HIPAA IT Compliance for Medical and Dental Practices

The HIPAA Security Rule requires any practice that is a covered entity to protect electronic patient information with administrative, physical, and technical safeguards, starting with a documented risk analysis. In IT terms that means individual logins, access limited by role, audit logs, encrypted devices and backups, a tested recovery plan, staff training, and a signed business associate agreement with every vendor that handles patient data. A larger update to the rule was proposed in January 2025. As of September 2026 it has not been finalized, so the existing rule is still the law.

This is general information, not legal advice; a healthcare attorney or compliance professional should confirm your practice’s obligations.

Does HIPAA apply to your practice?

HIPAA applies to covered entities and their business associates.

A healthcare provider is a covered entity if it transmits health information electronically in connection with a standard transaction, such as submitting claims to an insurer, checking eligibility, or requesting authorization. Nearly every medical and dental practice that bills insurance electronically, directly or through a billing service, is covered. Size does not matter. A practice that never conducts any of those transactions electronically may fall outside HIPAA, which is a question for an attorney because California’s own medical privacy law, the Confidentiality of Medical Information Act, applies to providers separately.

A business associate is a person or company that creates, receives, maintains, or transmits protected health information on a practice’s behalf. Examples: a billing company, a cloud backup provider, an email host, a practice management software vendor, a shredding service, and an IT provider with access to systems that hold patient data.

The Security Rule protects electronic protected health information, shortened to ePHI: any individually identifiable health information that you create, receive, store, or send in electronic form. That covers the chart, and also appointment reminders, X-ray images, insurance scans, voicemail files, and emails that mention a patient.

What is law now, and what is only proposed?

On January 6, 2025, the U.S. Department of Health and Human Services (HHS) published a proposed rule to strengthen the Security Rule. Public comments closed on March 7, 2025. HHS has not issued a final rule. A proposed rule has no legal force, and the final version could differ or never arrive.

The HHS fact sheet on the proposal describes the main changes. The table compares them with the rule in force today.

Topic	Current rule (in force)	2025 proposal (not in force)
Required vs. addressable	Some specifications are “required”. Others are “addressable”: implement them if reasonable and appropriate, or document why not and use an equivalent measure	Removes the distinction; nearly everything becomes required, with limited exceptions
Encryption of ePHI	Addressable	Required at rest and in transit, with limited exceptions
Multi-factor authentication	Not named; person or entity authentication is required	Required, with limited exceptions
Asset inventory and network map	Implied by the risk analysis	Written inventory and network map, updated at least every 12 months
Vulnerability scans and penetration tests	Not specified	Scans at least every 6 months, penetration test at least every 12 months
Recovery	Contingency plan and data backup required	Written procedures to restore critical systems within 72 hours
Compliance audit	Periodic evaluation required	Audit at least every 12 months
Business associates	Signed agreement with required assurances	Annual written verification of technical safeguards, and notice within 24 hours when a contingency plan is activated

The practical reading: most of the proposal describes controls that a careful practice would adopt anyway. Putting them in place now satisfies today’s rule more convincingly and leaves little to do if the proposal becomes final. “Addressable” has never meant optional. It means the practice must assess the measure and document its decision.

What does the Security Rule require today?

HHS summarizes the rule on its Security Rule page. The standard is flexible by design: safeguards must be “reasonable and appropriate” given the practice’s size, complexity, technical capabilities, costs, and risks. Flexibility applies to how you meet each standard, not whether you do.

Risk analysis

This is the foundation, and it is required. The practice must conduct an accurate and thorough assessment of the risks to the confidentiality, integrity, and availability of all the ePHI it holds, then manage those risks to a reasonable level and keep the documentation.

A workable risk analysis for a small practice lists:

1. Every system that stores or sends ePHI: practice management and EHR software, imaging, email, patient messaging, phones and voicemail, copiers and scanners, laptops, backups, and any cloud storage.
2. Who can access each one, and whether that access still matches their job.
3. How ePHI moves: to labs, insurers, referring providers, billing services, and patients.
4. Realistic threats to each: ransomware, phishing, a lost laptop, a former employee’s active account, a failed server, a fire or flood.
5. The safeguards in place, the gaps, and a dated plan to close them.

