You don't need another breach to prove your controls are insufficient. The October 2025 incident at Unlimited Technology Systems, which exposed patient data including Social Security numbers and medical diagnoses, and Meridian Health Plan of Illinois's April 2026 provider portal compromise affecting 21,027 individuals demonstrate a pattern: healthcare organizations repeatedly fail at the same control points.
This checklist focuses on the HIPAA Security Rule's administrative, physical, and technical safeguards that would have prevented or contained these incidents. Each item includes the specific regulatory reference and what "done right" actually looks like in practice.
What This Checklist Covers
This is your pre-breach audit. It addresses the three control categories where healthcare data breaches originate: third-party vendor security, access management to systems containing protected health information, and incident detection capabilities. If you can't mark each item complete with evidence, you're exposed.
The checklist maps to HIPAA Security Rule requirements under 45 CFR Parts 160 and 164, Subpart C. It's designed for risk managers and compliance officers who need to verify controls are operational, not just documented.
Prerequisites
Before you start this checklist, confirm you have:
- Current data inventory: You know where protected health information lives, including within vendor environments and third-party data centers.
- Access to your Business Associate Agreements: You need to verify what your vendors committed to contractually.
- Your incident response plan: The documented procedures you're supposed to follow when unauthorized access occurs.
- Audit log access: You can pull and review access logs from systems containing protected health information.
If you're missing any of these, stop. You can't verify controls without them.
Checklist Items
Vendor Risk Management (§164.308(b))
1. Business Associate Agreements contain specific security obligations
Your BAAs must require vendors to implement administrative, physical, and technical safeguards. Good looks like: Your agreement with any revenue cycle management company or practice management software provider specifies encryption requirements, access logging, and breach notification timelines that match your own HIPAA obligations.
2. Vendor security assessments completed within 12 months
You've reviewed SOC 2 Type II reports, conducted security questionnaires, or performed on-site assessments of any vendor accessing protected health information. Good looks like: Documentation showing you evaluated the security posture of your practice management software provider before they hosted patient data in their commercial data center.
3. Vendor access is logged and reviewed quarterly
You can produce reports showing which vendor accounts accessed your systems, when, and what data they touched. Good looks like: Monthly access logs from your provider portal showing which healthcare provider accounts authenticated, with quarterly reviews flagging anomalous access patterns.
Access Controls (§164.312(a)(1))
4. Role-Based Access Control limits data exposure
Users can only access the protected health information necessary for their job function. Good looks like: Your billing staff can see patient balance information and insurance details but cannot access full diagnostic records or scanned government IDs.
5. Unique user identification enforced across all systems
No shared credentials exist for accessing protected health information. Good looks like: Every person who accesses your electronic health record system, claims processing platform, or provider portal has their own username tied to their identity.
6. Multi-factor authentication required for remote access
Any access to systems containing protected health information from outside your network requires something beyond a password. Good looks like: Your provider portal won't authenticate users without both credentials and a time-based code from an authenticator app.
7. Access reviews conducted every 90 days
You verify that current access rights match current job responsibilities and terminate access for departed employees within 24 hours. Good looks like: Quarterly reports showing you deactivated accounts for terminated employees and adjusted permissions for staff who changed roles.
Audit Controls (§164.312(b))
8. Automated alerts configured for suspicious access patterns
Your systems notify security staff when unusual activity occurs. Good looks like: You receive alerts when a user account accesses an abnormally high volume of patient records or when authentication attempts occur outside normal business hours.
9. Audit logs retained for minimum 6 years
You can reconstruct who accessed what data going back through your record retention period. Good looks like: Searchable logs showing every access to protected health information, stored in a tamper-evident format that meets your state's record retention requirements.
10. Log review occurs within 72 hours of any access anomaly
When your monitoring tools flag unusual activity, someone investigates before the trail goes cold. Good looks like: Documentation showing your security team reviewed provider portal logs within 48 hours of detecting the unauthorized access on April 28, 2026, not weeks later.
Incident Response (§164.308(a)(6))
11. Incident response plan tested in last 12 months
You've run a tabletop exercise simulating unauthorized access to protected health information. Good looks like: Meeting notes from a simulated breach scenario where your team practiced evidence preservation, breach assessment timelines, and notification procedures.
12. Breach assessment timeline documented
You know exactly how long you have to determine if unauthorized access constitutes a breach requiring notification under the Health Information Technology for Economic and Clinical Health Act. Good looks like: A flowchart showing your 60-day assessment window and decision points for triggering notifications to affected individuals and HHS.
13. Forensic investigation vendor pre-qualified
You have a relationship with a digital forensics firm before you need one. Good looks like: A signed agreement with a cybersecurity and forensics company that can begin investigation within 24 hours of your call, not a scramble to find one after you've detected unauthorized activity.
14. Data breach notification templates ready
Your legal team has pre-approved letter templates that include all required elements under HIPAA Breach Notification Rule (45 CFR §164.404-414). Good looks like: Template letters specifying what information was exposed, what you're doing about it, and what services you're offering to affected individuals, ready to customize with incident-specific details.
Common Mistakes
Treating vendor security as the vendor's problem: The covered entity remains liable under HIPAA even when a business associate causes the breach. Your BAA doesn't transfer your compliance obligation.
Waiting until after detection to start the clock: The 60-day breach assessment period and notification requirements begin when you discover the incident, not when you finish investigating. Delayed detection means compressed response timelines.
Confusing audit logging with audit log review: Having logs doesn't count if nobody looks at them. The unauthorized access at Meridian Health Plan's provider portal went undetected until April 28, 2026, suggesting insufficient real-time monitoring of authentication events.
Assuming encryption solves everything: Encrypted data at rest doesn't help if an attacker obtains valid credentials and accesses the data through your application layer while it's decrypted for use.
Next Steps
If you marked fewer than 14 items complete, prioritize in this order:
- Fix vendor access logging and review (items 3, 8, 10), this addresses the provider portal compromise pattern.
- Implement multi-factor authentication for remote access (item 6), this prevents credential-based unauthorized access.
- Establish your forensic investigation relationship (item 13), you can't afford to lose days finding help after an incident.
Schedule your next full checklist review for 90 days from today. Compliance isn't a project with an end date.
