New Jersey · New York · Pennsylvania
GBTech.ai

Resources

HIPAA IT checklist for small medical and dental practices in New Jersey (2026)

What the HIPAA Security Rule requires of a small practice's IT today, what the proposed 2025 update would add, and a practical checklist for medical and dental offices in New Jersey, New York and Pennsylvania.

By GBTech.ai · Published · Last reviewed

The short answer

The HIPAA Security Rule in force today applies to every practice, however small. It requires you to:

  • do a written risk analysis and manage the risks it finds
  • name a security official
  • train your staff
  • control who can access patient data
  • back up electronic protected health information (ePHI) and plan for disasters
  • have business associate agreements (BAAs) with vendors that handle patient data

A proposed update published in January 2025 would make multi-factor authentication (MFA), encryption, asset inventories, 72-hour system restores and yearly compliance audits explicit requirements. As of October 2026 it is still only a proposal. HHS's current regulatory agenda estimates a final rule in July 2027.

Meanwhile, risk analysis is the main focus of enforcement by HHS's Office for Civil Rights (OCR), including settlements with small practices.

What the Security Rule requires today

HIPAA's safeguards are either required or addressable. "Addressable" doesn't mean optional. HHS says you must assess whether each addressable safeguard is reasonable and appropriate for your practice. Then you either implement it, or document why not and adopt an equivalent alternative where reasonable.

Administrative safeguards (45 CFR 164.308).

  • Required:
    • a risk analysis and risk management
    • a sanction policy
    • regular review of system activity
    • a named security official
    • incident response procedures
    • periodic evaluation
    • written business associate agreements
  • Training: a training program for all staff, including management.
  • Contingency planning:
    • Data backup, disaster recovery and emergency-mode operation are required.
    • Testing those plans and analyzing which systems are most critical are addressable.

Physical safeguards (164.310). Including secure disposal of devices and media, and wiping them before reuse.

Technical safeguards (164.312).

  • Unique user IDs and emergency access procedures are required.
  • Automatic logoff and encryption of stored data are addressable.
  • Audit controls, data integrity and person-or-entity authentication are standards you must meet.
  • Encryption of data in transit is addressable.

Documentation (164.316). Keep your policies and records for six years from when they were created or last in effect, whichever is later.

The checklist

  1. Do a written risk analysis. Cover every place ePHI lives: your EHR and practice management system, imaging, email, laptops, phones, backups and cloud services. Update it when you change systems. We suggest reviewing it at least once a year.
  2. Act on it. Keep a risk management plan that lists each risk, what you're doing about it and by when.
  3. Name a security official. One person is accountable, even if an IT provider does the work.
  4. Train everyone, including the doctors and the office manager, and include phishing awareness.
  5. Give everyone their own login. No shared accounts. Remove access the same day someone leaves.
  6. Turn on MFA for email, remote access, your EHR (where supported) and admin accounts. The current rule doesn't name MFA, but it's one of HHS's essential cybersecurity goals for healthcare, and the proposed rule would require it.
  7. Encrypt laptops, phones and backups. Encryption is addressable today. But under HHS guidance, ePHI encrypted properly isn't "unsecured," so a lost encrypted laptop generally isn't a reportable breach.
  8. Back up and test restores. Keep at least one copy offline or off-site, and test that you can restore it. HHS's guidance for small practices recommends offline, off-site, encrypted backups.
  9. Patch promptly and run endpoint protection on every computer.
  10. Review logs. Regular review of system activity is a required safeguard.
  11. Sign BAAs with every vendor that creates, receives, stores or sends ePHI for you. That includes your IT provider, cloud storage (even if the provider can't read the data) and your backup service.
  12. Write an incident response plan, including how you'll handle breach notification (see below).
  13. Dispose of old devices securely, and keep proof.
  14. Keep your documentation for six years.

The proposed 2025 update: what would change

HHS published the proposed rule on January 6, 2025, and comments closed March 7, 2025. According to HHS's fact sheet, the proposal would:

  • remove the distinction between required and addressable safeguards
  • require an asset inventory and network map, updated at least every 12 months
  • require plans to restore critical systems within 72 hours
  • require a compliance audit every 12 months
  • require MFA and encryption, with limited exceptions
  • require vulnerability scans every six months and a penetration test every 12 months
  • require network segmentation and separate controls for backups
  • require business associates to verify their safeguards in writing every year

The proposed text would also set deadlines for patching critical risks and for cutting off departing staff. Practices would have 180 days to comply after a final rule takes effect.

Status: no final rule has been published as of October 2026. HHS's spring 2025 regulatory agenda targeted May 2026. Its current agenda lists the rule as a long-term action, with an estimated final action date of July 2027. HHS says the current Security Rule remains in effect.

Many of these items are good practice anyway, and starting now spreads the cost.

What enforcement looks like

OCR began its Risk Analysis Initiative in October 2024 and had completed 14 enforcement actions under it by June 2026. Examples involving smaller providers:

  • A small New York neurology practice paid $25,000 after a ransomware attack affecting about 6,800 people. OCR found it hadn't done an accurate and thorough risk analysis (April 2025).
  • A small California radiology provider that had never done a risk analysis paid $5,000 and agreed to two years of monitoring. The case involved a breach of its imaging server that affected 21,778 people (May 2025).
  • Regional Women's Health Group (Axia Women's Health), with offices in New Jersey, Pennsylvania and three other states, paid $320,000 after a breach affecting about 38,000 people. Again, the core finding was the lack of a thorough risk analysis (April 2026).
  • Shen Smiles, a Pennsylvania dental practice, paid $140,000 in a case that began with a complaint that it hadn't given a patient timely access to their records. OCR also found the practice hadn't adequately safeguarded patient information (announced October 2026).

