Back to Blog
    hipaa-technical-safeguards
    hipaa-it-requirements
    electronic-health-record-requirements
    hipaa-technology-standards
    hipaa-compliance-guidelines

    90 Day HIPAA IT Checklist for US IT Teams: Map Controls to 45 CFR 164

    Dustin CollettOctober 6, 2026

    HIPAA requires covered entities and business associates to implement documented administrative, physical, and technical safeguards for electronic protected health information under 45 CFR Part 164, starting with a defensible risk analysis and enforceable controls. The immediate priorities for any IT team: identify every system that touches ePHI, turn on logging, enforce strong authentication, confirm business associate agreements are signed, and verify backups actually restore.

    TL;DR:

    • Conduct a thorough inventory of all systems touching ePHI, assess threats and vulnerabilities, and update the risk analysis whenever changes occur.
    • Ensure signed business associate agreements specify security obligations and breach reporting, and escalate refusals immediately.
    • Implement physical controls like facility locks, workstation security, and media encryption, and document disposal processes for all media.
    • Use strict access controls with unique IDs, role-based permissions, multi-factor authentication, and review audit logs regularly for suspicious activity.
    • Develop a clear incident response plan, test restores frequently, and maintain offline backups to ensure rapid containment and recovery.

    Table of Contents

    Security Rule Basics: Scope, ePHI, and the Three Safeguard Categories

    The HIPAA Security Rule applies to two kinds of organizations: covered entities (providers, health plans, and clearinghouses that handle patient data directly) and business associates (vendors, IT providers, billing companies, and any contractor that creates, receives, maintains, or transmits electronic protected health information on a covered entity's behalf). ePHI means any individually identifiable health information stored or sent electronically, from EHR records to a billing spreadsheet on a laptop.

    The rule organizes requirements into three safeguard categories, each with its own section of 45 CFR Part 164 Subpart C:

    • Administrative safeguards (§164.308): policies, risk analysis, workforce training, and security management processes.
    • Physical safeguards (§164.310): facility access, workstation controls, and device and media handling.
    • Technical safeguards (§164.312): access control, audit logging, encryption, and transmission security.

    Each standard contains implementation specifications marked either "required" or "addressable." Required means you implement it as written. Addressable means you assess whether it's reasonable and appropriate for your environment, and if you decide not to implement it as specified, you document an equivalent alternative or your reasoning. Appendix A to Subpart C lays out exactly which specifications fall into each category, which makes it the fastest reference when building a checklist.

    Administrative Safeguards IT Teams Must Implement and Document

    Administrative safeguards are the paperwork that proves your technical controls aren't accidental. OCR enforcement actions consistently come back to one gap: no documented risk analysis, or one that's years out of date.

    1. Run and document a risk analysis. Inventory every system that touches ePHI, score the likelihood and impact of threats against each, and keep dated records of the findings.
    2. Build a risk management plan. Convert analysis findings into a prioritized remediation list with owners and deadlines.
    3. Write a security management process. This covers your sanction policy for workforce violations, your information access management procedure, and your process for reviewing system activity.
    4. Define workforce security roles. Specify who can authorize access, how access is granted and revoked, and how terminations are handled same-day.
    5. Train staff on an ongoing basis. A single onboarding session doesn't satisfy the standard; recurring awareness training does.

    Pro Tip: When you decide not to implement an addressable specification exactly as written, document the decision and your compensating control in the same file as your risk analysis, not in a separate memo nobody can find during an audit.

    Physical Safeguards for IT: Device, Facility, and Media Controls

    Physical safeguards protect the hardware and media that hold ePHI, not just the data itself. These controls are often the easiest for a small IT team to overlook because they feel like facilities issues rather than IT issues.

    • Restrict facility access to server rooms and network closets with keyed or badge-based entry, and log who enters.
    • Lock down workstations that display or process ePHI, including automatic screen locks and physical cable locks where appropriate.
    • Manage mobile devices with mobile device management (MDM) software that enforces encryption and allows remote wipe.
    • Encrypt removable media, including USB drives and external hard drives, before any ePHI touches them.
    • Document media disposal. Every decommissioned hard drive or device needs a wipe or destruction record, not just a trash can.

