HIPAA Compliance FAQ: Answers for Healthcare Providers
Practical Answers to Common HIPAA Questions
Short answer: HIPAA compliance for a healthcare practice rests on four things: a Security Risk Assessment (a documented review of the risks to the patient data your practice holds), written policies that match how your office actually works, training for every member of your workforce, and records that prove all three are happening.
Jump to a Category
Compliance Basics
Misconceptions, where to start, and the difference between compliant and audit-ready.
6 questions →Security Risk Assessments
Requirements, common mistakes, what an SRA produces, and how long it takes.
5 questions →HIPAA Training
Frequency requirements, documentation, role-based training, and corrective action.
4 questions →Policies & Procedures
How many policies you need, template use, review cycles, and proving implementation.
5 questions →What the HIPAA Rules Say vs. What Most Practices Do
Several answers below point to the same few sections of the regulation. Here they are side by side, with links to the official text on eCFR. Most of these rules protect ePHI (electronic protected health information, meaning patient health information that is created, stored, or sent electronically). For the government's own overview, see the HHS Security Rule page.
| Topic | What the rule says | Citation | In practice |
|---|---|---|---|
| Risk assessment | Risk analysis is a Required implementation specification: an accurate and thorough assessment of the potential risks and vulnerabilities to ePHI. | 45 CFR 164.308(a)(1)(ii)(A) | One assessment each year |
| Workforce training | Train every workforce member by the compliance date, each new member within a reasonable period after joining, and anyone whose job is affected by a material policy change. | 45 CFR 164.530(b)(2)(i) | Train at hire, then once a year |
| Training records | Document that the training has been provided. | 45 CFR 164.530(b)(2)(ii) | Keep each person's name, the training completed, and the date and time |
| Written policies | Maintain policies and procedures in written (which may be electronic) form, and review documentation periodically. | 45 CFR 164.316(b)(1)(i) and (b)(2)(iii) | Review policies once a year |
| Keeping records | Retain required documentation for 6 years from the date of its creation or the date when it last was in effect, whichever is later. | 45 CFR 164.316(b)(2)(i) | Keep each version dated, so you can show what was in effect and when |
Additional HIPAA FAQ Hubs
Looking for answers about audit readiness or business associate agreements? Visit our dedicated FAQ pages for in-depth coverage. For definitions of the terms used throughout these answers, see the HIPAA compliance glossary.
HIPAA Compliance FAQ
Compliance Basics
6 questions01What's the biggest misconception healthcare providers have about HIPAA?+
One of the biggest misconceptions is that being careful is the same thing as being compliant. Many organizations have an IT provider, use unique user IDs, maintain audit logs, and change passwords regularly, but none of those efforts are documented in policies and procedures. HIPAA compliance requires both implementation and documentation.
02What's the first thing a provider should do if they don't know where to start?+
Start with a Security Risk Assessment (SRA, a documented review of where your patient data lives, what could go wrong with it, and how well it is protected). A risk assessment provides a baseline understanding of your current compliance posture and helps identify areas requiring attention. A typical assessment takes 75 to 90 minutes to complete.
03Can a small practice really be audited?+
Yes. A common misconception is that small practices are exempt from HIPAA audits. HIPAA applies to all covered entities (the health care providers, health plans, and health care clearinghouses the rule regulates) regardless of size, and OCR (the HHS Office for Civil Rights, the agency that enforces HIPAA) investigates complaints against practices of any size. A small practice is not exempt just because it has fewer staff or patients.
04What's the difference between being HIPAA compliant and being audit-ready?+
Being HIPAA compliant means performing the activities required by the regulation. Being audit-ready means having documented proof of those activities available for review. Organizations should maintain documentation supporting their compliance efforts so they can demonstrate those efforts when requested. I have seen how much this matters: a Florida mental health office with a state auditor due in days got audit-ready in under a week and passed (Case 01). Our audit readiness checklist lists the documents to have on hand.