Under HHS's 2026 inflation adjustment, civil money penalties range from $145 per violation where the practice didn't know of the violation, up to $2,190,294 for uncorrected willful neglect.

A 2021 law also requires HHS to consider whether a practice had "recognized security practices" in place for the previous 12 months when deciding fines and audits. Recognized practices include NIST guidance and HHS's 405(d) program. That can help your case, but it isn't a safe harbor.

If you have a breach

HIPAA.

  • Notify affected individuals within 60 calendar days of discovery.
  • If 500 or more people are affected, notify HHS at the same time.
  • If more than 500 residents of one state are affected, also notify prominent media in that state.
  • Log smaller breaches and report them to HHS within 60 days after the end of the year.
  • HHS guidance says a ransomware attack is presumed to be a breach unless an assessment shows a low probability that data was compromised.

New Jersey. New Jersey's breach law can apply as well. It applies when the exposed data includes a name plus a Social Security number, driver's license number, financial account details or online login credentials.

  • You must report to the New Jersey State Police before notifying affected residents.
  • Notify residents "in the most expedient time possible and without unreasonable delay."
  • If more than 1,000 people are notified, also notify the national credit bureaus.

Ask your counsel how your HIPAA procedures line up with the state law.

New York and Pennsylvania.

  • New York: residents must be notified within 30 days. HIPAA-covered entities must also notify the New York Attorney General within five business days of notifying HHS.
  • Pennsylvania: since Act 33 of 2024, the Attorney General must be notified when more than 500 residents are affected. People whose Social Security, bank account or ID numbers were exposed must be offered 12 months of credit monitoring.

Why this matters for a small practice

OCR's 2024 report to Congress counted 663 breaches affecting 500 or more people each, and 74,299 smaller ones. Hacking caused 81% of the large breaches. OCR's lessons learned included risk analyses that were too narrow, MFA added only after a breach, and weak log review.

The 2024 Change Healthcare attack affected about 192.7 million people. It also showed how a vendor outage can hit a practice's cash flow. In an American Medical Association survey in April 2024, mostly of practices with 10 or fewer physicians:

  • 80% had lost revenue
  • 55% had used personal funds to cover expenses
  • 31% had missed payroll

Plan for how you'd bill and operate if a key vendor went down.

Free tools from HHS

  • The Security Risk Assessment (SRA) Tool: built for small and medium providers. HHS notes that using it is neither required nor a guarantee of compliance.
  • 405(d) Health Industry Cybersecurity Practices (HICP): Technical Volume 1 is written for small organizations of roughly 1 to 10 physicians.
  • Healthcare Cybersecurity Performance Goals: ten voluntary "essential" goals:
    • fixing known vulnerabilities
    • email security
    • MFA
    • basic training
    • strong encryption
    • revoking departing staff's access
    • incident planning
    • unique credentials
    • separate admin accounts
    • vendor requirements

A note on "HIPAA certified" and Microsoft 365

HHS doesn't endorse or recognize private "HIPAA certifications," so be wary of anyone selling one.

Microsoft offers a BAA by default for services such as Exchange Online, SharePoint, OneDrive, Teams, Entra ID and Intune. As Microsoft itself says, using its services doesn't on its own make you HIPAA compliant. How you configure them matters.

How GBTech can help

GBTech can't make your practice "HIPAA compliant." No vendor can. Compliance is your practice's program. We can put the technical safeguards in place and help you document them. Our managed IT includes:

  • endpoint security
  • backups run and checked by our team, so restores are tested
  • Microsoft 365 hardening with Conditional Access and MFA
  • patching
  • a help desk

If you have an IT person already, our co-managed service works alongside them. Any IT provider that can access patient data needs a business associate agreement with your practice. Ask for one before work starts.

Talk to an advisor about where your practice stands, or see what cyber insurers ask about.

Frequently asked questions

Is the new HIPAA Security Rule in effect?

No. It was proposed in January 2025 and hasn't been finalized as of October 2026. HHS's current agenda estimates final action in July 2027, and practices would then have 180 days to comply. Today's rule still applies.

How often does a small practice need a risk analysis?

The current rule requires an accurate and thorough risk analysis, kept up to date and reviewed periodically. It doesn't set a fixed frequency, but the proposed rule would require yearly reviews. We suggest reviewing it at least once a year and whenever you change systems or vendors.

Does HIPAA require MFA or encryption right now?

Encryption is "addressable": you must assess it and implement it or document a reasonable alternative. MFA isn't named in the current rule, but HHS lists it as an essential cybersecurity goal for healthcare, and the proposed rule would require both.

Do our IT provider, Microsoft 365 and our backup service need BAAs?

Yes, if they create, receive, store or send ePHI for you. HHS says a cloud provider that stores ePHI is a business associate even if it can't read the data. Microsoft provides a BAA by default for its covered services.

Is a ransomware attack automatically a reportable breach?

HHS presumes it is, unless a documented assessment shows a low probability that the data was compromised.

Who do we notify in New Jersey, and in what order?

Follow HIPAA's rules for patients, HHS and, for large breaches, the media. If New Jersey's breach law also applies, report to the New Jersey State Police before notifying affected residents. Bring in counsel early.

What do OCR penalties look like for small practices?

Recent settlements with small providers have ranged from $5,000 to $140,000, plus multi-year corrective action plans. Penalty limits are much higher: up to $2,190,294 per year for uncorrected willful neglect.

Which free tools can help?

HHS's Security Risk Assessment Tool, the 405(d) HICP guide for small practices, and HHS's Healthcare Cybersecurity Performance Goals.

Sources

HIPAA rules and the proposed update:

Enforcement:

Breach notification:

Guidance and data:

Questions about your setup? Talk to an advisor.

Talk to an advisorSee what our managed IT covers →