Use this checklist in a meeting between your practice manager and IT contact. For each item, record the system, owner, evidence reviewed, open question, and next action. A checklist helps organize technical work; it does not replace a systematic security risk analysis or establish HIPAA compliance.
Start here.
- Ask for evidence of settings and coverage, rather than a general assurance.
- Give access, device, and incident tasks named owners.
- Include information outside the EHR in the wider risk review.
1. Check accounts and access
Review active staff, vendor, and administrator accounts together. Ask which systems support multifactor authentication (MFA), which accounts have it enabled, and where gaps remain. CISA recommends moving toward phishing-resistant MFA. Ask your provider which supported methods fit your systems.
- Can each person use an individual account with access appropriate to their role?
- Are administrator privileges separate from ordinary daily work?
- Who removes access when someone leaves or changes roles, including vendor access?
2. Check device and software coverage
Ask for the current inventory and evidence of update and security-tool coverage. Include devices and services used outside the office. Have the responsible provider explain unsupported software, missing protection, or changes that need application vendor coordination.
- Who reviews failed updates and vulnerabilities requiring attention?
- How are device encryption, screen locking, and approved remote access checked?
- Which exceptions need an owner, an agreed action, and a review date?
3. Make suspicious activity easy to report
Give staff a known contact and approved reporting method for suspicious messages, unexpected MFA prompts, missing devices, or unusual account activity. Practice the reporting step without using real patient information. Confirm unusual payment or account-change requests through a separately verified contact method.
Ask who receives technical alerts, who contacts practice leadership, and who covers an absence. Staff should be able to report a concern without first diagnosing it.
4. Check recovery and incident responsibilities
Review backup scope, failed-job follow-up, and the latest restore exercise record. Keep incident contacts available outside the systems they may need to recover. Ask who coordinates with your EHR, email, cloud, and support providers if several services are affected.
HHS’s voluntary healthcare Cybersecurity Performance Goals include access safeguards, training, vulnerability management, and incident preparedness. Use them to identify practical gaps with your provider; do not treat completion as a certification.
5. Keep a record the practice can act on
Mark each check as evidenced, needs work, or unknown. For an evidenced item, record what was reviewed and when. For the others, record the owner and next step. Keep sensitive configuration details in approved storage.
HealthIT.gov warns that a checklist alone falls short of a systematic security risk analysis. Use these findings as input to the practice’s broader review of electronic protected health information, including information outside the EHR. HIPAA safeguards also include administrative and physical responsibilities.
Sources
Sources checked on . References support the general guidance; they do not certify an IT provider.