A HIPAA compliance checklist is a practical list of the safeguards a healthcare practice needs so patient data stays private. It covers what counts as protected health information, how you encrypt and log access to it, the agreements you sign with vendors, and how your website quietly collects data.
Most clinics I speak with assume they are covered because a software vendor said so. That is usually where the trouble starts.
What counts as protected health information
Start here, because the whole checklist hangs on this one idea. Protected health information, or PHI, is any health data that can be tied back to a person. The Health Insurance Portability and Accountability Act, passed in the United States in 1996, names 18 identifiers that turn ordinary data into PHI.
The list runs wider than most people guess. It includes names, dates, phone numbers and email addresses. It also includes the things clinics forget: full-face photos, medical record numbers, vehicle plates, device serial numbers, and IP addresses. According to the federal de-identification standard at 45 CFR 164.514, all 18 of them are spelled out.
In our audits of clinic websites, the identifier that catches practices out is the IP address their analytics logs. You collect it the moment a visitor loads a page. If that same page shows appointment types or a symptom quiz, you have tied an identifier to health context. That is PHI, sitting in a third-party log where you cannot see it.
The technical safeguards to check
The Security Rule is the part auditors test hardest. It sorts controls into three buckets: administrative, physical and technical. For a website, the technical safeguards are where most gaps hide, so work through them in order.
Encryption comes first. Data moving between a browser and your server should travel over TLS, and the current baseline is TLS 1.2 or 1.3. Data sitting in a database should be encrypted at rest, usually with AES-256. Check both. A padlock in the address bar protects data in transit, not the nightly backup file on your host.
Access controls come next. Every staff member needs a login of their own, so you can tell who opened which record. Shared logins break that trail on day one. Add multi-factor authentication, and set a session timeout so an unlocked reception screen does not sit open for hours.
Audit logging is the control clinics skip most. Your systems should record who viewed, changed or exported a record, then keep those logs. Without them, you cannot answer the first question after a breach: what did the attacker actually reach? The full Security Rule text lives at 45 CFR Part 164.
Business Associate Agreements and hosting
You rarely handle patient data alone. Your booking tool, your email host, your cloud server: each one touches PHI on your behalf. Under the Privacy Rule, every such vendor is a business associate, and you need a signed Business Associate Agreement before data flows to them.
That agreement is not a formality. It is the document that passes your legal duty onto the vendor, and it is the first thing a regulator asks for after an incident. A popular plugin or a cheap host is worth little if the company behind it will not sign one.
Hosting matters for the same reason. General shared hosting suits a brochure site. A site that stores or transmits PHI needs a host that will sign a Business Associate Agreement and support encryption, backups and access logs. We set this up in our healthcare website development work, and go deeper in the HIPAA compliant website security guide that sits alongside this checklist.
Analytics and tracking, the quiet leak
Here’s the trap that catches careful clinics. You add Google Analytics or a Meta Pixel to learn where patients come from. That tracker sends the visitor’s IP address, and sometimes the page URL, to a third party. If the URL names a condition, you have shared PHI with no signed agreement in place.
This is not hypothetical, and honestly it surprised a few clients when we showed them. According to United States regulators, tracking pixels on health sites can leak this data to a third party. The Federal Trade Commission’s health breach notification rule now reaches apps and sites that once sat outside HIPAA. A practice manager we helped put it plainly: “we assumed the plugin was fine because it was popular.” Popularity is not a safeguard.
The fix does not mean flying blind. Route analytics through a tool that will sign an agreement, strip identifiers before they leave your server, or keep tracking off the pages that reveal health context. Thankfully, this is a settings problem, not a rebuild.
The Australian parallel, the Privacy Act 1988
If your clinic sits in Australia, HIPAA does not apply to you at all. The rules that bind you are the Privacy Act 1988 and the Australian Privacy Principles it carries. Health information is classed as sensitive information, which sits in the highest tier of protection under that Act.
The Office of the Australian Information Commissioner, the OAIC, enforces those principles. Since 2018, the Notifiable Data Breaches scheme has required you to report an eligible breach that risks serious harm, both to the OAIC and to the people affected. You can read the scheme on the OAIC notifiable data breaches page.
