Here’s the letter no practice manager wants: the HHS Office for Civil Rights (OCR) is opening an investigation, and it wants your HIPAA risk analysis. Not a promise. The document. If you don’t have one, the conversation turns to money fast.
That’s the real HIPAA risk for a small practice. Not a headline. A fine, a settlement and years of OCR oversight, often triggered by one complaint or one breach report. A solo gastroenterology practice in Utah paid $100,000. A small New York neurology practice paid $25,000. A Michigan surgical group paid $10,000. In each case, OCR said the practice had not done an accurate and thorough risk analysis. This checklist is how we help primary care, specialty, OB/GYN and dental practices across Harrisburg, Hershey, Mechanicsburg and the rest of Central PA stay out of that file. Plain English, tied to what the rules actually say.
Short version: do a real risk analysis, fix what it finds, write it down and keep it current. That’s what OCR asks for first, and everything below supports one of those four things.
How HIPAA fines work: the four penalty tiers
OCR enforces the HIPAA Privacy, Security and Breach Notification Rules. When it finds a violation, it can resolve it with technical assistance, a settlement (a resolution agreement and corrective action plan) or a civil money penalty. The penalty range depends on how culpable you were (45 CFR §160.404). These are the current inflation-adjusted amounts in 45 CFR §102.3, from HHS’s 2025 adjustment (91 FR 3665). HHS has said there will be no inflation adjustment for 2026.
| Tier | What OCR finds | Minimum | Maximum |
|---|---|---|---|
| 1 | You didn’t know, and with reasonable diligence wouldn’t have known | $145 | $73,011 |
| 2 | Reasonable cause, not willful neglect | $1,461 | $73,011 |
| 3 | Willful neglect, corrected within 30 days | $14,602 | $73,011 |
| 4 | Willful neglect, not corrected within 30 days | $73,011 | $2,190,294 |
The calendar-year cap for violations of an identical provision is $2,190,294. One practice can rack up more than one violation, because each failure to meet a requirement can count separately. The lesson is simple: the tiers reward practices that can show they did the work. “We didn’t know” only helps if you really couldn’t have known. Willful neglect, the costliest tier, is largely about ignoring what you should have fixed.
Real HIPAA settlements with small practices
These come straight from HHS resolution agreements. Notice the common thread.
- Steven A. Porter, M.D., P.C. (Ogden, Utah), $100,000. A solo gastroenterology practice. OCR found it had not done an accurate and thorough risk analysis, had not reduced risks to a reasonable level and had no BAA with its EHR company. It also agreed to a two-year corrective action plan. (HHS)
- Comprehensive Neurology, PC (New York), $25,000. A small neurology practice. After a ransomware attack affecting about 6,800 people, OCR found it had failed to conduct an accurate and thorough risk analysis. Two years of OCR monitoring came with it. (HHS)
- Northeast Surgical Group, P.C. (Michigan), $10,000. A breach report covering as many as 15,298 people, its entire patient population, led OCR to find no HIPAA-compliant risk analysis. Two-year corrective action plan. (HHS)
The check is only part of the cost. A corrective action plan means OCR reviews your risk analysis, your risk plan, your policies and your training, usually for two years. That’s time your team isn’t spending on patients. And the breach that starts an investigation can come from anywhere: a lost laptop, a phished password, an angry ex-employee, a vendor or ransomware. The fine doesn’t hinge on how you got breached. It hinges on whether you can show you did the required work.
What the HIPAA Security Rule actually requires
The HIPAA Security Rule (45 CFR Part 164, Subpart C) protects electronic protected health information (ePHI). It groups its requirements into three kinds of safeguards:
- Administrative safeguards (§164.308): risk analysis, risk management, a named security official, workforce training, access management, incident procedures, contingency planning and business associate contracts.
- Physical safeguards (§164.310): who can get to your server closet, workstations and devices, and how you dispose of old drives.
