Does Your Small Business Need HIPAA Compliance?
If your business creates, receives, maintains, or transmits protected health information (PHI) — even indirectly — HIPAA applies to you. This includes healthcare providers, health plans, billing services, and their business associates. Software vendors, marketing agencies, and IT providers that touch patient data are all covered entities or business associates under the law.
HIPAA violations carry penalties ranging from $100 to $50,000 per violation, with annual maximums up to $1.9 million per violation category. For a small business, a single breach can be existential.
HIPAA Compliance Checklist
Administrative Safeguards
- Designate a Privacy Officer and Security Officer (can be the same person)
- Conduct and document a formal Risk Analysis covering all PHI systems
- Implement a Risk Management Plan addressing identified vulnerabilities
- Train all workforce members on HIPAA policies annually and document it
- Establish procedures for reporting and responding to security incidents
- Execute Business Associate Agreements (BAAs) with every vendor handling PHI
Physical Safeguards
- Control physical access to all systems that store or process PHI
- Implement workstation use and security policies for PHI access
- Establish device and media controls covering disposal, re-use, and backups
