HIPAA Compliance Checklist for Physical Therapy Clinics

Train all employees on HIPAA requirements, privacy practices, and security procedures upon hiring and annually.

Develop data backup, disaster recovery, and emergency mode operation plans for ePHI systems.

Create and enforce a policy for disciplinary actions against employees who violate HIPAA regulations.

Appoint a qualified individual responsible for developing and implementing HIPAA privacy policies and procedures.

Appoint a qualified individual responsible for developing and implementing security policies to protect ePHI.

Perform a thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Create comprehensive written policies covering privacy, security, breach notification, and patient rights.

Restrict physical access to facilities where ePHI is stored with locks, badges, or other controls.

Establish policies specifying the proper functions and physical attributes of workstations accessing ePHI.

Implement policies for the receipt, removal, and disposal of hardware and electronic media containing ePHI.

Deploy hardware, software, and procedural mechanisms to record and examine access to ePHI systems.

Implement electronic mechanisms to confirm ePHI has not been altered or destroyed in an unauthorized manner.

Deploy unique user IDs, emergency access procedures, automatic logoff, and encryption mechanisms for ePHI.

Deploy encryption and integrity controls for ePHI transmitted over electronic networks.

Keep an updated list of all business associates with access to PHI, including the type and scope of access.

Ensure written BAAs are in place with all vendors and partners who access, create, or store PHI on your behalf.

Create written procedures for detecting, reporting, and responding to security incidents and breaches of PHI.

Ensure processes are in place to notify affected individuals, HHS, and media (if applicable) within 60 days of breach discovery.

Implement procedures allowing patients to request and receive copies of their PHI within 30 days.

Establish procedures for patients to request amendments to their PHI and respond within 60 days.