- Technical safeguards (§164.312): unique logins, automatic logoff, encryption, audit controls, integrity controls, authentication and transmission security.
Some specifications are “required” and some are “addressable”. Addressable does not mean optional. It means you either put the safeguard in place, or you document why it isn’t reasonable for you and what you do instead. For most small practices today, encryption is the obvious, reasonable choice.
A note on timing: HHS proposed a major update to the Security Rule in January 2025. As of this writing it has not been finalized. HHS’s regulatory agenda lists July 2027 as a target date, but that date is not binding and could slip further. The current rule is the one you’re held to now. Many of the proposed changes, such as multi-factor authentication everywhere, asset inventories and tested backups, are good practice anyway.
The HIPAA compliance checklist: 12 steps that keep you out of OCR’s file
1. Do a real security risk analysis, the document OCR asks for first
This is the step OCR names first. Every settlement above cites a missing or inadequate risk analysis, and OCR launched a Risk Analysis Initiative in 2024 focused on exactly this. Everything else hangs on it. The rule requires an “accurate and thorough assessment” of risks to the confidentiality, integrity and availability of your ePHI (§164.308(a)(1)(ii)(A)). HHS has guidance on risk analysis, and the free HHS/ONC Security Risk Assessment Tool is built for small practices.
- List every place ePHI lives: your EHR or practice management system, imaging, email, scanners, laptops, phones, cloud apps and backups.
- For each one, write down the threats (a lost laptop, a phished password, a dead server, ransomware), how likely each is and how bad it would be.
- Repeat the analysis when something big changes, such as a new EHR, a new office, a move to the cloud or a merger, and at least every year.
2. Turn the findings into a risk management plan you can show OCR
A risk analysis that sits in a drawer doesn’t protect anyone. The rule also requires you to put security measures in place that reduce those risks to a reasonable level (§164.308(a)(1)(ii)(B)). Make a simple list: each risk, the fix, who owns it and a target date. That list becomes your roadmap, and your proof of progress if OCR ever asks. Porter’s practice was also cited for not reducing risks to a reasonable level, so the fixes matter as much as the findings.
3. Name a security official and write your core policies
Someone has to own security. In a small practice that’s often the practice manager, working with an IT partner. Then put the basics in writing:
- Acceptable use, passwords and multi-factor authentication
- Access control: who gets access to what, and how access is removed when someone leaves
- Device and media handling, including disposal of old drives and copiers
- Incident response and breach notification
- Contingency plan: backups, disaster recovery and emergency-mode operations
- Sanctions for staff who don’t follow the policies
Keep policies and related documentation for six years from when they were created or last in effect (§164.316).
4. Sign business associate agreements with every vendor that touches PHI
Why it matters for fines: a missing BAA with an EHR vendor was one of the findings in the $100,000 Porter settlement.
Your EHR vendor, cloud backup provider, email host, IT company, billing service and shredding company may all be business associates. Before they create, receive, keep or send PHI for you, you need a business associate agreement (BAA) (§164.502(e) and §164.504(e)). HHS publishes sample BAA provisions. Keep a vendor list showing who has a signed BAA and where it’s filed. Free consumer email and file-sharing accounts usually won’t sign one, which is a good reason to move off them. Bluetek will sign a Business Associate Agreement with every medical client before work begins.
5. Lock down access: unique logins, MFA and least privilege
- Unique user IDs for everyone (§164.312(a)(2)(i)). No shared “frontdesk” logins.
- Multi-factor authentication on email, remote access and the EHR wherever it’s supported. Stolen passwords are a common cause of healthcare breaches.
- Least privilege: staff see only what their job needs, and nobody browses the web with admin rights.
- Automatic logoff and screen locks on shared workstations (§164.312(a)(2)(iii)).
- Same-day offboarding: disable accounts the day someone leaves, not at the end of the month.
