HIPAA IT Compliance Checklist for Medical Practices in Maryland & Virginia

Who Does HIPAA Apply To?

HIPAA applies to two categories of organizations: Covered Entities (healthcare providers that transmit health information electronically, health plans, and healthcare clearinghouses) and Business Associates (any vendor or service provider that creates, receives, maintains, or transmits Protected Health Information on behalf of a Covered Entity). For the purposes of this checklist, we're focused on medical practices, dental offices, physical therapy clinics, and other healthcare providers in Maryland and Virginia.

If your practice uses electronic health records (EHR), processes insurance claims electronically, uses cloud-based practice management software, communicates with patients via email or text, or stores any patient information digitally — HIPAA applies to your IT systems and the IT vendors you work with.

Technical Safeguard Checklist

The HIPAA Security Rule requires covered entities to implement reasonable and appropriate technical safeguards to protect electronic PHI. Here's the practical checklist:

• ☐ Access Controls: Unique user IDs for every employee accessing PHI systems. Shared logins are a HIPAA violation. Password complexity requirements enforced technically (not just in policy)
• ☐ Automatic Logoff: Workstations and EHR sessions must automatically log off after a period of inactivity (typically 15-20 minutes)
• ☐ Encryption at Rest: Hard drive encryption (BitLocker for Windows, FileVault for Mac) on all workstations and laptops. A lost or stolen encrypted laptop does not constitute a HIPAA breach
• ☐ Encryption in Transit: TLS encryption for all email containing PHI, web-based systems must use HTTPS. Never email patient information from an unencrypted provider
• ☐ Audit Controls: System activity logs for all access to EHR and systems containing PHI. Logs must be retained and reviewed regularly
• ☐ Multi-Factor Authentication: MFA on all EHR systems, Microsoft 365/email, and remote access (VPN). Not strictly required by HIPAA text but considered a best practice and increasingly required by cyber insurers
• ☐ Endpoint Protection: Antivirus/EDR on all workstations and servers. Signatures current, alerts monitored
• ☐ Patch Management: All workstations, servers, and network equipment kept current with security patches
• ☐ Backup and Recovery: Daily encrypted backups of all systems containing PHI with tested restore procedures documented

Physical Safeguard Checklist

Physical safeguards are often overlooked but are explicitly required by HIPAA:

• ☐ Workstation Security: Workstations accessing PHI must be positioned to prevent unauthorized viewing (patient-facing screens turned away from waiting areas)
• ☐ Server/Networking Equipment: Servers and network equipment secured in locked rooms or cabinets with access limited to authorized personnel
• ☐ Visitor Control: Procedure for escorting visitors in areas where PHI may be visible
• ☐ Device Disposal: Documented procedure for secure disposal of hard drives and devices that contained PHI (DOD-standard wiping or physical destruction)
• ☐ Mobile Device Policy: Policy covering personal devices (BYOD) that access PHI — must include remote wipe capability and encryption requirements

Administrative Safeguard Checklist

Administrative safeguards are the policies, procedures, and training requirements:

• ☐ Security Officer: Designated HIPAA Security Officer responsible for security policy — required for all covered entities regardless of size
• ☐ Workforce Training: Annual HIPAA training for all staff with access to PHI, documented with employee sign-off
• ☐ Risk Analysis: Documented risk analysis identifying threats to PHI — required and frequently cited in enforcement actions as missing
• ☐ Risk Management Plan: Written policies addressing identified risks, reviewed and updated annually
• ☐ Sanctions Policy: Written policy on consequences for workforce members who violate HIPAA policies
• ☐ Incident Response Procedure: Written procedure for identifying, responding to, and documenting security incidents and potential breaches

Maryland and Virginia-Specific Considerations

In addition to federal HIPAA requirements, Maryland and Virginia have state-specific laws that interact with HIPAA:

Maryland: The Maryland Personal Information Protection Act (MPIPA) has breach notification requirements that in some cases are stricter than HIPAA's. Maryland also has specific protections for mental health records that go beyond HIPAA's requirements.

Virginia: Virginia's Consumer Data Protection Act (CDPA) creates additional rights for patients regarding their data and requires covered businesses to conduct data protection impact assessments for high-risk processing activities. Virginia also has specific regulations for mental health and substance abuse records.