Healthcare & HIPAA

Free HIPAA Compliance Checklist Generator

Create a HIPAA review checklist with evidence, unresolved findings and follow-up actions. Export a clear report in HTML, Word or PDF without a compliance score.

No signup
Browser-based generation
HTML & Word downloads
Print or save PDF

Make it yours

Create your HIPAA Compliance Checklist

Fields marked * are required. Open a section to begin; close it to bring the next section into view.

Organisation or practice name *Enter the actual legal or public-facing name.

Public contact address *Use a suitable business address, not patient or student details.

Country *Editable exampleEditable sample location. Country alone does not determine which laws apply.

State, territory or region *Enter the actual location and any relevant jurisdiction.

Responsible contact name or role *

Contact email *Use a monitored business contact.

Contact telephone *Use a public contact number.

Website URLOptional public https:// address.

Document date *Effective date for policies; review date for assessment reports.

Entity role *

Systems, sites and activities reviewed *Record scope and exclusions explicitly. Do not include identifiable patient data.

Review method *Editable example

Privacy governance and workforce status *Privacy official, policies, training, sanctions and mitigation responsibilities. Select only a finding supported by review.

Privacy governance and workforce evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Notice and individual rights status *Current notice including Part 2 content, access, amendment, restrictions, accounting, complaints and non-retaliation. Select only a finding supported by review.

Notice and individual rights evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Use/disclosure controls status *Minimum necessary where applicable, authorisations, personal representatives and more protective laws. Select only a finding supported by review.

Use/disclosure controls evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Risk analysis and management status *Accurate and thorough ePHI risk analysis, risk treatment, evaluation and assigned security responsibility. Select only a finding supported by review.

Risk analysis and management evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Workforce access status *Authorisation, role-appropriate access, unique users, authentication, onboarding and termination. Select only a finding supported by review.

Workforce access evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Facilities, devices and media status *Facility access, workstation safeguards, movement, disposal and reuse. Select only a finding supported by review.

Facilities, devices and media evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Technical safeguards status *Access controls, audit controls, integrity, authentication and transmission security; addressable decisions documented. Select only a finding supported by review.

Technical safeguards evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Contingency and recovery status *Backup, disaster recovery, emergency operations, testing and criticality analysis. Select only a finding supported by review.

Contingency and recovery evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Incidents and breach notification status *Incident response, breach assessment, individual/HHS/media notification when required and evidence of timing. Select only a finding supported by review.

Incidents and breach notification evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Business associates and subcontractors status *Required contracts, services, permitted PHI use, subcontractors and return/destruction. Select only a finding supported by review.

Business associates and subcontractors evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Documentation and review status *Required HIPAA documentation retained for six years as applicable; records retention distinguished from medical-record rules. Select only a finding supported by review.

Documentation and review evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Special records and legal change review status *Part 2, state restrictions, patient consent, specialised populations and current rule changes assessed for applicability. Select only a finding supported by review.

Special records and legal change review evidence or reasonUse document/control references and dates, not PHI or credentials. Required for implemented, partial or not-applicable findings.

Follow-up plan and responsibilities *Editable example

Next review date *Choose a real planned review date on or after this review.

Review limitations and unresolved questions *Describe actual missing evidence, excluded systems or specialist review needed; explicitly state none if accurate.

Additional reviewer notesOptional non-sensitive notes.

From information to a useful document

How to create your hipaa compliance checklist

Define entity role, review boundary, reviewer, evidence sources and status for each topic. Assign follow-up actions and a review date for gaps or unassessed items.

01
Gather accurate information
Identify the responsible organisation, scope and actual contact routes. USA is an editable example country. HIPAA tools address US obligations; a location field does not establish whether a law applies.
02
Tailor examples and findings
Open each section. Keep suitable model wording or edit it, and use Restore example when needed. Actual parties, clinical explanations, controls and findings are not invented. Closing a section brings the next into view while keeping answers.
03
Review and export
Read the complete document and verify required details. Download Word or HTML, or open Print / Save PDF for a fixed copy. The preview, formatted copy and exports include a link to this exact tool.
04
Assign actions and retain the review
Confirm evidence, record unresolved findings and follow up with named owners and dates. Keep the report securely with supporting records. A report does not verify controls or certify compliance.

Purpose-specific content

What your document covers

Review scope → 12 topic findings → evidence and applicability → follow-up plan → review sign-off.

All topics initially say Not assessed. Implemented and partially implemented findings need evidence; not-applicable findings need a reason. Counts summarise your entries without a compliance percentage or pass badge.

Conditional questions follow the selected purpose or activity. Sample procedures stay editable. Patient records, identifiable student cases and credentials should remain in the organisation’s approved systems.

Before use

Scope, privacy and review

This scoped checklist is a review record, not a legal audit or certification. Not assessed is the initial status. An implemented selection requires evidence, and not applicable requires a reason.

Generation takes place in this browser. Form answers are not sent to a document-generation service or saved between visits. Download before leaving.
Enter organisation-level details and relevant evidence summaries. Keep patient-identifying records and sensitive supporting evidence in approved organisational systems.
Check applicable requirements, operational capacity and authority before use. Model wording does not verify facts, implement safeguards or confer legal compliance.

Template maintenance

Substantive update: 9 October 2026. No certification or review by a named legal professional is claimed.

Common questions

Frequently asked questions

Is this tool free, and do I need an account?

Creating, copying and exporting your document is free and requires no account. Form answers are processed in this browser and are not saved between visits.

Does this checklist certify HIPAA compliance?

No. It records the reviewer’s topic-level findings and evidence. A completed or implemented selection is not a verified legal conclusion. Unassessed items remain visible, and no percentage or pass badge is assigned.

Can I keep or edit the sample content?

Yes. Fields marked “Editable example” contain model wording with Restore example controls. USA is an editable sample country, not a determination of applicable law. Keep wording only when it matches the actual situation. Enter actual parties, contacts, clinical information supplied by a professional or assessment evidence as appropriate; do not enter patient records, student case details or credentials.

Which export formats are available?

Download HTML or an editable Word .docx document. For PDF, open Print / Save PDF and choose Save as PDF in the browser print dialog. Preview, formatted copy and exports contain a link to this exact tool. Publish policies where appropriate; share consent, contract and assessment documents privately with intended recipients.

Reference for your review

HHS: risk analysis requirements. Check the rules applicable to the organisation, records and activity; reference links do not establish applicability or certification.

Create your HIPAA Compliance Checklist

Organisation & document+

Review scope+

Privacy & patient rights+

Security & resilience+

Incidents, contracts & documentation+

Follow-up & approval+

How to create your hipaa compliance checklist

Gather accurate information

Tailor examples and findings

Review and export

Assign actions and retain the review

What your document covers

Scope, privacy and review

Frequently asked questions

Reference for your review

Related policy and review tools