If you run a solo dental office, a two-therapist counseling practice, or a small family medicine clinic, HIPAA is not optional and it is not just about locking the filing cabinet. Federal law expects you to have specific written policies on paper, to actually follow them, and to be able to hand them to an auditor, a cyber insurer, or a patient who asks.
The good news is that a small practice does not need a hundred-page compliance manual. There is a short, knowable list of documents that covers the vast majority of what the Office for Civil Rights (OCR) enforces and what insurers ask for. This post walks through that list in plain English: what each document is, why it matters, and how much of it a small practice genuinely needs.
What HIPAA actually requires of a small practice¶
HIPAA has two halves that matter here. The Privacy Rule governs how you use and disclose protected health information (PHI), the paper and conversation side. The Security Rule governs how you protect PHI that lives in a computer, phone, or cloud service, the electronic side (ePHI). A small practice is subject to both because you are a “covered entity.”
The part that surprises most owners is that the Security Rule is explicit that policies must be written and documented, and retained for six years. “We just know how we do things” is not compliance. If an OCR investigator asks for your risk analysis or your sanction policy and you cannot produce a dated document, you have a finding regardless of whether your actual practices were reasonable.
Here is the reality of enforcement in 2026: OCR’s most common settlements against small practices are not for dramatic hacks. They are for the absence of a current risk assessment, missing Business Associate Agreements, and no documented policies. Those paperwork failures are the cheapest thing in the world to prevent and the most expensive thing to explain after a breach.
Your Notice of Privacy Practices (NPP)¶
The Notice of Privacy Practices is the one HIPAA document your patients actually see. It is the plain-language notice explaining how you use their health information, who you share it with, and what rights they have: to access their records, request corrections, and get an accounting of disclosures.
You are required to give it to patients at the first appointment, make a good-faith effort to get their written acknowledgment, post it in your waiting area, and put it on your website if you have one. It is the most visible sign of whether a practice takes HIPAA seriously, and it is the easiest thing for a disgruntled patient or a state inspector to check.
A note for 2026: the NPP requirements were updated to reflect changes around reproductive health information and the Part 2 rules for substance use records. If your NPP was written before 2024 and you have not touched it since, it is very likely out of date. Review it annually, not once.
Business Associate Agreements (BAAs)¶
A Business Associate is any outside vendor that touches your patients’ PHI on your behalf. Your cloud EHR, your billing company, your IT support firm, your document shredding service, your email provider if it stores PHI, your appointment-reminder app: all of them are business associates, and HIPAA requires a signed Business Associate Agreement with each one before they handle any PHI.
The BAA is a contract that legally binds the vendor to protect your data and to notify you if they have a breach. It matters for two hard reasons. First, if a vendor exposes your patient data and you never had a BAA in place, OCR can hold you liable for the failure to have the agreement. Second, missing BAAs are one of the first things a cyber insurance underwriter checks, and one of the first reasons a claim gets denied.
The practical trap for small practices is the free tier. Standard consumer Gmail, a personal Dropbox, or a texting app that will not sign a BAA cannot lawfully be used for PHI, no matter how convenient. Keep a simple list of every vendor that touches PHI and confirm you have a current signed BAA for each. That list is also part of your risk assessment, which is next.
The HIPAA Security Risk Assessment¶
If you only do one thing on this list, do this one. The Security Risk Assessment (sometimes called a risk analysis) is the foundational requirement of the Security Rule, and it is the single most commonly missing document in OCR settlements with small practices.
A risk assessment is a written walkthrough of where your ePHI lives, what could go wrong, how likely each threat is, and what you are doing about it. For a small practice this is not a six-figure engagement. It is an honest inventory: which computers, phones, and cloud services hold patient data; who has access; whether devices are encrypted; whether you have backups; where the gaps are. Then you rank the gaps and write down a plan to close them.
It matters because nearly every other Security Rule requirement flows from it. You cannot claim your safeguards are “reasonable and appropriate” if you never assessed the risk. It is also the document that turns a breach from a catastrophe into a manageable event: OCR treats a practice that can show a recent, thoughtful risk assessment very differently from one that cannot.
Do it at least once a year, and again whenever something material changes: a new EHR, a new location, a move to remote scheduling. HHS publishes a free Security Risk Assessment Tool that is genuinely usable for a small office.
