HIPAA isn't one law — it's three rules (Privacy, Security, Breach Notification) plus enforcement. For your IT compliance, you mostly care about the Security Rule: administrative, physical, and technical safeguards protecting electronic Protected Health Information (ePHI). The core requirements: annual risk analysis, written policies, workforce training, access controls, encryption, audit logs, incident response plan, and signed BAAs with every vendor that touches PHI. Penalties range from $100 to $50,000 per violation. There's no HIPAA certification — anyone selling one is selling fiction.
/ 01The three HIPAA rules
"HIPAA" is shorthand for the Health Insurance Portability and Accountability Act of 1996 and its subsequent regulations. People say "HIPAA" but mean different parts depending on context. There are three rules you need to understand:
The Privacy Rule (45 CFR Part 164, Subpart E)
Governs who can access Protected Health Information (PHI) and under what circumstances. PHI is the actual medical information — diagnosis, treatment, payment data — in any form (paper, electronic, verbal). This rule is what your front-desk staff and clinical team operate under daily.
The Security Rule (45 CFR Part 164, Subpart C)
Governs how you protect electronic PHI (ePHI). This is the IT-relevant rule and the one this guide focuses on. It requires three categories of safeguards: administrative (policies, training, oversight), physical (facility security, workstation controls), and technical (encryption, access controls, audit logs).
The Breach Notification Rule (45 CFR Part 164, Subpart D)
Governs what you do when ePHI gets exposed inappropriately — who you notify, how fast, and in what format. The thresholds: notify affected individuals within 60 days. If the breach affects 500+ individuals, notify HHS and prominent media within 60 days. Smaller breaches get reported to HHS annually.
Enforcement is handled by OCR (Office for Civil Rights), an HHS sub-agency. Penalties range from $100 per violation (unknowingly violated) to $50,000 per violation (willful neglect, not corrected) with an annual cap of $1.5M per identical violation type. Multiple violation types stack.
/ 02Who HIPAA applies to
Two categories of entity must comply with HIPAA:
Covered Entities
Healthcare providers who transmit health information electronically in connection with covered transactions. In practice: any medical practice, dental practice, hospital, clinic, behavioral health provider, optometrist, physical therapist, or pharmacy that bills insurance or accepts electronic transactions. Practices that only accept cash and don't electronically bill anyone are technically not covered entities under HIPAA, though most state laws (including Tennessee) impose similar requirements separately.
Business Associates
Any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity. This includes:
- IT companies and MSPs supporting medical practices
- Cloud storage providers, email providers, EHR vendors
- Billing companies, transcription services, accounts receivable
- Document shredding services that handle records
- Answering services that take patient messages
- Backup providers, cybersecurity vendors
Business associates have their own direct compliance obligations under the HIPAA Omnibus Rule (2013). If you're a covered entity, every business associate you use must sign a Business Associate Agreement (BAA) — see section 04 below.
/ 03The Security Rule walkthrough
The Security Rule's requirements are organized into three categories. Each requirement is either "required" (you must do it) or "addressable" (you must implement it OR document a reasonable alternative that achieves equivalent protection). Both types are technically mandatory — "addressable" doesn't mean optional.
Administrative Safeguards (§164.308)
| Requirement | Type | What it means |
|---|---|---|
| Security Management Process | Required | Conduct an annual risk analysis; document risks and mitigations; sanction policy for workforce violations |
| Assigned Security Responsibility | Required | Designate one person as Security Officer (can be the same person as Privacy Officer) |
| Workforce Security | Addressable | Authorization, clearance, and termination procedures for workforce access to ePHI |
| Information Access Management | Required | Access controls based on role and minimum necessary |
| Security Awareness & Training | Required | Regular training for all workforce members; logged with sign-off |
| Security Incident Procedures | Required | Written incident response plan; document each incident |
| Contingency Plan | Required | Data backup, disaster recovery, emergency-mode operation; tested |
| Evaluation | Required | Periodic technical and non-technical evaluation of safeguards |
| Business Associate Contracts | Required | Signed BAAs with every BA |
Physical Safeguards (§164.310)
| Requirement | Type | What it means |
|---|---|---|
| Facility Access Controls | Addressable | Physical access restrictions to facility, server rooms, workstations |
| Workstation Use & Security | Required | Policies on workstation placement, screen visibility, auto-lock |
| Device & Media Controls | Addressable | Disposal, reuse, accountability for removable media |
Technical Safeguards (§164.312)
| Requirement | Type | What it means |
|---|---|---|
| Access Control | Required | Unique user IDs, emergency access procedure, automatic logoff, encryption/decryption |
| Audit Controls | Required | Logging mechanism for systems containing ePHI |
| Integrity | Addressable | Protection against improper alteration or destruction of ePHI |
| Person/Entity Authentication | Required | Verify identity of users accessing ePHI (in practice: strong passwords + MFA) |
| Transmission Security | Addressable | Encryption of ePHI in transit |
"Addressable" does not mean optional. It means you must either implement the control OR document why it's not reasonable and appropriate for your environment AND what alternative measure you've put in place. The default expectation in any modern practice is to implement it. Skipping addressable requirements without documented analysis is treated as non-compliance.