The wording differs from HIPAA, but the checklist barely moves. Encrypt data, restrict access, log it, vet your vendors, and be honest about what your website collects. The Australian Privacy Principles map cleanly onto the same controls. A clinic in Sydney and a practice in Texas are solving one problem with two different statute numbers.
The checklist you can print
Here’s the short version to work through with your web team. It maps each area to the United States and Australian rule, so a single table covers both audiences.
| Area | What to check | US (HIPAA) | Australia (Privacy Act 1988) |
|---|---|---|---|
| Data in transit | TLS 1.2 or 1.3 on every page and form | Security Rule | Australian Privacy Principle 11 |
| Data at rest | Database encrypted, AES-256 or better | Security Rule | Australian Privacy Principle 11 |
| Access | Unique logins, MFA, session timeout | Security Rule | Australian Privacy Principle 11 |
| Audit logs | Record who viewed or changed a record | Security Rule | Australian Privacy Principle 11 |
| Vendors | Signed agreement before data flows | Business Associate Agreement | Australian Privacy Principle 8 |
| Analytics | No identifiers sent to unsigned trackers | Privacy Rule | Australian Privacy Principle 6 |
| Breaches | A written plan to report inside the deadline | Breach Notification Rule | Notifiable Data Breaches scheme |
| PHI mapping | Know where the 18 identifiers actually live | Privacy Rule | Sensitive information rules |
Work top to bottom and log the gaps as you go. If a row makes you wince, that is the row to fix first. For the practice-side controls behind the website, our note on medical practice data security carries the detail this table leaves out.
FAQ
What is a HIPAA compliance checklist?
A practical list of the safeguards a healthcare practice needs so patient data stays private. It runs from what counts as protected health information, through encryption and access logs, to the agreements you sign with vendors. A short list you act on beats a long policy that gathers dust.
What are the 18 identifiers?
They are the data points that make health information personal under the rule. Names, dates, phone and fax numbers, email and IP addresses, medical record numbers, full-face photos and device serials all sit on the list. If one of them can point back to a patient, treat it as PHI.
Do small clinics really need Business Associate Agreements?
Yes, and size does not excuse you. Any vendor that stores or moves patient data on your behalf counts, from your booking widget to your cloud backup. Get the signed agreement before data flows, because a regulator will ask for it after an incident, not before.
How is Australia different from the United States?
Australian clinics answer to the Privacy Act 1988 and the Australian Privacy Principles, not HIPAA. The OAIC enforces them, and the Notifiable Data Breaches scheme sets the reporting duty. The statutes read differently, yet the day-to-day controls line up almost one for one.
Is a compliant website enough on its own?
No. The website is one surface. Staff training, device security, paper records and vendor contracts all sit inside the same duty. Treat this checklist as the web slice of a wider practice, and pair it with the operational controls your team handles offline.
Key takeaways
A HIPAA compliance checklist turns a broad legal duty into a short list you can act on. Map the 18 identifiers that make data PHI. Encrypt it in transit and at rest, log who touches it, and sign a Business Associate Agreement with every vendor that handles it. Watch your analytics, because a tracking pixel can leak an IP address and a condition to a third party with no agreement in place. In Australia the same controls satisfy the Privacy Act 1988 and the Australian Privacy Principles, enforced by the OAIC through the Notifiable Data Breaches scheme. Different statute, same habits.
Want the checklist run against your live site rather than guessed at? That is the work we do in healthcare website development, page by page, with a fix list you can hand to your web team.
Sources
- 45 CFR Part 164, HIPAA Security Rule: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164
- 45 CFR 164.514, de-identification rule: https://www.ecfr.gov/current/title-45/section-164.514
- Federal Trade Commission, Health Breach Notification Rule: https://www.ftc.gov/business-guidance/resources/health-breach-notification-rule
- Australian Information Commissioner, Notifiable Data Breaches: https://www.oaic.gov.au/privacy/notifiable-data-breaches
Updated August 2026. Written by Sheetal Dhadial, founder of SIAGB, an AI-native consultancy in Sydney.
Ready to put this into practice?
Let's Talk
