HIPAA Compliance Checklist for Medical Practices in California (2026)

HIPAA asks the same of a two-doctor practice in Fullerton as of a large clinic group anywhere else in Orange County: know where your patient information lives, protect it, and be able to show what you’ve done. Most of that is IT work, and most of it comes down to steady habits rather than one big project.

What HIPAA covers and who has to comply

HIPAA, the Health Insurance Portability and Accountability Act, applies to covered entities, which include physicians, dentists, mental health providers and physical therapists. It also reaches the billing companies, IT providers and other vendors that handle patient information for them, which HIPAA calls business associates. All of them have to protect the privacy, security and integrity of patient information, whether it’s on paper, on a computer or spoken. The rule’s own name for it is protected health information.

California practices have state law to think about as well. The HHS Office for Civil Rights (OCR) enforces HIPAA at the federal level, and California’s Confidentiality of Medical Information Act (CMIA) adds its own penalties on top of HIPAA.

HIPAA penalty amounts for 2026

HHS adjusts HIPAA’s civil money penalties for inflation each year. These are the amounts in its January 28, 2026 notice in the Federal Register (91 FR 3665), which apply to penalties assessed on or after that date.

The regulation caps penalties for violations of the same requirement at $2,190,294 per calendar year. Since 2019, though, HHS has said it uses lower yearly caps for the first three tiers: $25,000, $100,000 and $250,000, plus inflation adjustments. Sources: Federal Register documents 2026-01688 and 2019-08530.

15 IT requirements for California medical practices

Most of these come from the HIPAA Security Rule (45 CFR Part 164, Subpart C). We’ve included the section number for each one so you, or whoever looks after your IT, can check the exact wording.

1. Write down where patient information lives and what could go wrong

   The rule: Security Rule §164.308(a)(1) requires what it calls a “risk analysis”: an accurate and thorough look at the risks to electronic patient information in every system that creates, receives, maintains or transmits it.

   Why it matters: Every other safeguard builds on this review, and it’s where OCR has focused its enforcement, through what it calls its “Risk Analysis Initiative”. In 2025 HHS announced a $1.5 million penalty against Warby Parker and settlements with PIH Health ($600,000) and Northeast Radiology ($350,000). In each case, OCR’s findings included this review not being done properly.

   What to do: List every system that holds patient information: the EHR, billing software, email, cloud storage and phones. Note what could go wrong with each one, write it down, and look at it again every year or after a big change. HHS publishes a Security Risk Assessment Tool made for small and medium practices that walks you through it, and a good IT provider can do this with you.

2. Have a plan to fix what the review finds

   The rule: §164.308(a)(1)(ii)(B) requires risk management: security measures that bring the risks you found down to a reasonable and appropriate level.

   Why it matters: A review with no plan behind it doesn’t meet the rule, and OCR expects the plan to keep moving after the first pass. The Warby Parker penalty included this gap too.

   What to do: Rank what you found by how much it matters. Give each fix an owner and a date, and track it until it’s done. Look at the plan again at least once a year and after any security incident.

3. Give everyone their own login

   The rule: §164.312(a)(2)(i) requires a unique user identification for every workforce member who uses systems holding patient information. Shared logins don’t meet it.

   Why it matters: With a shared account there’s no way to tell who opened which patient’s record. That’s a security problem as much as a HIPAA one.

   What to do: Set up an individual account for every staff member in the EHR, the billing system and any cloud service that holds patient information. Turn off accounts the day someone leaves.

4. Turn on multi-factor authentication (MFA)

   The rule: The current Security Rule doesn’t name MFA, but the proposed update would require it.

   Why it matters: Stolen passwords are one of the most common ways into a practice’s systems. MFA stops most of those attempts even when the attacker already has the password, and cyber insurers often ask about it.

   What to do: Turn on MFA for every email account (Microsoft 365 and Google Workspace especially), the EHR, VPN connections and any remote desktop tool. Use an authenticator app rather than text messages where you can.

5. Set automatic screen locks and session timeouts

   The rule: §164.312(a)(2)(iii) covers automatic logoff: ending an electronic session after a set period of inactivity.

   Why it matters: A computer left logged in at the front desk or in an exam room is one of the easiest ways for the wrong person to see patient information.

   What to do: Lock screens and end sessions after 5 to 15 minutes of inactivity on every computer and mobile device. Group policy can enforce this on Windows, and mobile device management (MDM) software can do it on phones and tablets.

6. Encrypt patient information on devices and in transit

   The rule: §164.312(a)(2)(iv) and §164.312(e)(2)(ii). Encryption is an “addressable” specification, which means you either use it or document why an equivalent alternative is reasonable.

   Why it matters: If a lost or stolen laptop, hard drive or USB stick holds unencrypted patient information, that’s usually a breach you have to report. If the device was encrypted, it generally isn’t.

   What to do: Turn on full-disk encryption on every computer and laptop (BitLocker on Windows, FileVault on Mac). Require HTTPS for any web access to patient information, and use encrypted email whenever patient information goes out by email.

7. Back up your data and test the restore

   The rule: §164.308(a)(7) requires a contingency plan that covers data backup, disaster recovery and emergency mode operation.

   Why it matters: If ransomware or a failed server takes out the EHR data, tested backups are what bring it back. Without them, patient records can be lost for good.

   What to do: Keep at least three copies of your data, on two kinds of storage, with one copy offsite or in the cloud (the 3-2-1 rule). Restore from the backups at least once a quarter to prove they work. Write down how long you can afford to be down, your recovery time objective (RTO), and how much data you can afford to lose, your recovery point objective (RPO).

