Dr. Sofia Reyes·Clinical Documentation & Compliance Editor··13 min read
Outline
Safeguards checklist
If you are reviewing a new AI vendor, a lost device, or your annual safeguards, use this checklist to review administrative, physical, and technical safeguards, then the 18 PHI identifiers. Fill in this HIPAA compliance checklist one row at a time with an owner and a date, compare the intended control with what your practice actually does, and keep the evidence that supports your review. Treat this HIPAA compliance checklist as educational guidance for a US therapy practice, not legal advice or a certification, and escalate unresolved or high-impact risk to qualified counsel or a privacy or security professional.
The HIPAA Security Rule calls for reasonable and appropriate safeguards based on the practice’s size, complexity, capabilities, and risks. The checklist is therefore a working record, not a universal pass/fail score. The therapy practice compliance hub provides related privacy and operations resources. The administrative, physical, and technical safeguard requirements appear at 45 CFR 164.308, 45 CFR 164.310, and 45 CFR 164.312.
PHI and the 18 identifiers
Under the de-identification safe-harbor method at 45 CFR 164.514(b)(2), review each identifier below. This list is a review prompt, not permission to infer that removing a name alone makes a dataset de-identified.
When you use a different de-identification method, document the method and the qualified person who determined that the risk is sufficiently small. Do not treat a public-facing worksheet, a screenshot, or a copied clinical example as safe merely because the patient’s name is absent.
Notice of Privacy Practices
Review your Notice of Privacy Practices against 45 CFR 164.520. Use the templates below to check that your notice matches actual uses and disclosures, client rights, complaint route, contact details, and distribution workflow.
Keep the approved notice, effective date, distribution record, version history, and any acknowledgment or good-faith documentation your workflow requires. If the notice does not match an actual vendor, disclosure, or client-rights process, route the discrepancy for correction instead of silently editing a copy.
Vendor and Business Associate review
List each EHR, telehealth platform, cloud host, email service, transcription tool, AI tool, billing service, answering service, and other vendor that may create, receive, maintain, or transmit PHI. Determine whether the vendor is a business associate and whether a Business Associate Agreement is required before PHI is shared. Apply this test: if the vendor creates, receives, maintains, or transmits PHI on your practice’s behalf while providing a service or function, treat it as a potential business associate and check the definition and exceptions in 45 CFR 160.103 and the agreement requirements in 45 CFR 164.504(e). A signed agreement does not by itself make a product or practice secure.
For each vendor, record the service, PHI exposure, agreement status, access owner, security review, subprocessors, incident-notice terms, retention, return or destruction terms, and next review date. Include tools used by a contractor or temporary worker; access that is out of sight is still access.
Add each vendor review to the HIPAA compliance checklist so the practice can connect the agreement, access decision, evidence, owner, and next review date. Keep the HIPAA compliance checklist with the vendor record so you can revisit that decision after a renewal, product change, or new data flow.
How to prepare a HIPAA audit folder for a therapy practice
Reopen the review after a material change, not only before an audit. Start with a new EHR, telehealth vendor, AI transcription tool, office move, contractor, lost device, or security incident. Record what changed, which safeguards it affects, who owns the follow-up, and when you will review the evidence again.
Keep the dated review with the related evidence so you can verify each decision without reconstructing the process later.
An audit-ready folder is a small, dated collection, not a claim that every risk is gone. Use one template for each item in the folder:
A completed row says what was checked and where the evidence lives. It does not say “HIPAA compliant” without showing the control, scope, date, and remaining risk.
Download the solo-practice HIPAA checklist
Use the printable annual solo-practice HIPAA checklist delivered through the form below to assign owners, dates, evidence, and escalation actions across the safeguards in your practice. Pair it with this HIPAA compliance checklist when you need a broader review of vendors, identifiers, notices, and audit evidence. It is designed for a one-person practice, but the fields also help a group practice identify where it needs a broader role and access matrix.
Free PDF: Annual Solo-Practice HIPAA Checklist
A printable one-person HIPAA checklist for solo therapists: roles, devices, BAAs, risk analysis, and annual review fields.
•Owner, cadence, evidence, and escalation fields on every row
•Role inventory and Privacy Officer / Security Official designation
•Device, session workflow, and minimum-necessary access checks
•Vendor BAA inventory plus incident first-hour and annual close steps
Free. We'll email the PDF link right away and add you to the therapist toolkit, sent every two weeks. Unsubscribe any time.
Where should we send the link?
We'll email the PDF link right away. You'll also get the therapist toolkit every two weeks. Unsubscribe any time.
✓ Check your inbox
We've sent you the PDF
The download link is on its way to your inbox, usually within a minute or two. The email will come from Emosapien (hello@team.emosapien.com); check your spam folder if you don't see it.
You're also on the therapist toolkit list, sent every two weeks. Unsubscribe any time from the email footer.