    Technical Safeguards: Access Control, Audit Logging, Encryption, and Monitoring

    Technical safeguards under §164.312 are where most of an IT team's day-to-day HIPAA work lives. These are the controls OCR examiners ask to see evidence of first.

    Access control starts with unique user IDs for every person touching ePHI systems, never shared logins. Layer on role-based access so staff see only what their job requires, document an emergency access procedure for when normal authentication fails, and require multi-factor authentication for remote and privileged accounts. MFA is addressable today, but HHS's proposed rule changes would make it a baseline expectation, so treat it as required now rather than waiting.

    Audit controls mean logging who accessed what, when, and from where, across every system that touches ePHI. Logs need to be retained long enough to support an investigation, reviewed on a regular cadence rather than only after an incident, and protected from tampering.

    Integrity and transmission security cover two related problems: making sure ePHI isn't altered without authorization, and making sure it's protected while moving between systems. Encryption in transit (TLS for web traffic, encrypted VPN for remote connections) and encryption at rest (full-disk or database-level encryption) address both required and addressable specifications here, and integrity checks like hashing confirm that data hasn't been silently corrupted or modified.

    Session controls round this out with automatic logoff after periods of inactivity and tightly configured remote access, so an unattended workstation or an open VPN session doesn't become the weak link.

    One capability deserves its own line item: NIST SP 800-66 Revision 2 states plainly that there's no single HIPAA-compliant product. Compliance is a documented, risk-based program, not a checkbox tool purchase, which means patch management, endpoint detection and response, and anti-malware tools all need to be chosen and configured against your specific risk analysis, not bought off a vendor's generic HIPAA bundle.

    How to Perform a Defensible Risk Analysis and Build a Risk Management Plan

    A risk analysis that would survive an OCR audit starts with a complete inventory, not a sample.

    1. Inventory every system that creates, receives, maintains, or transmits ePHI, including cloud SaaS applications, backup locations, and any subcontractor with access.
    2. Assess threats and vulnerabilities against each system, scoring likelihood and impact. For healthcare environments, ransomware and insider threats deserve specific attention given how often they surface in OCR's own enforcement actions.
    3. Rank findings by risk level and translate each into a remediation item with an owner, a timeline, and either a fix or a documented compensating control.
    4. Re-run the analysis whenever you add a new system, change vendors, or experience a security incident, not just annually by calendar reminder.

    Pro Tip: Treat cloud applications the same way you'd treat an on-premises server: map their APIs, backup locations, export paths, and any subcontractor access, and confirm a signed BAA covers each one before go-live.

    The documentation artifacts that prove thoroughness are dated risk-analysis reports, a signed remediation plan with named owners, evidence the controls were actually implemented, and records of test results like backup restores and tabletop exercises.

    Incident Response, Breach Notification, and Contingency Planning for IT Teams

    A clear incident flow turns a chaotic breach day into a procedure your team can execute under pressure.

    1. Contain and preserve evidence immediately. Isolate affected systems without powering them down in a way that destroys forensic evidence, and begin a timeline log the moment you suspect a breach.
    2. Notify according to the Breach Notification Rule timeline. Covered entities must notify affected individuals no later than 60 calendar days from discovery; breaches affecting 500 or more individuals also require notifying HHS and the media, while smaller breaches can be reported to HHS annually.
    3. Activate contingency plans. Immutable, offline backups that ransomware can't encrypt or delete are the foundation here, and they only count if you test restores regularly rather than assuming they'll work.
    4. Run tabletop exercises before a real incident, so legal, communications, and any forensics vendor know their roles in advance.
    5. Coordinate externally with legal counsel and breach-response specialists as soon as scope is confirmed; our ransomware response guidance walks through the containment and coordination steps in more detail.

    Business Associate Management and What to Require in a BAA

    Any vendor that creates, receives, maintains, or transmits ePHI on your behalf is a business associate, and that chain often extends further than IT teams expect: a billing company, a cloud EHR host, and that host's own subcontractors can all qualify.

    • Confirm a signed BAA exists before any vendor touches ePHI, not after.
    • Check that the BAA specifies security obligations, breach reporting timelines, and a flow-down clause requiring the vendor's own subcontractors to meet the same terms.
    • Escalate refusals immediately. If a vendor doesn't sign a BAA, that's a deal-breaker for handling ePHI, not a negotiable detail; find an alternative vendor or restrict what data reaches them.

