The 2026 HIPAA Compliance Guide: Build Your Program in 8 Steps

Your office manager retires, and on her last day she hands you a three-inch binder labeled HIPAA. Inside is a policy manual from a template, a training sign-in sheet from two years ago, and a risk assessment someone filled out the year the practice opened. Every page is real, and none of it adds up to a program.

I see a version of that binder all the time. It is not a sign that anyone failed. Nobody hands you a HIPAA program. They hand you the paperwork somebody left behind.

What the binder is missing is the order. A program is a sequence, and each step feeds the next. Write policies before you know your risks, and you write policies for somebody else's practice.

So let me follow one practice through the order. Lakeview Family Dental has 25 people and an office manager named Maria, who just inherited that binder. Lakeview and Maria are an illustration, not a real practice or client. The steps and the rules behind them are real.

Step 1: Name your privacy officer and your security officer

On her first Monday, Maria finds the page titled Privacy Officer. The name on it belongs to the manager who just retired. Nobody ever named a security officer at all.

The Privacy Rule requires a designated privacy official and a contact for complaints, in writing. The Security Rule requires a named security official. (Source: 45 CFR 164.530(a); 45 CFR 164.308(a)(2).) HHS says one person can hold both roles, and uses a small provider office as its example. (Source: HHS Security Series #2.)

In small practices, the title often goes to whoever has been there longest, with no training and no time. Maria fits that description. The fix is simple. Dr. Patel, the owner, signs a one-page designation naming Maria to both roles and blocks two hours a week on Maria's calendar for the work.

Step 2: Complete the risk analysis

Maria starts a list on a legal pad. The EHR. The imaging software. The billing company. Email. The reminder-text service. Then the front desk lead mentions she pastes appointment notes into an AI chat tool to draft messages, and that goes on the list too.

That list is the start of the risk analysis, and it is Required: "an accurate and thorough assessment of the potential risks and vulnerabilities" to the electronic patient information you hold. (Source: 45 CFR 164.308(a)(1)(ii)(A).) A questionnaire filled out once is not this. You list every place the data lives and rate what could go wrong with each one.

OCR keeps making this point. Top of the World Ranch Treatment Center, an Illinois treatment provider, had 1,980 patients' information compromised after a phishing attack, and OCR found evidence it had no accurate and thorough risk analysis. It paid $103,000 and accepted two years of monitoring. (Source: HHS, February 19, 2026.) How to run your own is in the HIPAA risk assessment guide.

Step 3: Build the risk management plan

Maria's analysis turns up three problems. The front desk shares one login. The laptop Dr. Patel takes home is not encrypted. And nobody has ever tried to restore the backup.

Finding them is not enough. Risk management is Required: measures "sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level." (Source: 45 CFR 164.308(a)(1)(ii)(B).) So each problem gets an owner and a date.

The shared login goes first, because unique user identification is Required. (Source: 45 CFR 164.312(a)(2)(i).)

The laptop raises Maria's best question: is encryption required? Encryption at rest and in transit is addressable. (Source: 45 CFR 164.312(a)(2)(iv), (e)(2)(ii).) Addressable does not mean optional. You implement it if it is reasonable and appropriate, or you document why not and use an equivalent alternative if that is reasonable and appropriate. (Source: 45 CFR 164.306(d)(3).) For a laptop that leaves the building every night, Lakeview decides encryption is reasonable, turns it on, and writes the decision down.

The backup becomes a test date in Step 7. And the EHR access log nobody reads gets a monthly review on Maria's calendar, because reviewing system activity is Required too. (Source: 45 CFR 164.308(a)(1)(ii)(D).)

Step 4: Write your policies and procedures

Maria opens the template manual. It describes a fax machine Lakeview sold years ago and a records clerk the practice has never employed.

Policies must be in writing, and the Privacy Rule says they must be "reasonably designed, taking into account the size and the type of activities" of your organization. (Source: 45 CFR 164.316; 45 CFR 164.530(i).) Size changes how long they are. It does not change whether you need them.

The test comes fast. A patient emails asking for her X-rays, and Maria looks for the policy that says who answers and how quickly. There is none. The rule is to act within 30 days, with one 30-day extension if you tell the patient why in writing before the first 30 days run out. (Source: 45 CFR 164.524(b)(2).)

The same gap surfaced at Shen Smiles, a Pennsylvania dental practice, in a $140,000 settlement announced October 8, 2026. OCR determined it had failed to implement Privacy Rule policies, including right of access policies. (Source: HHS.) More in what that settlement says about the file behind the chart.

Step 5: Put every vendor under a business associate agreement

Maria lines up her vendor list against the BAA folder. The billing company has an agreement. The reminder-text service does not. And the IT company Lakeview let go in 2022 still has old server backups.