6. Encrypt devices and data so a lost laptop isn’t a reportable breach
Encryption is addressable under the rule (§164.312(a)(2)(iv) and (e)(2)(ii)), but it’s the cheapest insurance you’ll buy. Under HHS breach guidance, PHI encrypted to HHS’s standard is not “unsecured”. A properly encrypted lost laptop generally isn’t a reportable breach, as long as the encryption key wasn’t also lost or compromised. An unencrypted one can be.
- Full-disk encryption (BitLocker or FileVault) on every laptop and desktop
- Encrypted phones and tablets that are managed, so you can wipe them remotely
- Encrypted email for PHI, plus TLS on your patient portal and websites
- Encrypted backups, in transit and at rest
7. Turn on audit logs and actually watch them
The rule requires mechanisms that record and examine activity in systems containing ePHI (§164.312(b)), and regular review of that activity (§164.308(a)(1)(ii)(D)). In practice, that means:
- EHR access logs, so you can answer “who looked at this chart?”
- Microsoft 365 or Google sign-in and mailbox audit logs, kept long enough to investigate
- Firewall and endpoint logs sent to a monitored system (SIEM or managed detection and response) that someone reviews
8. Back up, test the restore and document your contingency plan
The contingency plan standard (§164.308(a)(7)) requires a data backup plan, a disaster recovery plan and an emergency-mode operations plan. Testing and revising the plan, and ranking which systems matter most, are addressable. The questions OCR, your insurer and your patients will care about:
- Do we have a copy that ransomware can’t reach (offsite, immutable or offline)?
- When did we last restore from it, not just see a green checkmark?
- How do we check patients in, chart and bill if the EHR or the internet is down for a day?
The HHS ransomware fact sheet is worth a read. It explains when a ransomware attack is presumed to be a breach.
9. Patch, protect and monitor every endpoint
- Automatic operating system and application patching, with reports showing it actually happened
- Endpoint detection and response that can isolate an infected computer on its own
- Email filtering that catches phishing and spoofed senders, plus SPF, DKIM and DMARC on your domain
- Replace unsupported systems such as old Windows versions, end-of-life servers and firewalls past support
- Keep an inventory of devices and software so nothing is left unmanaged
10. Train your team (and test them)
The rule requires a security awareness and training program for your whole workforce (§164.308(a)(5)). Its specifications, periodic security reminders and training on malware protection, log-in monitoring and password management, are addressable, which as noted above still means you must address them. It doesn’t say “annual”, but onboarding training plus at least a yearly refresher is the norm, with short phishing simulations in between. Keep attendance records, because that’s your proof.
11. Know your breach notification deadlines, because missing them is its own violation
Under the Breach Notification Rule (45 CFR §§164.400-414), a breach of unsecured PHI triggers these notices:
- Affected patients: without unreasonable delay and no later than 60 days after discovery
- HHS: within 60 days if 500 or more people are affected. Breaches affecting fewer than 500 people must be logged and reported to HHS no later than 60 days after the end of the calendar year in which they were discovered.
- Media: required if more than 500 residents of a state or jurisdiction are affected
- Business associates must notify you without unreasonable delay and no later than 60 days after discovering a breach (your BAA can set a shorter deadline)
Pennsylvania also has its own breach notification law, the Breach of Personal Information Notification Act (73 P.S. §2301 et seq.). Since a 2024 amendment, if more than 500 Pennsylvania residents must be notified, you must also notify the PA Attorney General at the same time and notify the national credit bureaus, and if Social Security, bank account, driver’s license or state ID numbers were involved, offer a free credit report and 12 months of credit monitoring. The law treats practices that comply with HIPAA as meeting many of its requirements, but not necessarily these newer ones, so check state requirements with your attorney. Write the steps down now, with names and phone numbers: your IT partner, your cyber insurance carrier, your attorney and your EHR vendor.