    Documentation, Periodic Evaluation, and Audit Readiness

    Section 164.316 requires retaining HIPAA-related documentation for six years from the date of creation or the date it last was in effect, whichever is later.

    • Keep policies, risk analyses, BAAs, training records, and incident reports on file for the full retention period.
    • Re-evaluate your program whenever systems, staff, or threats change significantly, not only on a fixed annual schedule.
    • Expect OCR's enforcement focus to land on documentation gaps first: an outdated risk analysis or a missing remediation record is consistently what turns a routine audit into a settlement.

    90-Day Practical Checklist for IT Teams

    A time-boxed sprint plan turns this guidance into something you can report to leadership in weekly increments.

    1. Days 1 to 30: Complete a full system inventory, enable logging across ePHI systems, require MFA for remote access, and confirm backups exist and are tested.
    2. Days 31 to 60: Finish a documented risk analysis, secure signed BAAs with every critical vendor, and deploy patch management and endpoint detection and response across all endpoints.
    3. Days 61 to 90: Run an incident response tabletop exercise, establish continuous monitoring with policy review cycles, and confirm staff training is complete and recorded.

    Pro Tip: Report progress to leadership in 30-day increments rather than waiting for a single year-end update. A visible sprint plan is also exactly the kind of evidence an auditor wants to see.

    How a Standardized Managed IT Stack Supports HIPAA Readiness

    We've built our approach around the idea that HIPAA compliance isn't a special project bolted onto IT, it's what a well-run IT stack already does. Fixed per-user managed IT services with 24/7 monitoring map directly onto the technical and administrative safeguards above: centralized logging satisfies audit controls, standardized endpoint protection satisfies the current anti-malware expectations, and documented assessments give you the evidence trail OCR examiners ask for. We've worked with healthcare and healthcare-adjacent clients across Southeastern Wisconsin on exactly this kind of readiness work.

    , Dustin Collett

    Get a Documented Risk Analysis and a Plan to Close the Gaps

    We run an IT & Security Assessment that gives you what OCR actually wants to see: a full inventory of systems touching ePHI, a risk score, and a prioritized remediation plan with owners and timelines, not a generic checklist.

    Collett Systems LLC

    From there, our managed IT services operationalize the ongoing pieces: continuous monitoring, patch management, and endpoint detection and response running in the background instead of depending on someone remembering to check.

    • Fixed per-user pricing means no surprise bills when your risk analysis turns up gaps that need fixing.
    • 24/7 monitoring and documented support give you the evidence trail an audit requires, built in rather than assembled after the fact.
    • One standardized stack for every client means the controls you need are already part of what we deliver, not an upsell.

    Book an IT & Security Assessment to see where your current setup stands against these requirements.

    This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

    FAQ

    What are the new HIPAA requirements for 2026?

    The current Security Rule requirements under 45 CFR Part 164 remain in effect while HHS's December 2024 proposed rule (NPRM) moves through the rulemaking process. The proposed updates would strengthen requirements around multi-factor authentication, incident response, and anti-malware protection, so IT teams should treat those as near-term priorities regardless of the rule's final status.

    What are the 5 main rules of HIPAA?

    HIPAA is generally organized around the Privacy Rule, the Security Rule, the Breach Notification Rule, the Enforcement Rule, and the Omnibus Rule, which extended direct liability to business associates. For IT teams, the Security Rule and the Breach Notification Rule carry the most direct technical obligations.

    Do HIPAA guidelines apply to computer use?

    Yes. The Security Rule's technical safeguards under §164.312 directly govern computer and network use, including access control, audit logging, encryption, automatic logoff, and transmission security for any system handling electronic protected health information. These requirements apply to workstations, servers, mobile devices, and cloud applications alike.

    What is HIPAA compliance for software?

    There's no single certification that makes software "HIPAA compliant." As NIST SP 800-66 notes, compliance depends on how an organization configures, secures, and documents its use of that software within a risk-based program, and whether a signed business associate agreement covers the vendor. A tool can support compliance, but the organization using it still owns the risk analysis and the safeguards.

    Sources