HIPAA Compliance for a Small Practice: The Seven Artifacts That Prove It

HIPAA compliance in a small therapy practice has a marketing problem: everything sold under that name — seminars, seals, subscription binders — implies compliance is a thing you buy once and frame on the wall. Federal regulators see it differently. When the Office for Civil Rights investigates a complaint or a breach, it does not ask for a certificate, because none exists; it asks the practice to produce specific documents. A current security risk analysis. Signed business associate agreements. Written policies. Dated training records. Evidence of how an incident was handled. A practice with no compliance officer, no IT department, and no lawyer on retainer can hold every one of those artifacts — and the rules were explicitly written to scale down to a practice that size. This article is the list: the two roles you must put in writing, the seven artifacts that answer an investigator’s questions, and the once-a-year rhythm that keeps them from going stale.

Start by discarding the certification myth. HHS answers the question directly in its Security Rule FAQ: no standard or implementation specification requires a covered entity to “certify” compliance, and HHS does not endorse or certify any private compliance program, seminar, or product. What the Security Rule requires instead — at 45 CFR 164.308(a)(8) — is a periodic technical and non-technical evaluation of how well your safeguards meet the rule. In other words, the government replaced the certificate with a habit: look at your own setup on a regular basis, and write down what you found.

The second thing to know is that the rule was built to fit you. The Security Rule’s own flexibility provision directs each organization to adopt security measures that are reasonable and appropriate for its size, complexity, technical infrastructure, and resources — HHS’s risk analysis guidance says plainly that appropriate measures for a small covered entity may differ from those for a large one. A two-clinician practice is not held to a hospital’s playbook. What it is held to is the paper trail: HIPAA requires that policies, designations, and other required documentation be retained for six years from creation or from the date they were last in effect, whichever is later. Every artifact in this article inherits that clock.

The phrase “we don’t have a compliance officer” misreads what HIPAA asks for. The Privacy Rule, at 45 CFR 164.530(a), requires every covered entity to designate a privacy official responsible for its privacy policies and procedures. The Security Rule, at 45 CFR 164.308(a)(2), requires it to identify a security official responsible for developing and implementing its security policies. Neither rule says these must be different people, be full-time, or hold a credential — in a small practice they are usually the same person, and in a solo practice that person is you. What the rules do require is that the designation be documented. One page in your policy folder — “Jordan Reyes, owner, serves as privacy official and security official, effective March 1” — satisfies step zero, gives every later artifact an owner, and tells an investigator exactly who answers for the practice. Undocumented is the only wrong answer.

The risk analysis is the artifact everything else hangs from, and it is the one OCR guidance calls the first step of Security Rule compliance. The requirement, at 45 CFR 164.308(a)(1)(ii)(A), is an “accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability” of the electronic protected health information you hold. Strip the regulatory language and the work is concrete: list every place ePHI lives or moves — the EHR, the billing portal, email, the practice laptop, therapists’ phones, any AI scribe or telehealth platform, paper charts in transit — then, for each, write down what could realistically go wrong, how likely and how damaging that would be, and what you currently do about it. The gaps you find become your to-do list; the document itself becomes your proof that the to-do list came from analysis rather than guesswork.

HHS’s guidance is explicit that there is no one-size-fits-all blueprint and that the analysis is not a one-time event: it should be revisited as the practice changes — a new EHR, a new location, a first hire, a new AI tool. It also does not need to be outsourced. ONC and OCR publish a free Security Risk Assessment (SRA) Tool built specifically for small and medium practices; it walks through the assessment as a questionnaire, stores everything locally on your own computer, and produces the documentation. An afternoon with that tool puts a small practice ahead of the many organizations OCR has cited for having no risk analysis at all.

A business associate is any outside company or person that creates, receives, maintains, or transmits protected health information to do something on your behalf — and before any PHI flows to one, HIPAA requires a written business associate agreement that pins down what the vendor may do with the data and obligates it to safeguard the information. You do not have to draft one from scratch: HHS publishes sample provisions, and established health-tech vendors bring their own. Your artifact is simpler: one folder holding the signed BAA for every vendor on the list, so the answer to “where is your agreement with your EHR?” takes thirty seconds. The harder question for a small practice is which vendors belong on the list, and HHS has answered most of the common cases directly.

