December 18, 2025
Running a medical or dental office in Nashville already comes with the daily stresses of patients, schedules, labs, billing, and equipment issues. The last thing you need is to have to figure out a confusing HIPAA compliance regulations written in IT jargon.
This guide simplifies HIPAA compliance essentials into a practical, audit-ready HIPAA IT checklist that office managers can use. No fluff. No scare tactics. Just clear actionable tasks that reduce risk and help you stay compliant.
What to do: Make sure your practice has a documented, written HIPAA Security Risk Analysis performed within the last year. If not, work with your IT provider to have a new risk analysis performed.
Why it matters: It’s the first document auditors request.
What to keep on file: Final signed report and remediation plan with timelines listed.
What to do: Turn on MFA for Microsoft 365, your EHR/EMR, remote access, and any system containing ePHI and train employees on its importance.
Why it matters: Nearly every credential-based breach starts with a stolen password.
What to keep: MFA enrollment list and screenshots of policy settings.
What to do: Ensure full-disk encryption is enabled on every device storing or accessing ePHI, including those used by remote staff.
Why it matters:A lost or stolen computer shouldn’t turn into a breach notice.
What to keep: Exported device encryption status reports.
What to do: Back up EHR, servers, cloud storage, and M365 data daily. Run a quarterly restore test to ensure backups work.
Why it matters: A backup you haven’t tested isn’t a backup, but a guess.
What to keep: Backup logs, screenshots, and timestamps from the most recent restore test.
What to do: Apply all updates in a timely fashion to Windows/macOS machines, EHR workstations, imaging systems, firewalls, and networking gear.
Why it matters: Unpatched systems are one of the biggest HIPAA and cybersecurity risks.
What to keep: Patch compliance reports.
What to do: Use short security refreshers, phishing simulations, and clear reporting instructions.
Why it matters: Your staff is the front line, so training is mandatory.
What to keep: Completion logs and phishing simulation stats.
What to do:
Why it matters: Remote access is one of the easiest entry points for attackers.
What to keep: Access lists, your Mobile Device Management policy (MDM), and an inventory of all devices.
What to do: Review and re-file BAAs with:
Why it matters: Missing BAAs are a common cause of HIPAA fines.
What to keep: A folder with all current BAAs and renewal dates.
What to do: Maintain updated HIPAA policies covering access, device use, sanctions, and breach response plans.
Why it matters: If it isn’t documented, it didn’t happen, at least not in the eyes of an auditor or cyber insurance policy.
What to keep: Signed policy PDFs and annual tabletop exercise notes.
Keep these items in a folder called “HIPAA IT Audit Kit 2025”:
This isn’t busy work. These items help clears audits quickly.
Healthcare practices across Middle Tennessee are receiving increasing pressure from carriers, regulators, and vendors regarding cybersecurity. Many IT providers still don’t understand HIPAA and what a medical practice needs to remain secure and compliant.
At Johnson Business Technology Solutions, we take a security-first, white-glove approach to HIPAA compliance grounded in decades of healthcare experience. We answer the phone live, triage fast, automate the simple stuff, and show up onsite when it actually matters.
Your practice should never wonder if you’re protected or if your IT provider knows HIPAA well enough to keep you out of trouble.
If you want help getting this checklist into place—or need a second opinion on your current setup—we’re here.
Click Here or give us a call at 615-989-0000 to Book a FREE 15-Minute Discovery Call
