A Practice Owner’s Checklist for Finding and Fixing HIPAA Risks

## Start With Where Patient Information Actually Goes An independent practice can have strong passwords and still miss a serious HIPAA risk. A downloaded ultrasound report, a former employee’s active account, or an intake spreadsheet saved to a personal laptop can expose information outside the systems everyone remembers to check. A useful HIPAA risk assessment follows electronic protected health information, or ePHI, through the entire practice. It identifies what could go wrong, evaluates existing safeguards, and creates a documented plan for reducing risk. For OB/GYN practices, this includes reproductive health histories, prenatal records, ultrasound images, portal conversations, and information shared with outside laboratories. The goal is not a perfect checklist score. It is an accurate, defensible understanding of risk and evidence that the practice acts on its findings. ## Know What the Assessment Must Accomplish The HIPAA Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. A questionnaire can support that analysis, but checking boxes alone is not enough. Distinguish two connected activities: - **Risk analysis:** Identify threats, vulnerabilities, existing safeguards, likelihood, and potential impact. - **Risk management:** Select safeguards, assign responsibility, implement improvements, and evaluate whether they work. The Security Rule does not prescribe a universal annual risk-analysis deadline. Review the analysis periodically and when significant changes occur. An annual review is a useful operating cadence, not a substitute for updates after a new interface, acquisition, incident, or workflow change. Start with the official [HHS risk analysis guidance](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html). The [HealthIT.gov Security Risk Assessment Tool](https://www.healthit.gov/topic/privacy-security-and-hipaa/security-risk-assessment-tool) can help organize the work, but using it does not itself establish compliance. ## 1. Assign Ownership and Define the Scope Name the person coordinating the assessment and involve clinical operations, billing, administration, and IT support. An outside consultant can help; outsourcing the assessment does not transfer the practice’s HIPAA responsibilities. ### Checklist - [ ] Identify the designated security official and assessment coordinator. - [ ] Include every location, remote worker, and relevant contractor. - [ ] Cover all systems that create, receive, maintain, or transmit ePHI. - [ ] Record the assessment date, participants, methods, and limitations. - [ ] Set a completion date and leadership review meeting. **Deliverable:** A scope statement naming the systems, people, locations, and workflows included. List unknowns explicitly rather than silently excluding them. ## 2. Map ePHI Beyond the EHR Walk through a patient encounter from scheduling to payment. Ask staff to demonstrate their real workflow, including shortcuts used during busy clinic sessions. ### Checklist - [ ] Inventory computers, phones, tablets, servers, removable media, and connected clinical equipment. - [ ] List email, messaging, fax services, cloud storage, intake tools, and billing platforms. - [ ] Identify downloads, screenshots, scanned documents, and local exports. - [ ] Map interfaces with laboratories, imaging services, hospitals, and clearinghouses. - [ ] Identify backups, archives, and data retained in retired systems. - [ ] Record who owns each system, where information resides, and who can access it. **Hypothetical example:** An OB/GYN practice securely receives ultrasound results but downloads PDFs to a shared workstation before attaching them to patient charts. The downloads folder becomes an overlooked ePHI repository. **Deliverable:** A data-flow map and asset inventory that include temporary storage, not just primary applications. ## 3. Identify Threats and Test Existing Safeguards A threat is a potential source of harm, such as phishing, theft, or a power outage. A vulnerability is a weakness that could allow harm, such as an unpatched device or an untested backup. Assess confidentiality, integrity, and availability. Exposure is not the only concern: incorrect patient matching can compromise integrity, while an inaccessible prenatal record can disrupt care. ### Checklist - [ ] Require individual accounts and review permissions against job duties. - [ ] Check account termination procedures for employees and contractors. - [ ] Evaluate multifactor authentication, especially for remote and administrative access. - [ ] Review device encryption, secure transmission, screen locks, and patching. - [ ] Confirm audit logs capture useful activity and have a review process. - [ ] Inspect workstation placement, visitor access, equipment storage, and disposal. - [ ] Review staff training and procedures for reporting suspicious activity. Do