/ 04Business Associate Agreements (BAAs)
A BAA is a contract between a covered entity and a business associate. It must include specific language required by §164.504. Every vendor that touches PHI on your behalf must sign one. Period.
Major vendors that will sign a BAA on request (you usually have to ask):
- Microsoft 365 Business Standard, Business Premium, E3, E5 (not free Outlook.com)
- Google Workspace Business Plus, Enterprise (not free Gmail)
- AWS, Azure, Google Cloud (paid tiers)
- Dropbox Business (not free), Box (Business tier+), OneDrive for Business
- Zoom Workplace (not free Zoom)
- Most reputable EHR vendors, billing companies, faxing services
Vendors that will not sign a BAA:
- Free Gmail, free Outlook.com, Yahoo Mail, AOL Mail
- Free Dropbox, free iCloud, free Google Drive (consumer)
- Free Zoom, free Slack, free Trello
- Most consumer messaging apps (SMS, iMessage, WhatsApp, Facebook Messenger)
If you've ever sent a patient's name plus a diagnosis through a personal email or text without a BAA, you've technically created a HIPAA violation. Practices accumulate these by the hundreds per month. OCR usually doesn't pursue individual instances; they pursue patterns of systemic failure.
/ 05Common violations OCR actually fines
OCR publishes enforcement actions. The patterns are remarkably consistent. The top violation categories that produce six-figure-plus fines:
- Lost or stolen unencrypted devices — a laptop or phone gets stolen, it had ePHI on it, it wasn't encrypted. This single failure produces more enforcement actions than any other. Fix: full-disk encryption on every device that touches ePHI (BitLocker on Windows, FileVault on Mac, mobile device encryption + MDM).
- No risk analysis on file — OCR's first document request is your risk analysis. If you don't have one or it's three years old, you've already failed the audit. Risk analysis should be done annually and after any significant environment change.
- Improper disposal of PHI — throwing records in regular trash, donating computers without wiping drives, leaving old patient files in the closet of a closed practice.
- No BAA with a vendor that had PHI — usually discovered after that vendor has their own breach. OCR fines you for not having the BAA.
- Inadequate access controls — shared logins, no termination procedure (people who left months ago still have access), no role-based access.
- Insider snooping — employees viewing celebrity records, ex-partner's records, family members' records they have no business need to see. Detected via audit logs (which is why audit logging is required).
- Failure to provide patient records on request — patients have a right to their own records. Refusing or unreasonably delaying produces fines under both the Privacy Rule and the 21st Century Cures Act.
/ 06What an audit looks like
OCR audits typically start with one of two triggers:
- A complaint — usually from a patient, sometimes from an ex-employee. OCR opens an investigation focused on that specific issue, but evidence found during the investigation can broaden into other areas.
- A reported breach — once you've reported a breach to HHS (mandatory for breaches affecting 500+ individuals), OCR may open a compliance review. For breaches affecting under 500, the report happens annually and OCR audits less aggressively but still does.
OCR audits are largely document-driven. They send a written request for documents within 10 business days. The standard initial request includes:
- Most recent risk analysis
- Risk management plan and implementation documentation
- HIPAA policies and procedures (often 20-40 documents)
- Workforce training records and curriculum
- List of business associates and copies of BAAs
- Security incident logs
- Audit trail / access log samples
- Encryption documentation
- Contingency plan and most recent test results
If the documentation exists and is current, the audit typically wraps at this stage with no findings or minor recommendations. If documentation is missing, OCR escalates to interviews, site visits, and ultimately to a Corrective Action Plan (CAP) or civil monetary penalty (CMP).