HHS and the federal health IT office publish a free Security Risk Assessment Tool aimed at small and medium providers. The tool’s own notice says that using it is not required by law and does not guarantee compliance. It is a structured way to start. Review the analysis whenever systems change and on a regular schedule.

Administrative safeguards

The policies and people layer: a named security official, workforce training, procedures for granting and removing access, a sanctions policy, incident response procedures, and a contingency plan that includes data backup, disaster recovery, and emergency operations.

Physical safeguards

Controls on the places and equipment where ePHI lives: a locked room or cabinet for the server and network gear, screens positioned away from the waiting area, automatic screen locks, a record of where devices go, and secure wiping or destruction of drives before disposal. Copiers and imaging workstations have drives too.

Technical safeguards

• Unique user identification (required). Every person has a separate login. A shared front-desk account makes the audit log meaningless.
• Emergency access procedure (required). A documented way to reach patient data during an outage.
• Audit controls (required). Systems record who accessed what, and someone reviews the records.
• Person or entity authentication (required). Verify that users are who they claim to be. Multi-factor authentication, a second proof of identity such as an authenticator app, is the standard way to do this for email and remote access.
• Integrity controls and transmission security. Protect ePHI from improper alteration and guard it in transit.
• Automatic logoff and encryption (addressable). Assess, implement where reasonable, and document the decision.

IT controls checklist for a small practice

1. Current written risk analysis and a remediation plan with dates.
2. Individual logins for every workforce member in Windows, the practice software, and email. No shared passwords.
3. Role-based access. Front desk, clinical, billing, and administrator roles see only what they need. Remove access on a staff member’s last day.
4. Multi-factor authentication on email, remote access, cloud practice software, and all administrator accounts. See why multi-factor authentication matters.
5. Full-disk encryption on every laptop, desktop, and server (BitLocker on Windows, FileVault on Mac), plus encrypted phones and tablets.
6. Encrypted email or a patient portal for messages containing ePHI. Our guide to email encryption compares the options in Microsoft 365 and Google Workspace.
7. Supported, patched systems. Windows 10 reached end of support on October 14, 2025, so machines still running it need an upgrade or a paid extended security update plan (see our Windows 10 end of life guide). Imaging workstations are the usual holdouts.
8. Managed antimalware on every computer, with alerts that reach a responsible person.
9. Backups that follow the 3-2-1 pattern: three copies, two kinds of storage, one offsite or offline, all encrypted. Test a restore on a schedule and record the result. Our business data backup guide explains the pattern.
10. Network separation. Guest Wi-Fi isolated from clinical systems, and medical devices, cameras, and payment terminals on their own segments.
11. Audit logs turned on and retained in the practice software and in Microsoft 365 or Google Workspace.
12. Automatic screen lock after a short idle period, and privacy screens where the public can see monitors.
13. Device and drive disposal with documented wiping or physical destruction.
14. Workforce training at hire and on a recurring schedule, with phishing examples and attendance records.
15. Business associate agreements on file for every vendor that touches ePHI.
16. Documentation kept for six years, which is the retention period the rule sets for required policies and records.

Ransomware deserves a specific mention because the rule protects availability as well as privacy. If a practice cannot open its charts, that is a Security Rule problem and a patient care problem. The defenses are the items above working together: MFA, patching, training, and backups that an attacker cannot reach. See how to protect a small business from ransomware.

Which vendors need a business associate agreement?

Any vendor that creates, receives, maintains, or transmits ePHI for the practice needs a signed business associate agreement (BAA). HHS publishes sample BAA provisions.

