31-Point IT Compliance Checklist for Healthcare Businesses in Orange County (2026)

MFA requires a second verification method (phone, authenticator app) beyond passwords. This blocks 99% of credential-based attacks targeting healthcare practices. Most EHR vendors support MFA—enable it today.

Weak passwords are exploited in 80% of healthcare breaches. Require uppercase, numbers, symbols, and mandate changes every 90 days. Document this in your security policy.

Shared logins (e.g., 'frontdesk' account used by multiple staff) violate HIPAA's accountability requirement. Each user must have their own unique login to enable audit trail tracking.

Front desk staff shouldn't access lab results; billing staff shouldn't see clinical notes. Configure user roles so each employee sees only what they need. Review access quarterly.

Audit logs are your proof of compliance. Check for failed login attempts, after-hours access, or bulk data downloads. Export logs monthly and store them for 6 years.

Former employees who retain system access are a major compliance risk. Document all terminations and immediately remove credentials. Verify removal in your EHR and email systems.

Your EHR should connect via secure HTTPS. Check your browser URL bar—it must show a lock icon. Verify this with your EHR vendor or IT provider today.

A stolen laptop without encryption is a breach requiring OCR notification. Use Windows BitLocker or Mac FileVault on all workstations. Takes 30 minutes to enable.

Doctors working from home must use an encrypted VPN tunnel—never direct internet access to EHR systems. Configure VPN with strong authentication and monitor concurrent connections.

Sending unencrypted patient data via email is a breach. Configure your email system to encrypt outgoing messages or use secure patient portals instead.

Encrypted backups prevent breach if backup media is lost. Schedule monthly restoration tests to prove backups work. Document results in your compliance file.

This foundational policy must cover access controls, encryption, audit logs, incident response, and vendor management. Use HIPAA.com or HITECH Act templates as starting points. Review with legal counsel familiar with CA healthcare law.

Your plan must define breach notification procedures, evidence preservation, OCR reporting timelines, and patient communication steps. Run a tabletop drill annually and document participation.

Your EHR vendor, cloud provider, billing service, and backup vendor all need signed BAAs. Send BAA requests today; most vendors already have standard agreements. Non-compliant vendors create liability for you.

Define how long you keep patient records, backup retention schedules, and how you securely destroy old data. Use HIPAA-certified shredding services for paper records and certified data wiping for drives.

Patients must see how their data is used. Provide a printed copy at check-in and a digital version online. Update it annually or when practices change.

Keep 6 years of documentation proving your compliance efforts. Organize by category (access logs, training records, risk assessments, audit reports). Use a shared drive with restricted access.

Cover confidentiality obligations, access controls, password security, and breach reporting. Use a written checklist or vendor-provided training. Have employees sign an acknowledgment form and file it for 6 years.

Annual training keeps security top-of-mind. Include phishing awareness and new threat scenarios. Use recorded training or live sessions—either works as long as attendance is documented.

Doctors treating a patient can access records; accounting staff cannot. Define legitimate use cases (treatment, payment, operations) and document employee training on policy.

Written agreements enforce accountability. Include consequences for unauthorized access or disclosure. Include contractors, vendors, and temporary staff.

Map all systems (EHR, email, backups, mobile devices), identify vulnerabilities (unpatched software, weak passwords, missing encryption), and document findings with remediation timelines. Hire a third-party assessor if you lack internal expertise.

Unpatched systems are exploited in ransomware attacks targeting healthcare. Enable automatic updates where possible or schedule monthly patch days. Document all patches applied.

Use automated scanning tools to identify open ports, weak SSL configurations, and unpatched software. Document scan results and track remediation progress. Address critical findings within 7 days.

Hire a third-party firm to test your defenses (phishing emails, network infiltration, data exfiltration). Document findings and remediate critical issues immediately. Proves to auditors you take security seriously.

EDR monitors for malware, ransomware, and suspicious behavior in real-time. It's critical for detecting healthcare-targeted ransomware before it encrypts patient data. Many MSPs include EDR in managed service plans.

Assign clear accountability. These roles can be held by the practice manager or IT provider. Ensure they understand breach notification requirements and OCR reporting procedures.

Define who to notify (patients, media, OCR), when (within 60 days of discovery), and how (email, mail, news). Include OCR portal submission steps. Test the plan annually.

Record date, scope (number of records affected), cause, and remediation for every breach—even minor ones. This log proves compliance efforts to auditors and regulators.

Phishing is the top attack vector for healthcare breaches. Deploy email filtering tools and send fake phishing emails to staff monthly. Track click rates and retrain high-risk employees.

Review EHR audit logs for signs of ransomware (mass file access) or insider threats (bulk PHI downloads). Set up alerts for abnormal activity and investigate within 24 hours.