HIPAA IT checklist for San Antonio healthcare organizations
The HIPAA Security Rule requires covered entities and business associates to implement 26 addressable and required IT controls across Technical, Physical, and Administrative Safeguards. This checklist maps each control to a verifiable implementation step. IDENETY MSP has completed this checklist for healthcare clients in San Antonio — including a 45-physician group that passed an OCR audit with zero findings.
Technical Safeguards
45 CFR § 164.312Unique user IDs, automatic logoff, encryption/decryption procedures
Hardware, software, and procedural mechanisms to record and examine activity
Policies to protect ePHI from improper alteration or destruction
MFA on all systems that access ePHI — EHR, M365, remote access
Encryption of ePHI in transit — TLS 1.2+ on all connections
BitLocker on all workstations and servers; encrypted backup storage
15-minute screen lock policy via Group Policy or MDM
Documented break-glass procedure for emergency ePHI access
Physical Safeguards
45 CFR § 164.310Documented policies limiting physical access to systems containing ePHI
Written policy specifying proper use of workstations that access ePHI
Physical safeguards for workstations — screen privacy filters, locked rooms
Policies for disposal, re-use, and accountability of hardware and media
Retrievable exact copy of ePHI before moving equipment
NIST 800-88 media sanitization before disposal or re-use
Administrative Safeguards
45 CFR § 164.308Risk analysis + risk management + sanction policy + information system activity review
Named Security Officer responsible for HIPAA compliance
Authorization procedures, supervision, and termination procedures
Role-based access controls; access authorization and modification procedures
Annual security awareness training for all workforce members
Documented Incident Response Plan with breach notification procedures
Data backup plan + disaster recovery plan + emergency mode operation plan
Periodic technical and non-technical evaluation of security controls
Signed BAA with every vendor that handles ePHI — including IT providers
Annual tabletop exercise testing the Incident Response Plan
Documented inventory of ePHI systems and their criticality to operations
Formal access request and approval workflow; quarterly access reviews
Completed for a 45-physician San Antonio medical group
IDENETY MSP completed all 26 controls for a multi-location medical group facing an OCR complaint. The practice passed the OCR audit with zero findings in six weeks. All controls were documented in an audit-ready evidence package.
Read the full case studyFrequently asked questions
What is the HIPAA Security Rule?
The HIPAA Security Rule (45 CFR Part 164, Subpart C) requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect electronic protected health information (ePHI). It applies to any organization that creates, receives, maintains, or transmits ePHI.
What is the difference between required and addressable HIPAA controls?
Required controls must be implemented exactly as specified. Addressable controls must be implemented if reasonable and appropriate — if not, the organization must document why and implement an equivalent alternative. 'Addressable' does not mean optional.
Does my IT provider need to sign a BAA?
Yes. Any vendor that handles, stores, or transmits ePHI on your behalf is a Business Associate and must sign a Business Associate Agreement (BAA). This includes your MSP, cloud backup provider, email provider, and EHR vendor.
How often must a HIPAA risk analysis be conducted?
The HIPAA Security Rule requires a risk analysis whenever there is a change to the environment — new systems, new workflows, new vendors, or a security incident. OCR guidance recommends at minimum an annual review.
HIPAA-aligned managed IT for San Antonio healthcare
IDENETY MSP has completed this checklist for healthcare clients and documented every control in an audit-ready evidence package.
Book HIPAA assessment