The core written policies every practice needs¶
Beyond the three big items above, the Security Rule expects a set of specific written policies. These are short (a page or two each for a small practice), but they need to exist, be dated, and reflect what you actually do.
Access control and workforce clearance¶
A written rule that each staff member gets only the minimum access they need to do their job, that everyone has a unique login (no shared passwords), and that access is revoked the same day someone leaves. This is the “minimum necessary” principle in policy form. It is also a favorite audit question because it is so easy to fail: the front desk should not have the same system access as the provider, and the fired employee’s account should not still work a month later.
Sanction and training policies¶
HIPAA requires two things about your people. A sanction policy is a written statement of what happens when a staff member violates your privacy or security rules: the consequences, applied consistently. A training policy requires that every workforce member receives HIPAA training at hire and periodically after, with a record of who was trained and when.
These matter because your staff are your biggest risk. Most small-practice breaches are not sophisticated attacks; they are a curious employee snooping in a neighbor’s chart or someone clicking a phishing link. A documented training log and a sanction policy show OCR you took reasonable steps and genuinely reduce the odds of an incident. Keep the sign-in sheet or the completion certificates. The record is the point.
Breach notification¶
You need a written breach notification policy that spells out what your practice will do if PHI is exposed: how you assess whether it is a reportable breach, who you notify, and how fast. Under the Breach Notification Rule you generally must notify affected patients without unreasonable delay and no later than 60 days, notify HHS (immediately for breaches of 500 or more people, annually for smaller ones), and in larger breaches notify the media.
The value of writing this down in advance is that a breach is the worst possible time to figure out your process. A practice that has a clear, pre-written playbook meets its deadlines and looks responsible. A practice that improvises misses the 60-day window and turns a bad day into an enforcement action.
Contingency and device policies¶
Two more that round out the set. A contingency plan covers data backup and how you would keep operating (and keep records available) if a computer dies, ransomware hits, or the office floods. For most small practices this is a documented, tested backup routine plus a basic recovery plan. A device and media policy covers encryption of laptops and phones that hold PHI, how you handle lost or stolen devices, and how you wipe hardware before disposal. Encryption is the quiet hero here: an encrypted lost laptop is generally not a reportable breach, while an unencrypted one almost always is.
A simple checklist to get compliant¶
If you want to know where you stand today, work down this list. Each item is either “yes, and I can produce the document” or “no.” There is no partial credit with an auditor.
Document Have it? Current within 12 months?
──────────────────────────────── ───────── ─────────────────────────
Security Risk Assessment [ ] [ ]
Notice of Privacy Practices [ ] [ ]
Signed BAAs for every vendor [ ] [ ]
Access control policy [ ] [ ]
Sanction policy [ ] [ ]
Workforce training + training log [ ] [ ]
Breach notification policy [ ] [ ]
Contingency / backup plan [ ] [ ]
Device & encryption policy [ ] [ ]
A quick decision rule: if you checked “no” on the Security Risk Assessment or on BAAs, start there: those two carry the most enforcement risk and are the fastest to fix. If you have the big items but your policies are undated or written for a hospital you copied off the internet, your job is to tailor them to how your practice actually runs. Auditors can tell the difference between a real policy and a downloaded one you have never read.
Where to start if this feels like a lot¶
None of this is technically hard, but it is real work, and for a busy solo owner “write nine policies” is exactly the kind of task that stays at the bottom of the list until an insurer or a new referral partner asks for it. So start with the two highest-risk items: the risk assessment (the free HHS tool is a fine starting point) and a full audit of your signed BAAs. Those alone put you ahead of most small practices.
For the written policies, you do not need to draft them from a blank page. We put together ready-to-customize HIPAA policy kits tailored to the practices that ask us for them most (dental, mental health, and family medicine) with the full set of documents above written in plain language and fill-in-the-blank sections for your practice’s specifics. They are a starting point you edit to match reality, not a magic PDF that makes you compliant on its own. Used honestly, they turn a multi-week project into an afternoon.
And if you are genuinely unsure what your situation calls for (maybe a healthcare client or an insurer asked you for something specific and you are not sure what they mean), email support@breachsecurity.io and tell us what you do, how many people are on staff, and what was asked of you. We will tell you what you actually need, even when the honest answer is “less than you think.”