Points that matter for IT:

• Email and file storage. Microsoft states that its HIPAA BAA is available by default through its data protection addendum to customers that are covered entities or business associates, for in-scope services such as Exchange Online, SharePoint, OneDrive, and Teams. Microsoft also states that using its services does not on its own achieve HIPAA compliance. Google offers a BAA for paid Google Workspace accounts that an administrator must review and accept. Free consumer email accounts are not covered by either.
• Backup, phone, fax, texting, and scheduling services usually handle ePHI and need a BAA.
• Your IT provider is a business associate when it can access systems containing ePHI. That includes Coastal Growth Co., so a BAA belongs in place before any work in those systems starts.
• A BAA moves some responsibility, never all of it. The practice still owns its risk analysis, its configuration choices, and its workforce.

Keep a one-page vendor list: vendor name, what data it handles, BAA date, and a contact for security incidents.

What are the penalties?

HHS adjusts HIPAA civil penalties for inflation. The amounts below were published in the Federal Register on January 28, 2026 and apply to penalties assessed on or after that date.

Culpability	Minimum per violation	Maximum per violation	Calendar-year cap for identical violations
Did not know, and could not reasonably have known	$145	$73,011	$2,190,294
Reasonable cause, not willful neglect	$1,461	$73,011	$2,190,294
Willful neglect, corrected within 30 days	$14,602	$73,011	$2,190,294
Willful neglect, not corrected within 30 days	$73,011	$2,190,294	$2,190,294

HHS weighs factors such as the nature of the violation, the harm caused, and the entity’s size and history when setting an amount.

What happens after a breach?

The Breach Notification Rule requires notice to affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting 500 or more people must also be reported to HHS within the same window, along with prominent media outlets when more than 500 residents of one state are affected. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year. California law adds its own, often shorter, deadlines, so involve counsel immediately. Our guide on what to do after a data breach covers the first technical steps.

ePHI that was encrypted to the standard HHS recognizes, where the key was not also compromised, is not “unsecured” and generally does not trigger notification. That is the strongest practical argument for encrypting every device.

Common mistakes

• Treating a “HIPAA compliant” product label as compliance. Compliance is about how the whole environment is configured, documented, and maintained. A product can only support it.
• No written risk analysis, or one that has not been revisited since systems changed.
• Shared logins at the front desk or in operatories.
• Reading “addressable” as “optional” and skipping encryption without a documented reason.
• Backups that have never been restored in a test.
• Old equipment sold, donated, or recycled with patient data still on the drive.
• Personal email or texting apps used for patient information without a BAA.

Common questions

Is HIPAA encryption mandatory?

Under the current Security Rule, encryption is an addressable specification. The practice must implement it if reasonable and appropriate, or document why not and use an equivalent alternative. For laptops, backups, and email there is rarely a persuasive reason not to encrypt. The 2025 proposal would make encryption required, and that proposal is not final as of September 2026.

Did the new HIPAA Security Rule take effect?

No. HHS published the proposed update on January 6, 2025 and took comments until March 7, 2025. No final rule has been published as of September 2026. The existing Security Rule remains fully enforceable. If a final rule is issued, it will state its own effective and compliance dates.

Is Microsoft 365 or Google Workspace HIPAA compliant?

Neither product makes a practice compliant by itself. Both vendors offer a business associate agreement for their paid business services, and both provide security features a practice can configure: MFA, encryption, audit logs, and data loss prevention. The practice remains responsible for turning those on, controlling access, and documenting its decisions.

Does a small dental office really need a risk analysis?

If the office is a covered entity, yes. The risk analysis requirement has no size exemption. The rule’s flexibility lets a small office keep it proportionate: a clear inventory, an honest list of threats, and a dated plan is appropriate. The free HHS Security Risk Assessment Tool was built for offices of this size.

How long must HIPAA documentation be kept?

The Security Rule requires that policies, procedures, and other required documentation be retained for six years from the date created or the date last in effect, whichever is later. That includes risk analyses, training records, and BAAs. State medical record retention rules are separate and may be longer.

How Coastal Growth Co. can help

We do the technical work behind the Security Rule: the system inventory for your risk analysis, individual accounts and MFA, device and backup encryption, tested backups, network separation, patching, and the written record of each. A business associate agreement comes first. Legal interpretation stays with your healthcare attorney or compliance adviser. Read about IT for medical and dental offices or our managed IT services, then contact us to describe what your practice needs.