not accept “we have a policy” as proof that a safeguard works. Inspect configuration reports, sample access lists, and interview staff. Avoid exposing real patient information unnecessarily during testing. Some Security Rule implementation specifications are addressable. That does not mean they can simply be ignored: document the required assessment and, where applicable, an appropriate alternative measure. ## 4. Examine Vendors and Sensitive Workflows Vendor review should extend beyond the EHR. Managed IT providers, transcription services, cloud storage companies, and other organizations may be business associates depending on their functions and access to PHI. ### Checklist - [ ] Determine which vendors require business associate agreements and verify those agreements are executed. - [ ] Document each vendor’s access, responsibilities, and incident-reporting process. - [ ] Ask how data is retained, returned, exported, or deleted at termination. - [ ] Review vendor security information without treating it as a substitute for practice-level analysis. - [ ] Evaluate proxy access, identity verification, and patient communication preferences. For OB/GYN workflows, examine whether appointment reminders, shared contact information, or proxy access could reveal sensitive services. These questions also intersect with Privacy Rule requirements and applicable state law; keep that broader review distinct from the ePHI security analysis. ### Include AI and Connected EHR Functions When evaluating IKON EMR, review how its AI scribe, telemedicine, billing, and patient portal functions fit your data-flow map. For AI-assisted documentation, ask whether audio is retained, which parties process it, whether information is used for model training, and how clinicians verify generated notes. For virtual visits and portal access, examine identity checks and access settings. Treat HIPAA compliance as a shared operational responsibility, not a product guarantee. Ask IKON EMR to document available safeguards, contractual terms, and configuration responsibilities; then verify how your practice implements them. ## 5. Score Risks and Build a Remediation Register Use a consistent rating method, such as low, medium, and high likelihood and impact. Explain each rating using observed conditions. Numerical scoring can help organize priorities, but it is not a HIPAA-prescribed formula. Record each finding in a working register: | Field | What to document | |---|---| | System or workflow | Where the risk exists | | Threat and vulnerability | What could happen and why | | Existing safeguards | What currently reduces risk | | Likelihood and impact | Rating with supporting rationale | | Remediation | Specific corrective action | | Owner and deadline | Who will complete it and when | | Verification and residual risk | Evidence of the fix and remaining exposure | **Hypothetical example:** A departing employee retains remote access. The practice disables the account immediately, investigates subsequent activity, and introduces a termination checklist with same-day verification. Address urgent exposures promptly rather than waiting for the entire report. Document why lower-priority items are deferred and any interim safeguards. Risk acceptance cannot excuse failure to meet an applicable HIPAA requirement. ## 6. Test Recovery and Preserve Evidence Backups are only useful if the practice can restore needed information. Test recovery safely and rehearse downtime procedures for accessing essential information, documenting encounters, and reconciling records afterward. ### Checklist - [ ] Verify backup coverage and protection against unauthorized alteration or deletion. - [ ] Perform a documented restoration test. - [ ] Rehearse downtime workflows for time-sensitive prenatal care. - [ ] Maintain incident contacts, escalation steps, and breach-evaluation procedures. - [ ] Preserve assessment records, corrective-action evidence, and leadership reviews. - [ ] Schedule reassessment after material changes or incidents. HIPAA-required Security Rule documentation generally must be retained for six years from creation or the date it last was in effect, whichever is later. This is not a universal medical-record retention rule. ## FAQ ### Can a small practice conduct its own assessment? Yes, if it has the expertise to perform an accurate, thorough analysis. Seek outside help for technical gaps, complex integrations, or unresolved findings. ### Does a business associate agreement prove a vendor is secure? No. It establishes required contractual obligations. You still need to assess relevant risks and understand each party’s safeguards and responsibilities. ### What should leadership review first? Review high-impact exposures, overdue corrections, untested recovery capabilities, and risks without a named owner. A useful assessment ends with verified improvements—not a report that sits unread.