HIPAA Compliance Checklist: A Step-by-Step Guide | Osto<\/title>\n<meta name=\"description\" content=\"A practical HIPAA compliance checklist for startups: scope PHI, run a risk analysis, implement safeguards, document policies, and keep evidence current.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">A HIPAA compliance checklist that follows how the work really happens: five ordered phases, each with the exact items to tick off and the mistake that most often trips teams up.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>HIPAA compliance follows a logical order: scope where PHI lives, run a risk analysis, implement the administrative, physical, and technical safeguards, document policies and train staff, then keep evidence current through regular review.<\/p>\n <p>The step teams most often get wrong is the first real one, risk analysis, which is also the most-cited enforcement gap. Doing the phases in order, with controls that genuinely operate, is what makes the checklist hold up over time.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#roadmap\">The five phases<\/a><\/li>\n <li><a href=\"#phases\">The checklist, phase by phase<\/a><\/li>\n <li><a href=\"#fail\">Where checklists break down<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"roadmap\">The HIPAA compliance checklist, in five phases<\/h2>\n <p>A checklist is only useful if it mirrors the real order of the work. HIPAA compliance is not a flat list of boxes to tick in any sequence; it is a chain where each phase depends on the one before it. Map your data first, understand your risks, fix them, formalise them, then prove it, continuously.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:36px 34px 32px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">The path at a glance<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:28px;letter-spacing:-.01em\">Five phases from zero to HIPAA-ready<\/div>\n <svg viewBox=\"0 0 720 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Five phase HIPAA readiness roadmap: scope PHI, risk analysis, safeguards, policies and training, evidence and review\">\n <defs>\n <linearGradient id=\"node\" x1=\"0\" y1=\"0\" x2=\"0\" y2=\"1\"><stop offset=\"0\" stop-color=\"#ffffff\"\/><stop offset=\"1\" stop-color=\"#eef1ff\"\/><\/linearGradient>\n <marker id=\"rmArr\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker>\n <\/defs>\n <g font-family=\"Inter,Arial,sans-serif\">\n \n <line x1=\"70\" y1=\"70\" x2=\"650\" y2=\"70\" stroke=\"#3a4699\" stroke-width=\"6\" stroke-linecap=\"round\"\/>\n <line x1=\"70\" y1=\"70\" x2=\"650\" y2=\"70\" stroke=\"#5b64c8\" stroke-width=\"6\" stroke-linecap=\"round\" stroke-dasharray=\"2 22\"\/>\n \n <g>\n <line x1=\"150\" y1=\"70\" x2=\"182\" y2=\"70\" stroke=\"#5b64c8\" stroke-width=\"0\" marker-end=\"url(#rmArr)\"\/>\n <\/g>\n \n <g text-anchor=\"middle\">\n \n <circle cx=\"70\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"70\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">1<\/text>\n <circle cx=\"215\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"215\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">2<\/text>\n <circle cx=\"360\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"360\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">3<\/text>\n <circle cx=\"505\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"505\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">4<\/text>\n <circle cx=\"650\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"650\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">5<\/text>\n <\/g>\n \n <g text-anchor=\"middle\" fill=\"#ffffff\" font-size=\"13.5\" font-weight=\"700\">\n <text x=\"70\" y=\"140\">Scope PHI<\/text>\n <text x=\"215\" y=\"140\">Risk analysis<\/text>\n <text x=\"360\" y=\"140\">Safeguards<\/text>\n <text x=\"505\" y=\"140\">Policies &<\/text><text x=\"505\" y=\"157\">training<\/text>\n <text x=\"650\" y=\"140\">Evidence &<\/text><text x=\"650\" y=\"157\">review<\/text>\n <\/g>\n \n <g text-anchor=\"middle\" fill=\"#aeb6ee\" font-size=\"11\">\n <text x=\"70\" y=\"186\">where it lives<\/text>\n <text x=\"215\" y=\"186\">find the gaps<\/text>\n <text x=\"360\" y=\"186\">fix the gaps<\/text>\n <text x=\"505\" y=\"203\">document it<\/text>\n <text x=\"650\" y=\"203\">keep it current<\/text>\n <\/g>\n <\/g>\n <\/svg>\n<\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">How to use this checklist<\/div>Work the phases in order. Each one produces the input the next one needs: your data map scopes the risk analysis, the risk analysis prioritises the safeguards, and the safeguards are what your policies and evidence describe. Skipping ahead is what creates gaps.<\/div>\n\n <h2 class=\"sec\" id=\"phases\">The checklist, phase by phase<\/h2>\n <p>Each phase below has the concrete items to complete and the pitfall that most often derails teams at that step.<\/p>\n\n <div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">1<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 1<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Scope where your PHI lives<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">You cannot protect or assess what you have not located. Map every place protected health information is created, received, stored, or transmitted, so the rest of the work has a defined boundary.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>List every system, database, backup, and log that touches PHI<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Identify all third-party services that process it<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Confirm which vendors need a business associate agreement<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Document the data flows end to end<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">Backups, logs, and analytics tools are the places teams forget. If PHI can reach it, it is in scope.