A small practice holds patient records, billing data and insurance details, and it cannot afford days without its systems. HIPAA adds legal duties on top of the ordinary security basics. This guide shows what to do first, what HIPAA requires today, and what may change.
Key takeaways
- Risk analysis first. HHS says the Security Rule requires an “accurate and thorough” assessment of risks to electronic patient information.
- Do the proposed rules now. MFA and encryption are cheap, and the proposed Security Rule update would make them required.
- Know the clock. Breach notices to individuals are due without unreasonable delay and within 60 days of discovery.
- Use free tools. HHS points small practices to the HIPAA Security Risk Assessment (SRA) Tool.
On this page: What HIPAA requires · What to do first · Proposed changes · Breach deadlines · Vendors · Insurance · FAQ
What does HIPAA require for security?
The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information (ePHI) with administrative, physical and technical safeguards. The foundation is the risk analysis: an accurate and thorough assessment of risks to the confidentiality, integrity and availability of ePHI. HHS guidance says it should identify where ePHI is, the threats and vulnerabilities, the safeguards already in place, the likelihood and impact of each risk, and a risk level with corrective actions. It should be updated when things change, such as after an incident, new technology or staff turnover. HHS notes that small organizations may need different safeguards than large ones, and points to the free HIPAA Security Risk Assessment Tool.
Our full tick-list is in the HIPAA compliance checklist for small business.
What should a small practice do first?
- Run and document a risk analysis, then keep a risk management plan.
- Turn on MFA for the EHR, email, remote access and admin accounts: what MFA is.
- Encrypt laptops, phones, removable media and backups.
- Give each person a unique login and limit access to what the role needs.
- Protect every device with endpoint protection that someone watches: endpoint protection vs antivirus.
- Back up and test restores, so a ransomware attack does not stop patient care: backup strategy and ransomware protection.
- Sign business associate agreements with every vendor that touches ePHI.
- Train staff at hire and regularly, and keep records: security awareness training.
- Write an incident plan covering who to call, patient notice and your insurer: incident response plan template.
Software choices and prices are in our best cybersecurity software for small business guide. Check that any cloud tool will sign a business associate agreement before you put patient data in it.
What changes are proposed for the HIPAA Security Rule?
In January 2025 HHS published a proposed rule to update the Security Rule. According to HIPAA Journal, the proposal would require, with limited exceptions:
- encryption of ePHI at rest and in transit
- multi-factor authentication for access to ePHI
- a written asset inventory and network map, updated at least every 12 months
- more specific risk analysis requirements
- written procedures to restore data within 72 hours
- vulnerability scans at least every six months and penetration tests every 12 months
- removal of the “required versus addressable” distinction, so most specifications become mandatory
Status: the sources we checked (HIPAA Journal and a practice-compliance blog, both written in 2026) say the rule is still a proposal, with finalization projected for around July 2027 and opposition from some industry groups. It could change or be slimmed down. The current rule, including the risk analysis requirement, applies now. We treat MFA and encryption as sensible today whether or not the rule is finalized. Check HHS for the latest status.
What are the HIPAA breach notification deadlines?
Per HHS: covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovery. For breaches affecting 500 or more people, they must also notify HHS (and the media if the breach involves more than 500 residents of a state) within the same 60-day limit. Breaches affecting fewer than 500 people can be reported to HHS annually, within 60 days after the end of the calendar year. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery. State laws may be stricter.
What about vendors and cloud services?
Any vendor that creates, receives, maintains or transmits ePHI for you, such as an EHR host, billing company, cloud backup or IT provider, is a business associate and needs a signed business associate agreement. Your risk analysis should include them. If you use a managed provider, ask who is responsible for what: MSP vs MSSP vs MDR vs vCISO.
Does a medical practice need cyber insurance?
HIPAA does not require it, but a breach can bring notification costs, forensics, downtime and claims. Insurers ask about MFA, endpoint protection, backups and training, and some ask about HIPAA compliance. See cyber insurance requirements, the cost guide and our readiness check.
Frequently asked questions
Is a HIPAA risk analysis required?
Yes. The Security Rule requires an accurate and thorough risk analysis of ePHI. HHS does not prescribe one method, but expects it to be documented and updated when things change.
Is MFA required under HIPAA?
Not explicitly under the current rule as we understand it. HHS proposed making MFA mandatory in January 2025, and that rule is not final. Turn it on anyway: it is one of the most effective controls.
Is encryption required under HIPAA?
Under the current rule encryption is an “addressable” specification, meaning you must assess it and document your decision. The proposal would make it mandatory.
How long do I have to report a HIPAA breach?
Individuals must be notified without unreasonable delay and no later than 60 days after discovery. HHS and media deadlines are in the section above.
Does a small clinic need a business associate agreement with its IT provider?
If the provider can access ePHI, generally yes. Ask your counsel or compliance adviser to confirm for your setup.
Is there a free HIPAA risk assessment tool?
Yes. HHS points small practices to the HIPAA Security Risk Assessment (SRA) Tool from ONC and OCR.
Sources
- HHS: HIPAA risk analysis guidance
- HHS: Breach Notification Rule
- HIPAA Journal: HIPAA updates and changes in 2026 (proposed Security Rule update; status as of the article)
- Accusights: The HIPAA Security Rule update is still a proposal (2026)
SMB Security HQ provides general information, not legal, medical, financial or professional security advice, and is not a HIPAA compliance consultancy. Regulations change; confirm current requirements with HHS or a qualified adviser. See our Affiliate Disclosure and How We Test.
