HIPAA IT requirements for a small medical or dental office

If you run a small medical or dental office in Tampa Bay, HIPAA probably feels like a binder nobody wants to open. The IT part is less mysterious than it looks. Underneath the legal language, the rule asks three fair questions: where does your patient data live, who can reach it, and how would you get it back?

Here is what the Security Rule asks of your computers, network and staff, mapped section by section, with plain answers.

This article is educational, not legal advice. For decisions about your own practice, talk with a healthcare attorney or a compliance professional.

What does HIPAA require from a small practice's IT?

HIPAA's Security Rule requires every practice that creates, stores or sends electronic protected health information (ePHI, meaning any patient data on a computer, server, phone or cloud service) to protect it with administrative, physical and technical safeguards. Those three groups live in the federal regulations at 45 CFR 164.308, 164.310 and 164.312, and the paperwork rules sit in 164.316.

The rule does not hand you a shopping list of products. It asks you to look at your own risks and choose protections that fit. Under 45 CFR 164.306(b), a practice weighs its size, complexity and capabilities, its technical setup, the cost of each measure, and how likely and how serious each risk is. That flexibility is good news for a 15-person office, but it also means "we bought antivirus" is not an answer by itself.

The official home for the rule is the HHS Security Rule page, where the Office for Civil Rights (OCR), the agency that enforces HIPAA, publishes its guidance.

1. 01

   3

   safeguard groups (administrative, physical, technical), 45 CFR Part 164, Subpart C

2. 02

   6 years

   : how long Security Rule documentation must be kept, 45 CFR 164.316(b)(2)(i)

3. 03

   July 2027

   : HHS's estimated date for final action on the proposed update, reginfo.gov (as of October 2026)

Which HIPAA safeguards are "required" and which are "addressable"?

A "required" safeguard must be in place, while an "addressable" one must be assessed, then either put in place or replaced with a documented, reasonable alternative, under 45 CFR 164.306(d)(3). Addressable never means optional. If you decide a safeguard does not fit, you write down why and what you do instead.

Here is how the safeguards that touch IT map to everyday work in a practice.

	Safeguard	Label	What it looks like in a small office
164.308(a)(1)(ii)(A)	Risk analysis	Required	A regular review of where patient data lives and what could go wrong
164.308(a)(1)(ii)(B)	Risk management	Required	A dated plan to fix what the risk analysis found
164.308(a)(5)	Security awareness and training	Addressable items	Phishing training, password rules, malware protection, log-in monitoring
164.308(a)(7)(ii)(A) and (B)	Data backup plan and disaster recovery plan	Required	Exact copies of patient data you can restore, and written steps to do it
164.308(b)	Business associate contracts	Required	A signed BAA with every vendor that touches ePHI, including your IT company
164.310(d)(2)(i)	Disposal	Required	Wiping or destroying old drives before a computer leaves the building
164.312(a)(2)(i)	Unique user identification	Required	No shared logins at the front desk
164.312(a)(2)(iii)	Automatic logoff	Addressable	Screens lock when someone walks away
164.312(a)(2)(iv)	Encryption and decryption	Addressable	Encrypted laptops and servers
164.312(b)	Audit controls	Standard	Logs that record who opened what
164.312(e)(2)(ii)	Encryption in transit	Addressable	Encrypted email and secure connections for patient data

• Safeguard

  164.308(a)(1)(ii)(A)

  Risk analysis

  164.308(a)(1)(ii)(B)

  Risk management

  164.308(a)(5)

  Security awareness and training

  164.308(a)(7)(ii)(A) and (B)

  Data backup plan and disaster recovery plan

  164.308(b)

  Business associate contracts

  164.310(d)(2)(i)

  Disposal

  164.312(a)(2)(i)

  Unique user identification

  164.312(a)(2)(iii)

  Automatic logoff

  164.312(a)(2)(iv)

  Encryption and decryption

  164.312(b)

  Audit controls

  164.312(e)(2)(ii)

  Encryption in transit

• Label

  164.308(a)(1)(ii)(A)

  Required

  164.308(a)(1)(ii)(B)

  Required

  164.308(a)(5)

  Addressable items

  164.308(a)(7)(ii)(A) and (B)

  Required

  164.308(b)

  Required

  164.310(d)(2)(i)

  Required

  164.312(a)(2)(i)

  Required

  164.312(a)(2)(iii)

  Addressable

  164.312(a)(2)(iv)

  Addressable

  164.312(b)

  Standard

  164.312(e)(2)(ii)

  Addressable

• What it looks like in a small office

  164.308(a)(1)(ii)(A)

  A regular review of where patient data lives and what could go wrong

  164.308(a)(1)(ii)(B)

  A dated plan to fix what the risk analysis found

  164.308(a)(5)

  Phishing training, password rules, malware protection, log-in monitoring

  164.308(a)(7)(ii)(A) and (B)

  Exact copies of patient data you can restore, and written steps to do it

  164.308(b)

  A signed BAA with every vendor that touches ePHI, including your IT company

  164.310(d)(2)(i)

  Wiping or destroying old drives before a computer leaves the building

  164.312(a)(2)(i)

  No shared logins at the front desk

  164.312(a)(2)(iii)

  Screens lock when someone walks away

  164.312(a)(2)(iv)

  Encrypted laptops and servers

  164.312(b)

  Logs that record who opened what

  164.312(e)(2)(ii)

  Encrypted email and secure connections for patient data

Source: 45 CFR 164.308, 164.310 and 164.312, via Cornell Law School's Legal Information Institute, checked October 2026.

