The Complete HIPAA Compliance Checklist for MSPs
Everything MSPs need to know about HIPAA compliance — technical safeguards, administrative requirements, and how to help healthcare clients stay compliant.
If you're an MSP serving healthcare clients, HIPAA compliance isn't optional — it's a legal requirement that carries penalties of up to $1.5 million per violation category per year. And as a Business Associate handling PHI (Protected Health Information) on behalf of your clients, YOU are directly liable for compliance, not just your clients.
Technical Safeguards
Access Controls: Unique user identification for every person accessing systems with PHI. No shared accounts. Role-based access control (RBAC) that limits access to the minimum necessary. Automatic session timeouts. Emergency access procedures.
Audit Controls: Logging of all access to systems containing PHI. This includes login attempts, file access, configuration changes, and data exports. Logs must be retained and regularly reviewed. Your SIEM should be configured to flag anomalous access patterns.
Integrity Controls: File integrity monitoring (FIM) on systems storing PHI. Mechanisms to authenticate ePHI and ensure it hasn't been altered or destroyed. Checksums, digital signatures, and version control for critical data.
Transmission Security: Encryption of ePHI in transit. TLS 1.2 or higher for all network communications. VPN or encrypted tunnels for remote access. Email encryption for messages containing PHI.
Encryption: While HIPAA doesn't explicitly require encryption at rest, it's an "addressable" safeguard — meaning you must either implement it or document why you chose an equivalent alternative. In practice, every MSP should encrypt ePHI at rest. Full disk encryption on all endpoints. Encrypted databases. Encrypted backups.
Administrative Safeguards
Risk Assessment: Annual risk assessment of all systems handling PHI. This should identify threats, vulnerabilities, and the likelihood and impact of each. Document everything — auditors will ask for it.
Security Awareness Training: All workforce members with access to PHI must receive security awareness training. This should include phishing awareness, password policies, clean desk policies, and incident reporting procedures. Training must be documented and repeated annually.
Incident Response: Written incident response plan that covers detection, containment, eradication, recovery, and notification. HIPAA requires breach notification within 60 days of discovery for breaches affecting 500+ individuals.
What Your Platform Should Provide
As an MSP, you need a platform that makes HIPAA compliance manageable across all your healthcare clients: continuous compliance monitoring with automated evidence collection, audit logging across all managed endpoints, encryption enforcement, vulnerability scanning mapped to HIPAA requirements, and security awareness training delivery. The alternative is spreadsheets, manual audits, and constant anxiety about your next client's compliance review.