Every vendor that creates, receives, maintains, or transmits your patients' information needs a business associate agreement first. (Source: 45 CFR 164.308(b); 45 CFR 164.502(e); 45 CFR 164.504(e).) What a good one says is in Business Associate Agreements, Explained, and the questions to ask beyond the signature are in A Signed BAA Is Not Satisfactory Assurance.

The old IT company is the one practices forget. The agreement should require it to return or destroy your data at the end, if feasible. (Source: 45 CFR 164.504(e)(2)(ii)(J).) Maria asks for written confirmation. Former vendors are often the gap nobody checked.

The Center for Children's Digestive Health, a small Illinois pediatric practice, paid $31,000 because neither it nor its records vendor could produce a signed agreement. (Source: HHS.)

Step 6: Train your workforce

Now Maria has something to teach. The old sign-in sheet was for a generic video that opened with the year HIPAA was enacted. Nobody at Lakeview remembers a word of it.

Training comes after policies because you train people on your policies. Every workforce member needs it as their job requires, new hires within a reasonable time, and everyone affected when a policy materially changes, with records kept. (Source: 45 CFR 164.530(b).) The Security Rule adds an awareness program for everyone, including management, and its four specifications, such as security reminders, are addressable. (Source: 45 CFR 164.308(a)(5).)

The training that sticks starts with the person, not the law. Ours opens with the staff member's own security officer, photo included. Prospects who see it tell us it beats the $29 training nobody even watched. At Lakeview, that face is Maria's.

A rule nobody was taught is hard to enforce, and having and applying sanctions is Required. (Source: 45 CFR 164.308(a)(1)(ii)(C); 45 CFR 164.530(e).)

Step 7: Prepare for breach response and contingency

A Tuesday in March. The front desk lead clicks a link in an email that looks like it came from Lakeview's dental supply company, and her screen does something strange. Who does she call?

Because of Step 6, she knows: Maria. And Maria has a written procedure to follow, because responding to and documenting security incidents is Required. (Source: 45 CFR 164.308(a)(6).)

The harder question is Thursday. If the server is locked, how does Lakeview see patients on Friday? A contingency plan answers that, and three parts are Required: a data backup plan, a disaster recovery plan, and an emergency mode operation plan. Testing them is addressable, and Maria runs that restore test anyway. (Source: 45 CFR 164.308(a)(7).)

This time the link was harmless. But Maria's procedure already names the clocks that start if it is not. Patients hear from Lakeview without unreasonable delay, and no later than 60 days after discovery. (Source: 45 CFR 164.404.) If 500 or more people are affected, the HHS Secretary hears at the same time. If fewer, Maria logs it and reports within 60 days after the year ends. (Source: 45 CFR 164.408.) Notice to the media is a separate test, triggered only when more than 500 residents of one state or jurisdiction are affected. (Source: 45 CFR 164.406.)

Vision Upright MRI, a one-site imaging practice, paid $25,000 after OCR found it had never done a risk analysis and had not notified patients within 60 days of discovery. (Source: HHS.) The most common gaps are worth reading before you write your plan.

Step 8: Keep the record current and stay audit ready

A year later, Lakeview adds a second location and a new imaging system. Maria does not start over. She goes back to Step 2 and adds them to the list.

That habit is the rule. Security documentation is kept six years, made available to the people who use it, and reviewed and updated as things change. All three are Required. (Source: 45 CFR 164.316(b)(2); privacy counterpart 45 CFR 164.530(j).) You also evaluate the program periodically and after changes to your operations. (Source: 45 CFR 164.308(a)(8).)

The binder Maria inherited was a pile of old paper. The one she keeps now is a dated record of decisions, and she can hand any of it over in an afternoon. To check yours against the full list, use the HIPAA compliance checklist. The questions an auditor asks come from the HIPAA audit protocol, built on these same rules.

The rules behind the eight steps

Maria never needed the textbook version of HIPAA, and you do not either. The full definition is in What Is HIPAA Compliance?, and the three rules split simply: the Privacy Rule covers patient information in every form, the Security Rule covers the electronic kind, and the Breach Notification Rule covers what you owe people when something goes wrong. (Source: 45 CFR Part 164.)

Civil money penalties come in four tiers, set by what you knew and how quickly you corrected it, and the budget side is in How Much Does HIPAA Compliance Cost? (Source: 45 CFR 160.404; 45 CFR 102.3.) A proposed Security Rule overhaul was published January 6, 2025. It is still a proposal, and the Unified Agenda lists final action for July 2027, so build to the rule in force today. (Source: 90 FR 898; RIN 0945-AA22.) More in the 2026 HIPAA Security Rule overhaul.

Could you hand over all eight this afternoon?

If the answer is no, you are in good company. Nobody showed you the order. Now you have it. If you cannot find a current risk analysis, start there this month.

Since 2010, we have helped 500+ healthcare organizations build these eight steps, with a 100 percent audit success rate. Audit-ready in 60 days, or we keep working at no additional cost until you are.

Get My Audit-Readiness Score and see which of the eight steps your program is missing.