How does HIPAA apply to employers?

Employers are not directly covered entities, but their group health plans are, so PHI handled for plan administration falls under HIPAA. Employment records held by the employer are generally not PHI. HR must separate plan-related health data and protect it under the Privacy and Security Rules.

What is a business associate agreement?

A business associate agreement is a contract requiring vendors who handle PHI on the plan's behalf, such as third-party administrators, to safeguard that data per HIPAA. It defines permitted uses and breach obligations. Sharing PHI with a vendor without one is itself a compliance gap.

What must happen after a HIPAA breach?

Following an unauthorized disclosure of unsecured PHI, covered entities must notify affected individuals, and depending on scale, the Department of Health and Human Services and sometimes the media, within defined timeframes. A documented breach response plan speeds this up. Prompt, complete notification reduces penalty exposure.

Free HIPAA Compliance Checklist Checklist

Progress

0%

x

0 of 27 steps done

HIPAA Compliance Checklist

Covered Entity Name:

HIPAA Privacy Officer:

HIPAA Security Officer:

Last Risk Analysis Date:

Privacy Rule Compliance

Designate a HIPAA Privacy Officer responsible for policy development and complianceDevelop and maintain written privacy policies and proceduresDistribute the Notice of Privacy Practices (NPP) to plan participantsImplement the minimum necessary standard for PHI use and disclosureObtain valid written authorizations for non-routine uses and disclosures of PHIEstablish procedures for individuals to exercise their HIPAA rights

Security Rule Safeguards

Designate a HIPAA Security Officer responsible for electronic PHI (ePHI) safeguardsConduct a comprehensive risk analysis of ePHIImplement a risk management plan based on the risk analysis findingsImplement access controls for systems containing ePHIEstablish audit controls to record and examine ePHI access activityImplement physical safeguards for facilities and workstations with ePHI access

Business Associate Management

Identify all business associates that create, receive, maintain, or transmit PHIExecute compliant Business Associate Agreements (BAAs) with all business associatesEnsure business associates extend BAA obligations to their subcontractorsPeriodically review and update BAAs for regulatory changesMonitor business associate compliance with BAA obligations

Breach Notification

Establish a breach identification and risk assessment processNotify affected individuals within 60 days of discovering a breachReport breaches affecting 500 or more individuals to HHS and the mediaLog breaches affecting fewer than 500 individuals for annual reportingDocument all breach investigations and response actions

Training, Retention and Auditing

Train all workforce members on HIPAA privacy and security policiesProvide role-specific training for workforce members with access to PHIRetain HIPAA policies, procedures, and documentation for at least six yearsImplement sanctions for workforce members who violate HIPAA policiesConduct periodic HIPAA compliance audits and assessments

The complete guide

Everything you need to know

01What Is the HIPAA Compliance Checklist?

HIPAA protects the privacy and security of individuals' health information. For HR and benefits teams, this checklist focuses on safeguarding protected health information handled through group health plans: privacy policies, the security of electronic PHI, workforce training, business associate agreements, and breach notification procedures. It helps employers keep plan-related health data confidential and handle it lawfully.

02Why Use a HIPAA Compliance Checklist

HR routinely touches health information through enrollment, claims questions, and wellness programs, and mishandling it can breach HIPAA's Privacy and Security Rules, leading to penalties and loss of trust. A checklist clarifies which data is protected, who may access it, and how it must be stored and transmitted. It also ensures business associate agreements are in place and that a breach response plan exists before you need it.

03How to Use This HIPAA Compliance Checklist

Identify where protected health information flows through your plan administration and who handles it. Confirm privacy and security policies are documented, access is limited to authorized staff, and electronic PHI is encrypted and backed up. Verify workforce training is current and that signed business associate agreements cover vendors. Test your breach notification process. Tick each safeguard and schedule periodic risk assessments.

HIPAA Compliance Checklist

HIPAA Compliance Checklist

Privacy Rule Compliance

Security Rule Safeguards

Business Associate Management

Breach Notification

Training, Retention and Auditing

Everything you need to know

01What Is the HIPAA Compliance Checklist?

02Why Use a HIPAA Compliance Checklist

03How to Use This HIPAA Compliance Checklist

Related HR checklists

Keep your hiring moving

Ready to interview your shortlist?

Frequently asked questions