HIPAA IT checklist for remote-first care teams
Short answer: HIPAA's Security Rule expects a remote-first care company to control access to client data, manage and encrypt every laptop and phone, protect email and backups, sign BAAs with vendors, log sign-ins, keep an incident response plan and train staff. Start with multi-factor authentication and device management, then work through the rest.
When your clinicians and staff work from home, your office is every laptop, phone and home network they use. HIPAA's Security Rule still applies to all of it. This checklist covers the controls a remote-first care company should have in place, in the order most teams can implement them. For a step-by-step MFA and encryption rollout, see MFA and encryption for small health companies. For choosing a productivity suite, see Google Workspace vs Microsoft 365 for HIPAA.
Is the HIPAA Security Rule changing?
HHS proposed the largest update to the Security Rule since 2013, including mandatory multi-factor authentication and encryption. As of mid-2026 it remained a proposed rule, with final action targeted for 2027. The current rule is still in force, and the proposed controls are good practice either way.
What identity and access controls belong on a HIPAA IT checklist?
- Single sign-on for every system that touches client data
- Multi-factor authentication for all staff, using an authenticator app or security key
- Role-based access: clinicians see their clients, billing sees billing
- Same-day removal of access when someone leaves
- Quarterly access reviews for EHR and billing systems
What device controls should remote care teams enforce?
- Company-managed laptops enrolled in device management
- Full-disk encryption, screen lock and automatic updates enforced
- Endpoint detection and response on every device
- Remote lock and wipe for lost or stolen devices
- A written rule for personal phones: either managed apps only or no client data
How should email and communication be protected?
- A Business Associate Agreement with your email and chat providers
- Phishing protection and regular simulated phishing tests
- No client details in email subject lines
- Approved, BAA-covered tools for video sessions and messaging
What about data, backups and vendors?
- An inventory of every system that stores client data
- Encryption at rest and in transit
- Backups that are tested by actually restoring them
- A retention schedule and secure deletion
- A signed BAA with every vendor that handles client data
- A short security review before adding any new tool
- A list of who owns each vendor relationship
What monitoring, response and paperwork belong on the list?
- Central logging for sign-ins and admin actions
- Alerts for impossible travel, new admin accounts and mass downloads
- A written incident response plan with named roles
- A breach notification process that matches HIPAA timelines
- Security training at onboarding and every year
- A current security risk analysis, updated when systems change
- Written policies that match what you actually do
How do you offboard a clinician in one hour?
- Disable the identity account.
- Revoke sessions and app passwords.
- Lock and wipe the device remotely if it will not be returned.
- Transfer client records and inbox ownership.
- Remove access to shared drives and the EHR.
- Record the date and time for your audit trail.
Frequently asked questions
Does HIPAA require MFA today?
The current rule requires reasonable access controls and is interpreted to call for strong authentication in most cases. The proposed update would make MFA explicit. See the MFA and encryption guide for an eight-step rollout.
Can clinicians use personal laptops?
It is risky. If you allow it, require device management, encryption and approved apps.
How often should we do a risk analysis?
At least yearly and whenever you add major systems or change how you work.
What should a HIPAA IT checklist cover first?
Start with identity (SSO and MFA), then device management and encryption, then email and vendor BAAs. The sections above walk through that order.
Can Keepwell declare a company ready under HIPAA?
No. Keepwell helps gather security evidence and run controls. Compliance depends on your own policies and risk analysis.
Sources and last check
Last checked October 11, 2026. Primary sources: HHS OCR Security Rule materials and the proposed Security Rule updates published in the Federal Register. Confirm current status with counsel before relying on any proposed requirement.
How Keepwell helps
Keepwell runs IT for remote-first care companies: devices shipped ready, accounts secured, offboarding in an hour and HIPAA evidence on hand. Get an IT assessment to see your gaps.