8. Use a business firewall and separate your networks

   The rule: §164.312(e)(1) requires technical security measures to protect patient information sent over a network.

   Why it matters: A consumer router does little to keep anyone out, and one flat network lets a problem on any device reach the EHR.

   What to do: Install a business-grade firewall in place of a consumer router. Put medical devices, office computers and guest Wi-Fi on separate networks, and turn on intrusion detection and prevention (IDS/IPS). Someone has to watch the alerts, whether that’s your own staff or an IT provider.

9. Turn on activity logs

   The rule: §164.312(b) requires audit controls: hardware, software and procedures that record activity in systems containing patient information and let you examine it.

   Why it matters: Logs are how you spot someone opening records they shouldn’t, work out what happened after an incident and show OCR what you did. Without them you can’t prove anything either way.

   What to do: Turn on logging in your EHR and collect logs in one central place, yourself or through your IT provider. Keep them for at least six years, to match HIPAA’s documentation retention rule, and check access logs regularly for anything unusual.

10. Train every staff member on security

    The rule: §164.308(a)(5) requires security awareness training for the whole workforce, management included.

    Why it matters: A convincing phishing email gets past firewalls and filters by asking a person to click. Training is how staff learn to spot one, and no technical control can do that part for them.

    What to do: Train people when they’re hired and every year after, with phishing simulations included. Cover passwords, how to spot a phishing email, handling patient information and how to report a possible breach. Keep a record of each session with the date and who attended.

11. Sign a BAA with every vendor that handles patient information

    The rule: §164.308(b)(1) requires a written business associate agreement (BAA) with any vendor that creates, receives, maintains or transmits patient information for you.

    Why it matters: If a vendor exposes your patient information and you don’t have a signed BAA, the practice carries that problem too. Vendors that usually need one include your IT provider, cloud storage, billing company, EHR vendor and transcription service, and even some appointment scheduling tools. HHS’s guidance on business associates explains who counts.

    What to do: Keep a list of every vendor that touches patient information. Get a signed BAA before you share any, and review them every year. If a vendor won’t sign one, don’t use them for anything involving patient information.

12. Write and test a breach notification plan

    The rule: The Breach Notification Rule (§164.400 to 414) requires you to notify affected patients within 60 days of discovering a breach. Every breach also has to be reported to HHS: within those same 60 days if it affects 500 or more people, or within 60 days after the end of the calendar year if it affects fewer. A breach affecting more than 500 residents of a state also has to be reported to local media.

    Why it matters: A notice that goes out late is a violation of its own. HHS’s 2025 settlement with PIH Health included a failure to notify patients, HHS and the media on time.

    What to do: Write down who gets told, in what order and by when, and walk through the plan once a year. Name a Privacy Officer to decide whether an incident counts as a breach and to handle the notices. Find a lawyer who knows HIPAA and California breach law before you need one. For the incident itself, see the first steps after ransomware or a hacked mailbox.

13. Secure phones and tablets, including personal ones

    The rule: §164.310(d) device and media controls cover every device that holds electronic patient information, including staff phones and tablets.

    Why it matters: Physicians often open the EHR on their own phones. A lost or unmanaged phone with access to patient information can turn into a breach you have to report.

    What to do: Use mobile device management (MDM) on every device that can reach patient information, so you can require encryption and a PIN, restrict apps and wipe a lost phone remotely. Have every staff member sign a written bring-your-own-device (BYOD) policy.

14. Make sure your software and cloud tools are set up for patient information

    The rule: A vendor whose software or cloud service stores or processes patient information for you is a business associate: it has to protect that information under the Security Rule, and you need a signed BAA with it (§164.308(b), §164.314(a)).

    Why it matters: Common consumer tools, like standard Gmail, Dropbox and standard Zoom, aren’t set up for patient information as they come. Practices often use them because they’re convenient, and take on real breach liability without realizing it.

    What to do: List every app and cloud service the practice uses. Replace the unsuitable ones with versions that come with a BAA, such as Microsoft 365 Business or Google Workspace with a BAA, Zoom for Healthcare, or Doxy.me for telehealth. Keep the signed BAA for each one on file. Our guide to Microsoft 365 for medical and dental offices covers that setup.

15. Name a Privacy Officer and a Security Officer

    The rule: §164.308(a)(2) requires a designated Security Officer, and §164.530(a)(1) a Privacy Officer. In a small practice they can be the same person.

    Why it matters: Someone has to own this work, or it slips behind patient care. Having no one designated is a gap of its own.

    What to do: Designate them in writing and record it in your HIPAA policies. Their job includes keeping the written review current, running the breach response plan, organizing staff training and being the contact for OCR. If you’re weighing whether that support should come from your own IT person or an outside team, our comparison of in-house IT and managed IT for practices can help.

Where we fit in

North Blue Networks looks after IT for medical practices across Orange County and Southern California, with a team that has been in the IT industry since 1996. We help practices put the sensible security habits HIPAA asks for in place, explained in plain English, and keep them working day to day. Dental offices have their own mix of imaging and practice software, which our page on IT support for dental offices covers. If you’re comparing providers, here’s what managed IT should include for a medical practice.

If you’re not sure where to start, book a free IT check-in. It’s a relaxed, no-obligation call to learn about your practice and what it needs, and we’ll point out which items on this list matter most for you. You can also call (714) 450-9330 to talk with someone on our team.

This checklist is general information, not legal advice. For questions about your practice’s specific obligations, talk to your attorney or compliance advisor.