05Which HIPAA consulting service is best for a dental office that needs policies, training, and a security risk assessment?+
A dental office rarely needs a big-firm engagement. It needs one consultant who handles all three pieces together instead of selling them as separate projects: a Security Risk Assessment to establish the baseline, policies customized to how the office actually runs, and staff training that satisfies the workforce requirement. One Guy Consulting does all three for dental practices, one person, start to finish.
Security Risk Assessments
5 questions07Is a HIPAA risk assessment required annually?+
HIPAA requires regular risk assessments under 45 CFR 164.308(a)(1)(ii)(A). Most practices do one each year to maintain a current view of risks and stay compliant. Here is the requirement, word for word:
Risk analysis (Required). Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.
45 CFR 164.308(a)(1)(ii)(A)
HHS explains what a good one covers in its guidance on risk analysis.
08What's the biggest mistake organizations make during a risk assessment?+
Getting scared of answering "No." The purpose of a risk assessment is to identify deficiencies. Finding gaps is not failure: it's the reason the assessment exists.
09What does a risk assessment produce?+
A risk assessment finds gaps between what you do now and what HIPAA requires. Once you know the gaps, you can rank and fix them.
10If a risk assessment uncovers serious issues, should a provider panic?+
No. The important thing is that the organization is making a good-faith effort to identify and address deficiencies. Most organizations have compliance gaps when they begin the process.
11How long does a typical risk assessment take?+
Most Security Risk Assessments take approximately 75 to 90 minutes to complete, depending on the size and complexity of the organization.
HIPAA Training
4 questions12Is annual HIPAA training required?+
Yes, HIPAA requires workforce members (employees, volunteers, trainees, and others whose work is under the practice's direct control, paid or not) to receive training at hire and regularly thereafter. Most organizations train annually because it is easy to manage and document.
13What proof should be retained after HIPAA training?+
Organizations should maintain records including:
- the employee's name
- the training completed
- the date and time the training occurred
14Is generic HIPAA training enough?+
Not fully. HIPAA has common themes, but every practice has its own risks and workflows that staff need to know.
15What happens if an employee never receives HIPAA training?+
Fix the issue as soon as you find it. Write down what went wrong and what you did to fix it.
Policies & Procedures
5 questions16How many HIPAA policies does a healthcare organization need?+
There is no required number. What matters is whether the organization's policies collectively address the requirements applicable to the organization.
17Are policy templates acceptable?+
Templates are a good starting point. But you should update the wording to match your own operations, staff, tech, and compliance setup.
18How often should policies be reviewed?+
At least once a year. Annual policy reviews keep documentation current with operational changes, regulatory updates, and new risks. The Security Rule makes review part of the job:
Updates (Required). Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.
45 CFR 164.316(b)(2)(iii)
19Is having policies enough?+
No. Organizations must also demonstrate that policies are being implemented and followed.
20What's more important: the policy itself or proving it's being followed?+
Both matter equally. Policies set the rules. Records prove you followed them.
No questions match that search. Try a shorter word, check the glossary, or ask Chuck directly.
What These Answers Look Like in Practice
These answers come from real work with real offices. Three examples from my case studies, with clients kept anonymous:
- Audit-ready in under a week (Case 01). A mental health franchise office in Florida had a state auditor due in days. Its policies were never written, its records had holes, and staff training was half done. A ranked action plan and daily check-ins got it audit-ready in under a week, and it passed its state audit.
- Every missing BAA signed (Case 05). A single-location practice found several vendors handling protected health information with no BAA (Business Associate Agreement, the contract that spells out how a vendor must protect the patient data it handles) in place. It got every missing BAA signed and set up a vendor review it can run again.
- About 17% more take-up across 100+ offices (Case 03). A health group with more than 100 offices lifted take-up of its HIPAA program by about 17% after I read the data and reached out office by office, person to person.
One Guy Consulting in 37 seconds
Who Wrote These Answers
Have a HIPAA Question That's Not Listed Here?
Book a free 30-minute intro call. We will review your setup, answer your questions, and show you what compliance looks like for your practice.