Notice how much of that list is "addressable." Encryption is the classic example. Today's rule lets you document an alternative, but for a laptop that leaves the office, it is hard to picture a reasonable one.

What does HIPAA-ready IT look like in a 15-person office?

HIPAA-ready IT in a small practice usually means every person has their own login, every device is patched and protected, patient data is backed up and tested, and you have the paperwork to prove it. Here is the short list we walk through with practices across Pinellas and Pasco counties.

None of this needs enterprise software. Most of it is configuration, habit and follow-through, which is exactly the part that slips in a busy office.

Not sure where your practice stands?

Our free network assessment looks at your devices, logins, backups and network, then tells you in plain English what we found. Book a free network assessment for your practice.

Has the 2025 HIPAA Security Rule update been finalized?

No. As of October 7, 2026, the proposed update to the Security Rule has not been finalized, and the current rule is the one in force. HHS published the proposal on January 6, 2025 (90 FR 898). The federal regulatory agenda at reginfo.gov now lists it under "Long-Term Actions," with final action estimated for July 2027 (RIN 0945-AA22).

Clark Hill, a law firm, reported the move to the long-term list on July 13, 2026, and noted that agenda dates are planning estimates, not deadlines. The HIPAA Journal (May 18, 2026) summarizes what the proposal would change if it is finalized.

Our advice: do not wait for the final rule. Most of the proposal describes good practice that auditors already ask about. If it is finalized, the practices that already have encryption, multi-factor authentication and a current inventory will have the least scrambling to do.

Does your IT company need to sign a business associate agreement?

Yes. If your IT company can access patient data, the Security Rule requires a written business associate agreement (BAA) with them, under 45 CFR 164.308(b). That covers almost every managed IT provider, since we touch the servers, backups and email where ePHI lives.

The same goes for your cloud backup service, your email host, your phone system if it stores voicemails with patient details, and your practice management software vendor. Keep the signed copies with your other HIPAA documents, because the rule expects you to hold on to them.

At Radiant, we sign a BAA with healthcare clients before we touch a single system.

How should a small practice get started this month?

Start with a risk analysis, because every other safeguard depends on knowing where your patient data actually lives. The Office of the National Coordinator for Health IT (ONC), working with OCR, publishes a downloadable Security Risk Assessment Tool aimed at small and medium providers (version 3.7, page updated September 18, 2026). The tool's own page notes that using it is not required and does not by itself make you compliant.

1. 01

   Map your patient data

   List every place ePHI lives: the practice management system, imaging, email, scanners, laptops and cloud apps.

2. 02

   Run the risk analysis

   Use the SRA Tool or your IT provider's assessment to rate each risk by how likely and how serious it is.

3. 03

   Fix the big three first

   Turn on multi-factor authentication, encrypt laptops, and prove that a backup restore works.

4. 04

   Collect your BAAs

   Get a signed agreement from every vendor that touches patient data.

5. 05

   Train your team

   Run short security awareness sessions and phishing tests, and record who attended.

6. 06

   Write it down and date it

   Policies, the risk analysis and your fixes all go in one place, kept for at least six years.

Steps 1 and 2 usually take a small practice a couple of afternoons with help. The fixes in step 3 are where an IT partner earns its keep, since they touch every device in the building.

Where does managed IT fit into HIPAA compliance?

A managed IT provider handles the technical safeguards day to day, but the practice stays responsible for compliance. We can encrypt devices, run and test backups, manage logins and keep logs. You still own the policies, the training records and the decisions about what is reasonable for your office.

That split is how our HIPAA compliance IT service works for practices in Tarpon Springs, Clearwater, St. Petersburg and across Tampa Bay. It sits alongside our cybersecurity services and backup and disaster recovery, the two areas where the Security Rule's required safeguards land hardest. If you run a clinic or dental office, our IT for healthcare practices page shows how we work with front desks, imaging and practice management systems. Your cyber insurer will likely ask similar questions, and our post on cyber insurance requirements in Florida covers what they look for.

Want to know where your practice stands before the proposed rule lands? Our free network assessment checks your logins, devices, backups and network, and ends with a plain list of what to fix first.