Healthcare Compliance Checklist Template
A free healthcare compliance checklist based on HHS OIG compliance program guidance. No signup or email required.
What is a HIPAA compliance checklist?
A HIPAA compliance checklist is an audit tool for verifying that a covered entity or business associate meets the requirements of the Health Insurance Portability and Accountability Act across three rules - Privacy, Security, and Breach Notification.
The template
HIPAA Compliance Checklist Template
HIPAA COMPLIANCE CHECKLIST
Organisation:
[Your organisation]
Organisation type:
- Covered entity - healthcare provider
- Covered entity - health plan
- Covered entity - healthcare clearinghouse
- Business associate
Date of review:
[Date]
Reviewed by:
[Name and role]
Review type:
AnnualPre-auditPost-incidentNew system
Next review date:
[Date]
Reference:
45 CFR Parts 160, 162, 164
PART 1 - PRIVACY RULE (45 CFR 164.500–164.534)
1.1 Notice of Privacy Practices (NPP)
YesNoRemarks
Current NPP in place?
NPP updated for 2024 changes (effective Feb 16, 2026)?
NPP provided at first service?
Written acknowledgement obtained?
NPP posted on-site and online?
1.2 Patient Rights
YesNoRemarks
Process to access PHI?
Process to amend PHI?
Process for accounting of disclosures?
Process to request restrictions?
Process for confidential comms?
Requests documented within timeframes?
1.3 Minimum Necessary Standard
YesNoRemarks
Staff access minimum PHI only?
Access updated on role change?
Third-party disclosures limited?
1.4 Privacy Official and Complaints
YesNoRemarks
Privacy official designated?
Contact for complaints designated?
Complaint process documented?
All complaints logged and resolved?
No-retaliation policy in place?
PART 2 - SECURITY RULE (45 CFR 164.302–164.318)
2.1 Administrative Safeguards
YesNoRemarks
Security official designated?
Risk analysis for e-PHI done?
Risk management plan in place?
Risk analysis reviewed regularly?
Staff trained on security?
Sanction policy for violations?
Activity logs reviewed?
Emergency access plan documented?
2.2 Physical Safeguards
YesNoRemarks
Physical access to e-PHI controlled?
Workstations screened from view?
Workstation use policy in place?
Device and media controls?
Hardware disposal documented?
2.3 Technical Safeguards
YesNoRemarks
Unique user IDs assigned?
Automatic logoff for e-PHI systems?
e-PHI encrypted in transmission?
e-PHI encrypted at rest?
Audit controls in place?
Integrity controls in place?
PART 3 - BREACH NOTIFICATION (45 CFR 164.400–164.414)
3.1 Breach Response Plan
YesNoRemarks
Breach response plan documented?
Breach response team identified?
Plan reviewed and tested?
3.2 Breach Assessment and Notification
YesNoRemarks
Process to assess reportable breach?
Four-factor risk assessment applied?
Individual notified within 60 days?
HHS notified for 500+ immediately?
HHS notified annually for under 500?
Media notified when required?
All notifications documented?
PART 4 - BUSINESS ASSOCIATES (45 CFR 164.502(e) and 164.504(e))
YesNoRemarks
All business associates identified?
BAA with every associate?
BAAs reviewed on renewal?
Cloud providers covered by BAAs?
Associate compliance verified?
PART 5 - TRAINING AND DOCUMENTATION
YesNoRemarks
HIPAA training at induction?
Training refreshed annually?
Training records kept 6 years?
Policies retained 6 years?
Decisions and rationale documented?
PART 6 - SUMMARY AND ACTION PLAN
Total reviewed:
Total Yes:
Total No:
Compliance rate:%
Priority gaps:
1.
2.
3.
Action 1:
Description:CFR ref:Owner:Target date:
- Open
- In progress
- Closed
Action 2:
Description:CFR ref:Owner:Target date:
- Open
- In progress
- Closed
Action 3:
Description:CFR ref:Owner:Target date:
- Open
- In progress
- Closed
SIGN-OFF
Completed by:
Name:Role:Date:
Reviewed by:
Name:Role:Date:
Next review:
Reference:
45 CFR Parts 160, 162, 164 | hhs.gov/hipaa
Get instant answers from your documents
Private and self-hosted
Every answer cites its source
One-time payment, no monthly fees
What this template covers
Privacy Rule
NPP, patient rights, minimum necessary standard, privacy official
Security Rule
administrative, physical, and technical safeguards
Breach Notification Rule
response plan, assessment criteria, notification timelines
Business Associates
BAA requirements, cloud providers, ongoing verification
Training and Documentation
induction training, annual refresh, six-year retention
Summary and action plan
compliance rate, priority gaps, corrective actions with CFR references
Sign-off
with next review date
How to use this template
Confirm your HIPAA status first
Complete the organisation type field. If unsure, check hhs.gov/hipaa before beginning.
Complete each part in order
Work through Privacy, Security, Breach Notification, Business Associates, and Training. A No is more useful than an assumed Yes.
Add a CFR reference to every corrective action
This shows which specific regulation the gap relates to and makes it easier to brief legal counsel.
Check the 2024 NPP changes
If your NPP was not updated by February 16, 2026, this is a high-priority item under 45 CFR 164.520.
Check all cloud vendor BAAs
Cloud providers storing or processing e-PHI are business associates regardless of whether they access the data.
Document and retain this checklist
HIPAA requires retention of compliance documentation for a minimum of six years.
Related templates
Other templates that work alongside this one.
Medical Incident Report Template
A free medical incident report template for healthcare teams. Document patient safety incidents and near misses. No signup required.
Nursing Handover Template
A free nursing handover template using the SBAR framework. Endorsed by NHS England and the WHO. No signup required.