Two edges of that table deserve emphasis, because they are the ones small practices get wrong. First, the cloud row is broader than it looks: HHS treats a vendor that merely stores ePHI as a business associate even when the data is encrypted and the vendor holds no key — “we can’t see your data” does not exempt anyone from a BAA. Second, absence from the folder is the failure mode, not weak contract language. If a transcription app, a form builder, or an email tool is holding client information and no BAA exists, that is the finding an investigator writes down. When a consumer-grade tool will not sign a BAA, the tool — not the rule — is what has to change.

The Security Rule’s administrative, physical, and technical safeguards all funnel into one artifact a small practice can actually maintain: a short set of written policies describing who may touch what information, on which devices, under which rules. Resist the urge to buy a 200-page template — the rule requires policies that reflect your practice, and a policy nobody has read protects no one. For a small clinic, a handful of pages covers the ground that matters: every user has their own login and nobody shares credentials; access matches role, so the front desk sees scheduling and billing but not clinical notes it has no need for; access ends the day employment does; and the device rules say which machines may hold ePHI, that they lock when idle, what happens when one leaves the building, and what is allowed on a personal phone. If your risk analysis flagged it, a policy should answer it — that correspondence between the two documents is exactly what a reviewer looks for.

Training is required twice over: the Privacy Rule requires training every workforce member on your policies and procedures, as necessary and appropriate to their role, and the Security Rule separately requires a security awareness and training program for the whole workforce — management explicitly included. In a three-person practice, the program does not need a learning platform. It needs to actually happen and to leave a record: a session when someone is hired, a refresher when a policy materially changes, and a log line each time — date, names, topics covered. The log is the artifact. Training that happened but was never documented is, for compliance purposes, indistinguishable from training that never happened. Pair it with the sanction policy the rules also expect: a short written statement that violating the practice’s privacy and security policies has consequences, applied consistently.

The Security Rule requires policies for identifying and responding to security incidents, mitigating what can be mitigated, and documenting each incident and its outcome. The Breach Notification Rule then attaches deadlines that are brutal to discover for the first time mid-crisis. Write the path down while nothing is wrong: who a therapist tells the moment a laptop disappears or an email goes to the wrong family; who assesses whether the incident is a reportable breach of unsecured PHI; and who owns the clock if it is. The clock is the part small practices underestimate — an impermissible use or disclosure is presumed to be a breach unless your documented risk assessment shows a low probability the information was compromised, and once a breach is discovered, the notification deadlines below apply no matter how small the practice or the incident.

This is the whole article as a folder audit. Every line names something you can physically produce — print the list, walk your practice against it, and treat any unchecked line as the next compliance task. A small practice that can check every line holds a stronger position than most large organizations OCR writes about, because the artifacts exist, are current, and have an owner.

The Security Rule’s evaluation standard expects periodic review, and stale artifacts fail quietly: the risk analysis that predates your EHR switch, the BAA folder missing the AI scribe you adopted in March. The fix is a standing appointment with yourself — one afternoon, once a year, plus a lightweight check whenever something material changes. Put it on the calendar like a recertification deadline, because functionally it is one.

1. 01

   Re-walk the risk analysis

   Open last year’s document and update it against reality: systems added or retired, new staff, new devices, new tools. Note what changed and date the review — the delta note is what proves the analysis is ongoing rather than archaeological.

2. 02

   Sweep the vendor list against the BAA folder

   List every tool that touched client information this year, including anything a clinician adopted informally. Anything on the list without a signed BAA either gets one or gets replaced.

3. 03

   Run the training refresher and log it

   Cover what changed this year — new tools, new policies, anything an incident taught you — and add the dated entry to the log while the room is still together.

4. 04

   Read the policies against the actual office

   Where practice has drifted from policy, change one of them. A policy that says something nobody does is worse than no policy, because it documents that you knew.

5. 05

   Test the contingency answer once

   Confirm the backup exists and restores, and rehearse the EHR-down morning for ten minutes. The Security Rule asks for contingency planning; a test is what makes the plan an artifact instead of an intention.

6. 06

   Write the evaluation note

   Close with one page: what was reviewed, what changed, what remains open, signed and dated by the security official. That page is the periodic evaluation the rule asks for — and next year’s starting point.