the required process?

Minimum Necessary & PHI Disclosure Practices

Evaluate whether staff limit PHI access and disclosures to the minimum necessary for the intended purpose.

  • Are role-based access controls in place so staff can only access PHI relevant to their job functions?
  • Is fax transmission of PHI handled using a HIPAA-compliant fax cover sheet with a confidentiality notice?
  • Are verbal discussions of PHI conducted in private or low-traffic areas to prevent incidental disclosure?
  • Is there documentation showing periodic review of user access privileges to confirm appropriateness?

ADA Accessibility & Accommodations

Confirm the facility provides equal access and effective communication for patients with disabilities.

  • Are accessible parking spaces, ramps, and pathways available and properly marked per ADA standards?
  • Are auxiliary aids (sign language interpreter, written materials, TTY) available for patients with communication disabilities?
  • Are examination tables and medical equipment accessible to patients with mobility impairments?
  • Are restrooms accessible and compliant with ADA dimensional requirements for turning radius and grab bars?

Incident Response & Documentation

Verify readiness to detect, report, and document potential HIPAA incidents and security events.

  • Is there a written Incident Response Plan that defines roles, timelines, and notification procedures?
  • Have all reportable incidents from the past 12 months been logged and reviewed?
  • Is there evidence that the Breach Notification process was tested or table-top exercised within the past year?
  • Are HIPAA documentation and policies retained for a minimum of 6 years from creation or last effective date?
  • Are findings from this walk-through documented and assigned corrective action owners with deadlines?

Related Health Services Checklists

Related Urgent Care Checklists

Why Use This Medical Office HIPAA Compliance Walk-Through Checklist [FREE PDF]?

This medical office hipaa compliance walk-through checklist [free pdf] helps urgent care teams maintain compliance and operational excellence. Designed for compliance officer professionals, this checklist covers 34 critical inspection points across 7 sections. Recommended frequency: quarterly.

Ensures compliance with HIPAA Privacy Rule 45 CFR Part 164 Subpart E, HIPAA Security Rule 45 CFR Part 164 Subpart C, HITECH Act 42 U.S.C. § 17931, Joint Commission Standard IM.02.01.01, ADA Title III 28 CFR Part 36. Regulatory-aligned for audit readiness and inspection documentation.

Frequently Asked Questions

What does the Medical Office HIPAA Compliance Walk-Through Checklist [FREE PDF] cover?

This checklist covers 34 inspection items across 7 sections: Physical Safeguards & Facility Access Controls, Technical Safeguards & Electronic PHI Security, Administrative Safeguards & Policies, Patient Rights & Notice of Privacy Practices, Minimum Necessary & PHI Disclosure Practices, ADA Accessibility & Accommodations, Incident Response & Documentation. It is designed for urgent care operations and compliance.

How often should this checklist be completed?

This checklist should be completed quarterly. Each completion takes approximately 45-60 minutes.

Who should use this Medical Office HIPAA Compliance Walk-Through Checklist [FREE PDF]?

This checklist is designed for Compliance Officer professionals in the urgent care industry. It can be used for self-assessments, team audits, and regulatory compliance documentation.

Can I download this checklist as a PDF?

Yes, this checklist is available as a free PDF download. You can also use it digitally in the POPProbe mobile app for real-time data capture, photo documentation, and automatic reporting.

Browse More Checklists