HIPAA and HITECH Checklist for Tennessee Medical Practices

First determine whether the organization is a HIPAA covered entity, a business associate, or both in different relationships. HHS says covered entities include health plans, clearinghouses, and healthcare providers that conduct certain transactions electronically; business associates perform specified functions or services involving PHI on behalf of covered entities. Use HHS’s covered-entity guidance and business-associate guidance as starting points.

• Inventory EHR, billing, imaging, laboratory, email, file-sharing, backup, telehealth, patient-portal, mobile, and paper-to-digital workflows.
• Record where ePHI is created, received, maintained, and transmitted.
• Include outsourced IT, cloud services, support vendors, connected devices, and subcontractors.
• Assign an owner to each system and data flow.

The Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to ePHI. OCR says the analysis must cover all ePHI an organization creates, receives, maintains, or transmits, regardless of its medium or location. OCR does not prescribe one universal methodology or a fixed review frequency. Its current risk-analysis guidance explains the required scope and documentation.

• Identify threats, vulnerabilities, existing safeguards, likelihood, and potential impact.
• Document risk levels and corrective actions instead of relying on an undocumented conversation or questionnaire.
• Revisit the analysis after meaningful changes such as a new EHR, acquisition, office move, cloud migration, or incident.
• Connect each accepted or remediated risk to an accountable owner and review date.

Risk analysis identifies and measures risk; risk management is the process of selecting and implementing reasonable and appropriate measures. The Security Rule is flexible and scalable, but that flexibility requires decisions to be grounded in the regulated entity’s environment. HHS groups the required protections into administrative, physical, and technical safeguards.

• Prioritize risks to confidentiality, integrity, and availability of ePHI.
• Document chosen safeguards, responsible people, target dates, and residual risk.
• Cover contingency planning, backups, emergency operations, and restoration—not only prevention.
• Evaluate whether safeguards remain effective when technology or operations change.

The Security Rule addresses workforce authorization, access management, termination procedures, access controls, authentication, and audit controls. Its technical safeguards are not a product shopping list; the practice must implement reasonable and appropriate measures based on its risk analysis. HHS summarizes each safeguard and implementation specification.

• Use unique accounts and give users only the access their work requires.
• Separate routine accounts from administrator accounts and protect remote and privileged access with MFA where the risk analysis supports it.
• Approve, record, review, and promptly remove employee and contractor access.
• Inventory service accounts, shared credentials, emergency accounts, remote-support tools, and vendor access.
• Enable logs that can help reconstruct access and security-relevant changes.

For a deeper implementation guide, use the WTSS privileged-access checklist for small Tennessee healthcare practices.

OCR’s January 2026 guidance connects system hardening with Security Rule areas including access control, encryption, audit controls, and authentication. It recommends enabling and correctly configuring security measures in the context of risk analysis and risk management. The guidance discusses baselines, configuration, unnecessary services, patching, and monitoring.

• Maintain supported systems, secure configurations, patches, endpoint protection, and tested backups.
• Disable unnecessary accounts, services, software, and insecure remote-access paths.
• Evaluate encryption for stored and transmitted ePHI and document the resulting implementation decision.
• Test recovery and confirm that backup administration cannot be reached through the same compromised account used for daily work.

When a vendor creates, receives, maintains, or transmits PHI on a regulated entity’s behalf, a business associate relationship may exist. HHS lists cloud providers, EHR and IT support vendors, certain app developers, and some device technicians among its examples. Required written agreements must define permitted uses, safeguards, incident reporting, subcontractor obligations, and other terms. HHS publishes the required elements and sample provisions.

• Maintain a vendor inventory tied to systems and PHI flows.
• Confirm the agreement is executed before the vendor handles PHI and that it matches the actual service.
• Record security and breach-reporting contacts, contractual deadlines, subcontractor use, data return, and termination procedures.
• Do not assume that encryption or a vendor’s “HIPAA-ready” marketing removes the need for analysis or an agreement. HHS says even a no-view cloud provider maintaining encrypted ePHI is generally a business associate.

A security incident is not automatically a reportable breach, and breach decisions should not be improvised. Establish who preserves evidence, contains systems, obtains legal advice, coordinates with business associates and insurers, performs the required assessment, and authorizes notices.

For breaches affecting 500 or more individuals, notice to HHS must be submitted without unreasonable delay and no later than 60 calendar days after discovery. Smaller breaches have a different federal reporting schedule. HHS provides the current reporting instructions and deadlines. Business associates also have notice obligations to covered entities under the rule.

Tennessee has a separate data-breach notification law. The Tennessee Attorney General summarizes it as generally requiring notice to affected Tennessee residents within 45 days when covered personal information was or may have been acquired by an unauthorized person, subject to the statute’s terms and a law-enforcement extension. Review the Attorney General’s summary and obtain counsel to reconcile potentially overlapping federal, Tennessee, contractual, and sector-specific duties.

The Security Rule requires regulated entities to maintain required policies, procedures, and documentation for six years after the later of creation or the date the document was last in effect. It also requires periodic review and updates when environmental or operational changes affect ePHI security. HHS details those documentation requirements.

• Retain risk analyses, risk-management decisions, policies, evaluations, approvals, training records, incident records, vendor agreements, and evidence of corrective work as applicable.
• Keep proof that safeguards operate: access reviews, backup tests, patch reports, vulnerability remediation, tabletop exercises, and follow-up records.
• Document recognized security practices consistently if the organization intends to ask OCR to consider them under the HITECH amendment.