/ 07Practical compliance checklist
Here's a realistic, practice-sized checklist. If you can answer "yes, and we have documentation" to all of these, you're in better shape than most Tennessee practices we audit:
- ☐ Annual risk analysis conducted (within the last 12 months), documented in writing
- ☐ Written HIPAA policies and procedures, reviewed annually
- ☐ Designated Security Officer (named individual)
- ☐ Workforce training conducted annually, with sign-off logs
- ☐ Written incident response plan with named responders
- ☐ BAAs signed with every vendor that touches PHI (M365 / Google Workspace, EHR, backup provider, IT/MSP, billing company, transcription, fax service)
- ☐ Full-disk encryption on every workstation, laptop, server, and mobile device
- ☐ MFA enforced on email, EHR, remote access, admin accounts
- ☐ Unique user accounts (no shared logins)
- ☐ Automatic logoff configured (typically 10-15 minutes)
- ☐ Audit logs enabled on all systems containing ePHI; reviewed periodically
- ☐ Backups running, monitored, and restoration tested at least quarterly
- ☐ Termination procedure for departing workforce (accounts disabled within 24 hours)
- ☐ Patch management current (no unsupported OS versions running PHI)
- ☐ Antivirus/EDR on every endpoint, monitored centrally
- ☐ Email security: BAA-signed provider, encryption available for outbound PHI
- ☐ Physical access controls: server/network gear in locked area; visitor logs
- ☐ Workstation positioning: screens not visible to non-authorized people
- ☐ Disposal procedures: certified shredding for paper, wiping or destruction for drives
- ☐ Six years of records retained: policies, training, risk analyses, BAAs, incident logs
Most practices that get fined have multiple "no" answers on this list. Most practices that pass audits have all "yes" answers and the documentation to prove it.
What to ask your IT provider
If you're using an MSP or internal IT person, they should be able to:
- Sign a BAA with you
- Produce documentation of encryption status on every device
- Demonstrate audit logging is active
- Provide quarterly compliance reports
- Participate in your annual risk analysis
- Help you respond to OCR document requests if needed
If your IT person says "what's a BAA?" you have a serious problem.
Frequently asked questions
Is there a HIPAA certification?
No. There is no official HIPAA certification from HHS, OCR, or any other federal body. Anyone selling you "HIPAA certification" is selling you their own private certification, which has no legal standing. What you can have: a formal risk analysis, documented policies, evidence of training, and signed BAAs. That collective package is what auditors look at — not a certificate.
Do I need a HIPAA-compliant email provider?
You need an email provider that will sign a Business Associate Agreement (BAA) with you, and you need to use it in a configuration that supports HIPAA requirements (encryption in transit, encryption at rest, access controls, audit logging). Microsoft 365 Business Standard or higher will sign a BAA. Gmail Workspace will sign a BAA. Free Gmail, free Outlook.com, free Yahoo will not. The product isn't magically "HIPAA-compliant" — your use of it has to be.
Can I store PHI in the cloud?
Yes, with appropriate safeguards and a signed BAA with the cloud provider. AWS, Azure, Google Cloud, Microsoft 365, Google Workspace, Box, and Dropbox Business all sign BAAs. Free consumer cloud accounts (iCloud, free Dropbox, free Google Drive) generally do not. The cloud isn't inherently more or less HIPAA-compliant than on-premise — it depends entirely on configuration.
How long do I have to keep HIPAA records?
Six years from the date of creation or the date when last in effect, whichever is later. That applies to policies, procedures, training records, risk analyses, BAAs, security incident reports, and audit logs. Tennessee's state retention requirements for medical records themselves (typically 10 years from last patient encounter) are separate and longer.
What happens if I get audited?
OCR (Office for Civil Rights) audits typically start with a document request: produce your last risk analysis, your policies and procedures, your training records, your BAAs, and your incident logs within 10 business days. If everything is in order, the audit usually wraps up at that stage. If documentation is missing or controls are failing, OCR moves to "compliance review" which can lead to civil monetary penalties or a corrective action plan.
Need a HIPAA risk analysis or compliance review?
We do HIPAA-focused IT and compliance work for medical, dental, and behavioral health practices across Tennessee. BAAs signed, documentation provided, and we'll tell you honestly what your gaps look like.
Talk to us 615-274-9555