<\/span>\n <\/div>\n <\/div>\n<\/div><div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">2<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 2<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Run a real risk analysis<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">With scope mapped, assess the threats to that data: where it could be exposed, altered, or lost, and how likely and serious each risk is. This is the single most important phase and the deficiency regulators cite most.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Assess threats and vulnerabilities to your ePHI<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Rate each risk by likelihood and impact<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Produce a prioritised list of gaps to fix<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Keep the analysis current as systems change<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">A one-page form is not a risk analysis. Regulators look for a genuine, documented, and updated assessment.<\/span>\n <\/div>\n <\/div>\n<\/div><div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">3<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 3<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Implement the safeguards<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">Now close the gaps your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk analysis<\/a> surfaced, across all three safeguard categories. These are the controls buyers scrutinise and regulators enforce.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Administrative: access management, workforce procedures, sanction policy<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Physical: facility, workstation, and device or media controls<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Technical: access control, encryption, audit logging, integrity<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Prioritise by the risk ratings from phase two<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">Documenting a control you have not actually built is a common and costly gap. Controls must operate.<\/span>\n <\/div>\n <\/div>\n<\/div><div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">4<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 4<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Document policies and train your people<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">Controls need policies behind them and people who follow them. Human error is a leading cause of breaches, so this phase reduces real-world risk, not just paperwork.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Write the required policies and procedures<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Train your workforce and record that training<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Assign clear ownership for each policy area<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Refresh training on a regular schedule<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">Training that is not recorded may as well not have happened. Keep evidence of who was trained and when.<\/span>\n <\/div>\n <\/div>\n<\/div><div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">5<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 5<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Collect evidence and review regularly<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">HIPAA is ongoing, not a one-time project. Keep evidence that your safeguards operate, and revisit your risk analysis and controls on a regular cadence and whenever systems change materially.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Retain audit logs, access reviews, and training records<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Re-run the risk analysis at least annually<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Review controls after any material system change<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Keep evidence organised and readily producible<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">This is the phase that quietly decays. Manual evidence collection is the first thing to lapse under pressure.<\/span>\n <\/div>\n <\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"fail\">Where HIPAA checklists break down<\/h2>\n <p>Most teams can push through phases one to four in a concentrated effort. The failure point is almost always the same: treating HIPAA as a project with an end date rather than an ongoing state. The difference between the two shows up clearly.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">Where checklists break down<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:22px\">The gap between a one-time push and durable compliance<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr;gap:16px\">\n <div style=\"background:#fff;border:1px solid #e4e7f2;border-radius:14px;padding:22px\">\n <div style=\"display:flex;align-items:center;gap:9px;margin-bottom:14px\"><span style=\"width:24px;height:24px;border-radius:7px;background:#eef1f7;display:grid;place-items:center;color:#8a92ad;font-weight:800;font-size:13px\">✕<\/span><span style=\"font-size:13.5px;font-weight:800;color:#5b6178\">The one-time push<\/span><\/div>\n <div style=\"display:flex;flex-direction:column;gap:11px;font-size:12.5px;color:#6b7194\">\n <div style=\"padding-left:2px\">Safeguards set up once, then left alone<\/div>\n <div style=\"padding-left:2px\">Evidence gathered manually, in a scramble<\/div>\n <div style=\"padding-left:2px\">Risk analysis done once and forgotten<\/div>\n <div