HIPAA requires a small medical practice to do three things: know where its patient data lives (a documented risk analysis), protect that data with reasonable safeguards, and be able to show its work in writing. That’s the whole law in one sentence — everything else is detail. This guide walks an Indiana practice through those details in plain English, including the myths that generate most of the fines. One disclaimer up front: we’re an IT provider, not a law firm; this is practical guidance, not legal advice.
Who has to comply with HIPAA?
Every covered entity regardless of size: solo physicians, dental offices, therapy and counseling practices, chiropractors, home-health agencies — and the business associates who touch their data (billing services, IT providers, cloud vendors). There is no small-practice exemption. HHS’s enforcement arm has repeatedly fined practices with fewer than ten employees, and its audit history shows the #1 finding is the same every year: no documented risk analysis.
What does the HIPAA Security Rule actually require?
- Administrative safeguards — the paperwork layer: a named security officer (a role, not a hire), written policies, workforce training with sign-off, and the risk analysis that drives everything else.
- Physical safeguards — the boring layer: locked server closets, screens not visible from the waiting room, a policy for what happens to old computers and copiers (their drives remember).
- Technical safeguards — the IT layer: unique logins for every user (shared front-desk accounts are a violation), automatic screen locks, encryption on laptops and phones, access limited to what each role needs, and audit logs showing who looked at what.
The three myths that cause the most damage
- “Our EHR is HIPAA-compliant, so we’re compliant.” Software can’t be compliant — only a practice can. A compliant EHR on an unencrypted laptop with a shared password is a violation waiting for a theft.
- “We’re too small for anyone to notice.” Enforcement is complaint-driven and breach-driven, not size-driven. A disgruntled ex-employee or one lost laptop puts a solo practice in front of OCR exactly as fast as a hospital.
- “We did HIPAA in 2019.” The risk analysis has to be reviewed and updated as the practice changes — new EHR, new location, telehealth. A five-year-old binder is evidence of the gap, not protection against it.
What a breach actually costs a small practice
Fines scale with negligence — from thousands to seven figures for willful neglect — but the fine is rarely the worst part. Breach notification to every affected patient, mandatory reporting to HHS (and the media, past 500 records), plus the local reputation damage in a community where patients talk: that’s what closes small practices. The good news is that the controls that prevent this are the ordinary ones — encryption, MFA, backups, offboarding — done consistently and written down — the same core controls in our small business cybersecurity checklist.
Your first 90 days, in order
- Days 1–30: Run (or commission) the risk analysis — where does patient data live, who can touch it, what protects it. Name your security officer. Inventory every device.
- Days 31–60: Close the technical gaps the analysis found — typically encryption, MFA on email and the EHR, unique logins, screen locks, and a real backup with a tested restore.
- Days 61–90: Write the policies to match what you actually do, train the team (document who attended), and collect Business Associate Agreements from every vendor that touches patient data — including your IT provider.
Frequently asked questions
Does HIPAA apply to small medical practices?
Yes — every covered entity regardless of size, including solo practices, dental offices, and therapy clinics. There is no small-practice exemption.
What is the most common HIPAA violation found in audits?
A missing or outdated risk analysis — the documented assessment of where patient data lives and what protects it. It is consistently the #1 audit finding.
How much do HIPAA fines cost small practices?
From thousands of dollars for correctable issues to seven figures for willful neglect — though breach-notification costs and reputation damage usually hurt small practices more than the fine.
Where an IT partner fits
Most of the Security Rule’s technical safeguards are things a healthcare-aware IT provider deploys and documents as routine work — and the documentation is the compliance. QOS MSP signs BAAs and builds practices’ technical controls to survive an auditor’s checklist, here in Indiana. If your risk analysis is overdue or nonexistent, start the conversation — the first one costs nothing.