HIPAA for small medical practices
What a doctor's office or small clinic needs in place under HIPAA — the core documents, the vendors that need a BAA, patient record requests, family members, and the gaps OCR finds most often.
On this page
HIPAA for small medical practices: at a glance
A doctor's office or small clinic is a HIPAA covered entity if it, or a billing service acting for it, conducts standard electronic transactions such as insurance claims or eligibility checks — which almost every practice that bills insurance does. A covered practice needs a documented risk analysis, written policies, staff training, BAAs with vendors that are business associates, a Notice of Privacy Practices, and a process for patients' record requests within 30 days. HIPAA permits sharing with other providers for treatment and, with conditions, with family members involved in care.
| HIPAA applies if | You or your billing service conduct standard electronic transactions |
|---|---|
| Most-missed item | A documented, current risk analysis |
| Patient record requests | Act within 30 days; one 30-day extension with written notice |
| Sharing for treatment | Permitted with other providers without authorization |
| Family members | Only what is directly relevant to their involvement — if the patient agrees or doesn't object, or professional judgment supports it |
| Vendors that usually need a BAA | EHR, billing service, IT support, cloud storage, email, texting, telehealth, AI scribes |
Does HIPAA apply to your practice?
A health care provider is a covered entity if it transmits health information electronically in connection with a standard transaction — claims, eligibility checks, referral authorizations, remittances — directly or through a billing service (45 CFR 160.103). There is no exemption for small practices. A fully cash-pay practice that never conducts these transactions may not be covered; check with Does HIPAA apply?.
This page is the general starting point for physician practices and clinics. Some practice types have their own pages because their HIPAA questions differ: therapists and psychologists, dental practices, and physical therapists and chiropractors.
The core documents
Most of a small practice’s HIPAA program is a handful of documents kept current:
| Document | Rule | Notes |
|---|---|---|
| Risk analysis and risk management plan | 164.308(a)(1) | Required; the item OCR most often finds missing or outdated |
| Policies and procedures | 164.316, 164.530(i) | Written, reviewed when things change |
| Workforce training records | 164.530(b), 164.308(a)(5) | Every new hire, and when policies change |
| Notice of Privacy Practices | 164.520 | Given at first visit, posted in the office and on the website |
| BAAs | 164.502(e), 164.504(e) | With each vendor that is a business associate |
| Breach assessments | 164.402, 164.414 | Written four-factor assessment for each incident |
Keep this documentation for six years (164.316, 164.530(j)).
Everyday questions
Sharing with other providers. Disclosures for treatment — referrals, consults, sending records to a specialist or hospital — don’t need the patient’s authorization (164.506). Use reasonable safeguards when sending.
Family members. You may share information directly relevant to a family member’s or friend’s involvement in the patient’s care or payment, if the patient agrees or doesn’t object when given the chance; if the patient isn’t present or can’t agree, you may use professional judgment about what’s in their interest (164.510(b)).
Patient record requests. Act within 30 days, with one 30-day extension if you notify the patient in writing; provide the format requested if readily producible; charge only a reasonable, cost-based fee (164.524). See right of access. Separately, the federal information blocking rules (45 CFR Part 171) apply to health care providers and can make unreasonable delays in releasing electronic health information a problem even beyond HIPAA.
Ransomware and email
HHS treats ransomware that encrypts patient data as a security incident and a presumed breach — notification follows unless a documented assessment shows a low probability of compromise. Tested, offline backups, MFA on email and remote access (recommended), and staff training against phishing are the controls that matter most for a small practice. The HIPAA email and practice management pages compare tools on BAA terms.
Main risks
- No documented risk analysis, or one that covers the EHR but not email, laptops, phones and the patient portal.
- Missing the 30-day deadline — or overcharging — when a patient asks for their records.
- Vendors with access to patient data — IT support, billing, cloud backup, reminder services — without a signed BAA.
- Shared logins at the front desk and former staff who still have access.
- Phishing that compromises a mailbox full of patient messages.
- Ransomware with no tested backups and no plan for breach assessment.
Requirements that matter most here
- Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
- HIPAA policies and procedures →§ 164.316What written policies and procedures HIPAA requires, how to keep them current, and how long to keep them — for small practices and business associates.
- HIPAA training requirements →§ 164.530(b)Who must be trained under HIPAA, on what, how often, and how to document it — and what the rule does not actually require.
- Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
- Notice of Privacy Practices →§ 164.520What the Notice of Privacy Practices must say, when and how a practice must provide it, where it must be posted, and what changed in 2026.
- Right of access →§ 164.524Patients' right to see and get copies of their health records: deadlines, formats, fees, third-party requests, and what a small practice needs in place.
- Minimum necessary →§ 164.502(b)What the HIPAA minimum necessary standard requires, when it does not apply, and how small practices put it into practice with role-based access and standard disclosure limits.
- Access control and sign-in →§ 164.312(a)(1)Only the right people should reach ePHI, each under their own account, with a reliable way to confirm who is signing in. In practice: unique user accounts, strong authentication such as MFA, and automatic logoff.
- Notifying patients of a breach →§ 164.402An impermissible use or disclosure of unsecured PHI is presumed to be a breach unless a documented four-factor assessment shows a low probability of compromise. Affected individuals must be notified without unreasonable delay and no later than 60 days after discovery.
Solutions to look at
- Practice management and EHR →ToolPractice management and EHR systems for therapy and small medical practices — how each puts its BAA in place, from which plan, and what that agreement covers.
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- Patient texting and messaging →ToolPhone, text and messaging platforms for practices that sign a BAA — what's included in the price, how the agreement is put in place, and what to watch for when texting patients. A BAA is necessary for a vendor that handles PHI, but it does not by itself make texting patients secure or appropriate — that also depends on your own safeguards and policies.
- Telehealth and video visits →ToolVideo platforms for therapy and medical visits that sign a BAA — on which plans, how you get the agreement, and what you still have to set up.
- Cloud storage and file sharing →ToolCloud storage services that sign a BAA — on which plans, how you put the agreement in place, and what you must configure before storing patient files.
- AI medical scribes →ToolAI scribes that turn visits into clinical notes — whether they sign a BAA, what happens to the recordings, and what clinicians need to check before using them with patients.
- Online HIPAA training courses →ToolOnline HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
- HIPAA risk assessment software →ToolTools for the security risk analysis HIPAA requires — from the free HHS SRA Tool to paid platforms with guidance, remediation tracking and expert help. What each covers and what it costs.
If something happens
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
- HIPAA training for new employees — and the rest of onboarding →What HIPAA training a new employee needs, when, and how to document it — plus the access steps when someone joins your practice or company and when they leave.
- You received a letter from OCR →A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
Your path to compliance
- Confirm HIPAA applies to you and in which role — Does HIPAA apply?
- Put the requirements above in place, starting with a documented risk analysis.
- Choose how to do the work — yourself, with templates, software, a consultant or an attorney — compare every route.
Frequently asked questions
Does HIPAA apply to a small doctor's office?
Yes, if the practice — or a billing company on its behalf — submits claims or other standard transactions electronically. Size doesn't matter; there is no small-practice exemption.
Can a doctor's office talk to a patient's family member?
HIPAA permits sharing information directly relevant to a family member's involvement in the patient's care or payment, if the patient doesn't object or, when the patient can't agree, the provider judges it to be in their best interest.
Can we fax records to another doctor?
Yes. Sharing for treatment is permitted without the patient's authorization. Use reasonable safeguards, such as confirming the fax number before sending.
How long can a practice take to give patients their records?
No more than 30 days after the request, with one 30-day extension if you tell the patient in writing why and when. Fees must be reasonable and cost-based.