HIPAA Compliance Checklist for Miami Medical Practices in 2026

HIPAA fines reached record levels in 2025, with many violations traced to small practices with outdated IT controls. This checklist covers the technical safeguards every Miami healthcare practice must have in place.

Administrative Safeguards

• Designate a HIPAA Security Officer
• Conduct annual Security Risk Analysis (SRA)
• Maintain written HIPAA policies and procedures
• Train all staff on HIPAA annually and document training
• Establish sanction policy for violations

Technical Safeguards

• Encrypt all ePHI at rest and in transit (AES-256 minimum)
• Implement multi-factor authentication on all systems accessing ePHI
• Maintain access controls — least privilege, unique user IDs
• Enable automatic logoff after inactivity (15 minutes max)
• Maintain audit logs of all access to ePHI
• Use HIPAA-compliant email (encrypted, BAA in place)

Physical Safeguards

• Secure workstations in locked areas or with screen privacy filters
• Control physical access to servers and network equipment
• Establish media disposal procedures for hard drives and devices

Business Associate Agreements

Every vendor who handles ePHI on your behalf must sign a Business Associate Agreement (BAA). This includes your IT provider, cloud backup provider, EHR vendor, and billing service.