The 2026 HIPAA Compliance Checklist
The 2026 Security Rule NPRM removes the 'addressable' escape hatch — every implementation specification becomes required. This is the checklist our auditors carry into Northeast Houston practices, with the evidence column that decides whether a control counts.
What's inside
68 controls across 10 domains
Administrative, physical, and technical safeguards, each mapped to the 45 CFR citation that governs it, so a finding can be traced to the rule it implicates.
The evidence column
For every control, what an auditor will accept as proof. A policy that says you encrypt is not evidence; an encryption status report with a date is.
2026 NPRM change log
The nine places the proposed rule changes what you must do, marked inline so you can see what is new rather than re-reading the whole rule.
Texas HB300 addendum
The three obligations state law adds on top of federal HIPAA — training cadence, 15-business-day electronic access, and authorisation for the sale of PHI.
90-day remediation sequence
If you fail most of this checklist, the order to fix things in — sequenced by risk reduction per dollar, not by what is easiest.
Who it's for
- →Practice administrators who own compliance but are not IT specialists
- →Physician owners deciding whether their current IT vendor is enough
- →Practices renewing cyber liability coverage and facing the security questionnaire
- →Anyone who has just received an OCR letter and needs to know where they stand
Table of contents
- →1. Security Risk Analysis and Risk Management
- →2. Access Control and Authentication
- →3. Encryption of ePHI
- →4. Network Segmentation and Asset Inventory
- →5. Audit Controls and Log Review
- →6. Contingency Planning and Backup
- →7. Technical Testing
- →8. Workforce Training and Sanctions
- →9. Business Associate Agreements and Vendor Risk
- →10. Incident Response and Breach Notification
- →Texas HB300 addendum
- →If you failed most of this: the 90-day sequence