12. Document everything: it’s your evidence in an OCR investigation
If it isn’t written down, it didn’t happen, and in an OCR investigation that’s literally how it’s treated. Keep your risk analysis, risk plan, policies, BAAs, training records, backup test results and incident notes in one place. Review them every year, and whenever you add a location, provider or system. Your cyber insurance renewal will ask for most of the same things (see our cyber insurance requirements checklist).
How this looks in different practice types
- Primary care: high patient volume and many users. Focus on MFA, shared-workstation logoff and EHR audit logs. See primary care IT support.
- Specialty and OB/GYN: imaging, lab interfaces and connections to referring providers add vendors and BAAs. Map every data flow. See specialty practice IT support.
- Dental: imaging software and practice management servers are often older and on-site. Server health, backups and patching matter most. See dental IT support.
- Veterinary: HIPAA generally doesn’t cover animal patient records, but vet clinics still hold card data and client details, and the same safeguards protect them. See veterinary IT support.
Where Central PA practices usually get stuck
In our work with practices from Harrisburg to Hershey to Mechanicsburg, the gaps tend to repeat. The risk analysis is years old or was never done. There’s no BAA with one or two vendors. Backups have never had a test restore. A shared login is still in use at the front desk. And the server under the desk is past support. None of these take long to find, and most are straightforward to fix once they’re on a list.
Get help before OCR asks
Bluetek supports medical, dental and specialty practices across Central PA with managed IT services, cybersecurity and HIPAA compliance support. Bluetek will sign a Business Associate Agreement with every medical client before work begins. We help you run the risk analysis OCR expects, get BAAs in place with your other vendors and fix what the analysis finds. Learn more about our healthcare IT services, or call 717-516-0600 or contact us to book a 30-minute fit call. We serve Harrisburg, Hershey, Mechanicsburg and the rest of Central PA.
This article is general information, not legal advice, and reading it does not create an attorney-client or business associate relationship. Bluetek is an IT services company, not a law firm, and following this checklist does not by itself make a practice HIPAA compliant. HIPAA and Pennsylvania obligations depend on your practice, so talk with a qualified healthcare attorney about your specific situation. Penalty amounts and settlements are taken from HHS sources and are current as of November 2026. Past settlements don’t predict the outcome of any other case.
HIPAA fines and compliance FAQ
How much can a HIPAA violation cost a small practice?
Civil money penalties currently range from $145 to $73,011 per violation for the lower tiers, and up to $2,190,294 per violation for uncorrected willful neglect, with a calendar-year cap of $2,190,294 for identical violations (45 CFR 102.3). Many small-practice cases are resolved by settlement instead. HHS settlements with small practices have included $10,000, $25,000 and $100,000, plus two-year corrective action plans.
What is the most common reason OCR fines small practices?
A missing or inadequate security risk analysis comes up again and again. It was cited in each of the small-practice settlements described in this article, and OCR runs a Risk Analysis Initiative focused on it.
Is there an official HIPAA compliance checklist from HHS?
No. HHS does not certify practices or publish a single official checklist. The Security Rule sets the required safeguards, and HHS offers guidance and a free Security Risk Assessment Tool for small practices. A checklist like this one helps you organize the work.
How often should a small practice do a HIPAA risk analysis?
The rule requires an accurate and thorough risk analysis kept current. Most practices review it every year and whenever something significant changes, such as a new EHR, a move to the cloud or a new location.
Is encryption required under HIPAA?
Encryption is an addressable specification, so you must use it or document a reasonable alternative. In practice, encrypting laptops, phones, email and backups is the standard choice, and properly encrypted PHI is generally not considered unsecured under the Breach Notification Rule, provided the encryption key was not compromised.
Do we need a business associate agreement with our IT company?
Yes, if your IT provider can access systems that hold PHI, you need a BAA with them before they start. Bluetek will sign a Business Associate Agreement with every medical client before work begins.
Does HIPAA apply to veterinary clinics?
Generally no, because HIPAA covers human health information. Vet clinics still hold payment and client data, and the same security safeguards help protect it.
