In this episode of the HIPAA Insider Show, Adam and Gil unveil the Ultimate HIPAA Checklist for 2025, a must-have resource for healthcare organizations and businesses navigating compliance. From conducting annual security risk assessments to managing business associate agreements, this episode covers every essential step to ensure your HIPAA program stays robust and audit-ready.

Key topics include:

The importance of annual security risk assessments and audits
Effective gap analysis and remediation planning
Annual staff training and onboarding requirements
Managing vendor relationships with business associate agreements (BAAs)
Developing a comprehensive incident response plan
Whether you’re new to HIPAA or a seasoned compliance professional, this checklist provides actionable insights to safeguard patient data and maintain regulatory compliance in 2025. Stay ahead of the curve and ensure your organization’s compliance plan is proactive and up-to-date.

🎧 Check out the checklist here: https://www.hipaavault.com/are-you-hipaa-compliant/

Transcript

Adam Zeineddine
Or. Welcome back to the HIPAA Insider Show. I’m Adam, and as always, I’m joined by our resident HIPAA expert, Gil Vidal. Today we’re bringing you the ultimate hipaa checklist for 2025. If you’re listening to us on podcast, we will be sharing the screen. But not to worry, we’ll have a link to the checklist in the description that you can check out. While you’re at it, give us a five star review on your podcast app. If you’re watching us on YouTube, hit the like and subscribe. So today we’re bringing you the ultimate hipaa checklist for 2025.

Gil Vidals
That’s right, Adam. Whether you’re someone who’s into compliance already or you’re just starting off in your healthcare business journey, this checklist will be a strategic guide for you to make sure you have everything in place for HIPAA compliance.

Adam Zeineddine
Yeah. So let’s kick things off with the first item on the checklist, the security risk assessment. Why is this the foundation of HIPAA compliance, Gil?

Gil Vidals
Well, that’s a good question. The security risk assessment is essential because it identifies the weaknesses or the vulnerabilities in the systems in the platform that could potentially expose patient data. And it’s not just about checking a box. It’s about actively mitigating risks. For 2025. Focus on emerging threats like ransomware, phishing attacks targeting healthcare.

Adam Zeineddine
Yeah, and you mentioned for 2025 there. Does the risk assessment need to be done annually?

Gil Vidals
At the minimum, yes, it should be done annually. Now, some companies may decide to do it every six months or every quarter, but at least once a year is important. And remember, if you’re audited, you need to show records for the last six years.

Adam Zeineddine
Yeah, you mentioned audits there. Next stop is annual HIPAA audits, so that would be self audits. I’m assuming the checklist mentions six types of audits. Walk us through these, Gil.

Gil Vidals
Sure. So there’s there are six kinds of reviews or audits you need to be aware of. The first one is the security standards audit. This evaluates how well you’re protecting your electronic health information. And then you have a privacy standards audit which focuses on patient privacy policies. You have next the high tech subtitle D audit, which ensures compliance with breach notification requirements. The fourth one is asset and device audit. Tracks every device that accesses sensitive data. Number five is physical site audit review, physical security measures and Refinery 6 policies and procedures review to ensure these documents are up to date and actionable.

Adam Zeineddine
Okay. And then it moves on to the next section where it says, have you identified all the gaps uncovered in the audits above? And then have you documented any deficiencies or all deficiencies?

Gil Vidals
Sure. When you’re looking for deficiencies, they call those gaps. If you have a gap in your security plan, then you need to figure out, well, how are we going to fix the gaps? How are we going to close the gaps? That’s called the remediation plan. And for 2025, it’s vital to not only document these plans, but also to update them annually. So you want to continuously keep up to date with the gaps that you have. So if you are audited, you can show that you’re actively looking at things, finding gaps, planning to remediate them. Remember, the auditor is not looking for perfection. They’re looking for due diligence.

Adam Zeineddine
Okay. And let’s talk about an item that often may be overlooked when it comes to HIPAA compliance, and that’s staff training.

Gil Vidals
Yeah, I can’t really emphasize this one enough. Your staff is your first line of defense. Every employee must complete HIPAA training annually. And you need documentation that proves that your employees are receiving this training.

Adam Zeineddine
And what about new staff that are being onboarded?

Gil Vidals
Part of your orientation when you bring in a new employee should be to have them understand the HIPAA policies by taking a learning module. I think that’s a good way to indoctrinate them into your company’s procedures for HIPAA compliance. Yeah.

Adam Zeineddine
Well, moving on to vendors and business associates, what does the checklist say about them?

Gil Vidals
It really talks about due diligence. Start by identifying every vendor and business associate who handles patient data. And then make sure you have the va, the business associate agreement, in place for each of them. You’re really taking inventory of all your vendors. If you find a vendor that is touching or processing medical records, medical data, then you need to review the ba, make sure that they have one in place in your files.

Adam Zeineddine
And again, does this need to be reviewed annually or what’s the frequency there?

Gil Vidals
Yeah, the BA document itself doesn’t need to be reviewed every year. So you do need to review every year whether you have all your vendors covered and whether they all have a baa. But the BAA itself, unless there’s a reason to change it, to modify it, you don’t really need to review it annually for any kind of compliance. But of course, it doesn’t hurt if you’ve forgotten what’s in there. It can’t hurt to review them. Now, most of these vendor bas are going to be the same so if you’ve read one, you’ve read them all. So you don’t need to literally read each one for every vendor, but you shouldn’t be familiar with them. That’s so true.

Adam Zeineddine
Yeah. And then last item on the checklist. Do you have a defined process, for instance, and breaches? So what processes should organizations have in place there?

Gil Vidals
Yeah, I mean, once an incident happens, Adam, there’s going to be a lot of activity and a lot of concerns. So you want to have everything written down as to what you should do, who you should call, what documents you need to fill out, what you should do. You don’t want to be trying to think of all that when you’re under duress or when you’re under some kind of pressure. So instead you want to have all this written out, including the tracking of the incident, the investigation phase, the reporting of the breaches, and whether they’re minor or meaningful. So you need to have all that in place so that when you are ready to handle this, it goes smoothly and you’re not. Have to, you’re not inventing this as you go.

Adam Zeineddine
Yeah. So like a standard operating procedure, SOP specifically for breaches.

Gil Vidals
That’s right.

Adam Zeineddine
And staff should, if I understand correctly, they should always have a way to report incidents anonymously. Is that right?

Gil Vidals
Yeah. It’s a good idea. Because you don’t want your employees to be reluctant if they see something happening within the organization, something suspicious that involves patient data. You want them to feel comfortable reporting it to management so they don’t feel like they’re tattletailing or they’re going to get in trouble. So it is important to have that in place.

Adam Zeineddine
All right, great. Well, there you have it. That’s the ultimate checklist for HIPAA in 2025. Gil, any final tips for our listeners?

Gil Vidals
Yeah. Unfortunately, HIPAA compliance isn’t a just a one and done checklist. You could just put in your desk drawer. Forget about it. It’s an ongoing process, especially since you’ll be scanning your assets, your system and platform on a regular basis, remediating, working with your team to close those gaps. So think about it more as a. It’s dynamic. You have to be actively working at it. Because think about it this way. If you’re not actively working, your plan, the plan, malicious and bad actors, they’re trying to get in, they’re trying to break in all the time, and they’re constantly trying new things. So you want to make sure your plan is up to date and that you’ve tidied up your systems and making sure everything is buttoned up.

Adam Zeineddine
Thanks for that, Gil. So that wraps up our episode for today. Don’t forget to subscribe and tune in next week for more HIPAA insights. And until next time, stay compliant and stay secure.