Short answer: If HIPAA covers your practice, start with five steps. Sign a Business Associate Agreement (a contract that requires a vendor to protect patient information) with every vendor that handles that information, complete a risk assessment, set rules for texting and phone calls, train your staff and keep the records, and write a breach plan. Skipping them can lead to civil penalties of $145 to $2,190,294 per violation.
By Lu Haj, founder of HelpCo AI · Last updated
Checked against guidance from HHS (the federal health department), the federal rule text, and Google's HIPAA page. General information, not legal advice.
If you searched "HIPAA compliance checklist for small practices," start here. These steps assume your practice is covered. If you are not sure, read Does my practice need to be HIPAA compliant? first.
Civil penalties run from $145 per violation, for a practice that did not know about the problem, up to $2,190,294 per violation, for willful neglect that is never corrected (federal penalty table, January 2026). In between, the amount depends on how much the practice knew and whether it fixed the problem quickly.
A Business Associate Agreement (BAA) is a written contract that requires a vendor to protect the patient information it handles for you. Every vendor that handles that information needs one: your billing company, practice software, email and file storage, phone and texting platform, and answering service. HHS says even a cloud service that stores only encrypted (scrambled) information counts (HHS).
The Security Rule is HIPAA's set of rules for protecting patient information that is stored or sent electronically. It requires an "accurate and thorough assessment" of the risks to that information (45 CFR 164.308). In plain terms, list where patient information is kept, what could go wrong, and how you will reduce each risk.
HHS lets providers email patients if they use reasonable safeguards, such as limiting how much a regular, unencrypted email says. Patients can also ask to be contacted a certain way, and you should honor reasonable requests (HHS FAQ 570). HHS wrote that guidance about email, so ask your attorney how it applies to texting. Keep texts to scheduling details.
Any tool you use for calls and texts should come with a BAA. Google's HIPAA page, for example, says customers who have not signed a BAA with Google must not use patient information in Google Workspace (Google). Ask any phone or texting vendor whether a BAA covers your exact account type.
HIPAA requires you to train everyone who works for you on your privacy policies. Document the training and keep those records for six years (45 CFR 164.530).
A breach is, generally, a use or disclosure of patient information that HIPAA does not permit and that compromises its privacy or security. If one happens, notify the affected patients without unreasonable delay and no later than 60 days after you discover it. If 500 or more people are affected, tell HHS within 60 days as well (HHS). State laws can be stricter: Florida requires notice within 30 days (Fla. Stat. 501.171).
Not covered by HIPAA? State law and the FTC may still apply. See Does HIPAA apply to cash-only practices?
Please do not put patient information in any form, chat, or voicemail on this website.
A BAA, or Business Associate Agreement, is a written contract between a HIPAA-covered practice and a vendor that handles its patients' health information. The vendor agrees to use that information only as allowed and to safeguard it. HHS requires one before such vendors receive patient information.
If HIPAA does not cover your practice, it does not ban either one, though state law may apply. If it covers you, any vendor handling patient information needs a signed Business Associate Agreement (BAA), and a free personal account may not offer one. Ask your attorney first.
The HHS Office for Civil Rights (OCR) enforces HIPAA by investigating complaints and running compliance reviews. State attorneys general can also sue, and OCR refers possible crimes to the Department of Justice. In 2026, civil penalties run from $145 to $2,190,294 per violation, depending on how serious it was.
Book a free 15-minute call. We will walk through the setup and the Business Associate Agreement. You do not need to share patient information.
Book a Free 15-min Demo