HIPAA Compliance and Your EHR: The Complete 2026 Checklist

Most teams do not fail HIPAA compliance because they ignored security. They fail because day-to-day operations drift away from policy over time. A system can look compliant on paper while staff are still using workarounds that create risk.

This HIPAA compliance checklist is designed to help small and mid-sized practices evaluate how their EHR performs under real operating conditions. It is not legal advice, but it can help your team ask better questions and close practical gaps faster.

Checklist section 1: Identity and access controls

1) Role-based access is actually enforced

Confirm that clinicians, front desk staff, billers, and admins only access what they need. Check for role drift over time, especially after staff changes.

2) Multi-factor authentication (MFA) is available and enabled

MFA should be standard for privileged users and remote access scenarios.

3) Session timeout is configured for clinical reality

Timeouts should reduce risk without forcing unsafe shortcuts. Validate settings at workstation and remote access levels.

Checklist section 2: Auditability and accountability

4) Audit logs are complete and searchable

You should be able to answer who accessed what, when, and what action was taken.

5) Suspicious access monitoring is part of operations

Logging is not enough. Define review cadence, escalation paths, and ownership for anomaly review.

6) Break-glass access has explicit controls

If emergency overrides exist, they should require justification and create high-visibility audit records.

Checklist section 3: Data protection controls

7) Encryption in transit and at rest is verified

Request implementation details, not just policy statements.

8) Backup and restore processes are tested

Ask for restore test evidence and recovery objectives relevant to your practice size.

9) Data export and sharing controls are governed

Validate how records are exported, which users can export, and how transfer events are logged.

Checklist section 4: Workflow-level compliance

10) Scheduling, messaging, and portal workflows are secure by default

Patient access workflows should not create side channels for PHI leakage.

11) E-prescribing and CDS are integrated safely

Medication workflows should include interaction checks and clear alert handling to reduce preventable risk.

12) Billing and clinical workflows maintain data consistency

Coding, claims, and chart data must stay aligned to reduce downstream corrections and compliance exposure.

Checklist section 5: Third-party and interoperability risk

13) External app access is scoped and auditable

If your platform supports SMART on FHIR or third-party integrations, confirm token scopes, audit coverage, and revocation processes. For broader context, review this interoperability guide.

14) Business associate responsibilities are documented

Ensure contractual and operational responsibilities are clear across vendors, hosting providers, and service partners.

15) Referral and transition workflows preserve privacy boundaries

Specialty workflows, especially in behavioral health, need explicit consent and segmentation controls. See 42 CFR Part 2: A Practical Guide for a practical model.

Checklist section 6: People, training, and governance

16) New-user onboarding includes security workflows

Train for real tasks, not just policy acknowledgment.

17) Offboarding process revokes access quickly

Access revocation should be immediate and verifiable.

18) Incident response is documented and tested

Teams should know exactly who does what in a breach or suspected access event.

19) Periodic risk assessments are part of routine operations

Compliance is a continuous process. Set quarterly review rhythms tied to workflow changes.

20) Leadership receives operational compliance metrics

Track practical indicators like unauthorized access attempts, audit review completion rate, and unresolved control gaps.

How to use this checklist in your practice

Score each item as Green, Yellow, or Red
Assign owners and timelines to all Yellow/Red items
Reassess monthly until all critical gaps are closed
Repeat quarterly after major workflow or staffing changes