style=\"padding-left:2px\">Compliance decays quietly after the project ends<\/div>\n <\/div>\n <\/div>\n <div style=\"background:#fff;border:1px solid #cdd3f0;border-radius:14px;padding:22px;box-shadow:0 6px 22px rgba(43,53,150,.10)\">\n <div style=\"display:flex;align-items:center;gap:9px;margin-bottom:14px\"><span style=\"width:24px;height:24px;border-radius:7px;background:#eaf7f4;border:1px solid #b8e6dd;display:grid;place-items:center;color:#0a7d6c;font-weight:800;font-size:13px\">✓<\/span><span style=\"font-size:13.5px;font-weight:800;color:#1c267a\">Durable compliance<\/span><\/div>\n <div style=\"display:flex;flex-direction:column;gap:11px;font-size:12.5px;color:#28304f\">\n <div style=\"padding-left:2px\">Safeguards run continuously on one platform<\/div>\n <div style=\"padding-left:2px\">Evidence collected automatically, always current<\/div>\n <div style=\"padding-left:2px\">Risk analysis revisited on a set cadence<\/div>\n <div style=\"padding-left:2px\">Compliance stays provable between audits<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The phase to protect<\/div>Phase five, continuous evidence and review, is where compliance quietly erodes once the initial push is over. Automating evidence collection is what keeps the whole checklist alive without constant manual effort.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path through the checklist<\/h2>\n <p>Look across the five phases and a pattern emerges: the heaviest, most repeatable work, implementing safeguards and sustaining evidence, is technical. That is exactly the part a lean team struggles to maintain across scattered tools, and exactly where the checklist tends to break down over time.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The safeguards the checklist calls for, access control, encryption, audit logging, and monitoring, run on one platform and produce evidence automatically, then map to HIPAA alongside 200+ other frameworks. Phases three and five, the ones teams struggle to sustain, become continuous rather than manual, which is why startups treat Osto as the default way to work the checklist.<\/div>\n\n <div class=\"callout\">\n <h3>Work the checklist without the manual grind.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Implement the safeguards on one platform and let evidence collect itself, so HIPAA readiness stays current between audits. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is on a HIPAA compliance checklist?<\/summary><p>Five phases: scope where PHI lives, run a risk analysis, implement administrative, physical, and technical safeguards, document policies and train staff, and collect evidence with regular review. Each phase builds on the one before.<\/p><\/details>\n <details><summary>What is the first step to HIPAA compliance?<\/summary><p>Scoping your PHI, mapping every place protected health information is created, stored, or transmitted, including third-party services. You cannot protect or assess data you have not located, so this defines the scope for everything else.<\/p><\/details>\n <details><summary>What is the most important step?<\/summary><p>The risk analysis. It is an explicit HIPAA requirement, the foundation the safeguards build on, and the deficiency regulators cite most often. A genuine, current risk analysis directs the rest of the work.<\/p><\/details>\n <details><summary>How often should HIPAA compliance be reviewed?<\/summary><p>Regularly, at least annually, and whenever your systems change materially. HIPAA is an ongoing obligation, so evidence collection and periodic review of your risk analysis and controls are essential to keep compliance current.<\/p><\/details>\n <details><summary>Does a HIPAA checklist guarantee compliance?<\/summary><p>No checklist guarantees it. HIPAA compliance depends on controls that genuinely operate and on maintaining evidence over time. A checklist gives you the right order of work; real, sustained safeguards are what make it hold up.<\/p><\/details>\n <details><summary>Can a small team handle HIPAA compliance?<\/summary><p>Yes, especially when the technical safeguards and evidence collection are automated rather than manual. The phases that overwhelm small teams, implementing safeguards and sustaining evidence, become manageable when they run on one platform.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>HIPAA Compliance Checklist: A Step-by-Step Guide | Osto A HIPAA compliance checklist that follows how the work really happens: five\u2026<\/p>\n","protected":false},"author":8,"featured_media":818,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[319,318],"class_list":["post-817","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa-compliance-checklist","tag-hipaa-compliance-steps"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=817"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/817\/revisions"}],"predecessor-version":[{"id":819,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/817\/revisions\/819"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/818"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":817,"date":"2026-08-16T21:44:38","date_gmt":"2026-08-16T21:44:38","guid":{"rendered":"https:\/\/www.osto.one\/resources\/?p=817"},"modified":"2026-08-16T21:44:38","modified_gmt":"2026-08-16T21:44:38","slug":"hipaa-compliance-checklist","status":"publish","type":"post","link":"https:\/\/www.osto.one\/resources\/blog\/hipaa-compliance-checklist\/","title":{"rendered":"HIPAA Compliance Checklist: A Step-by-Step Guide"},"content":{"rendered":"\n\n\n\n\n\nHIPAA Compliance Checklist: A Step-by-Step Guide | Osto<\/title>\n<meta name=\"description\" content=\"A practical HIPAA compliance checklist for startups: scope PHI, run a risk analysis, implement safeguards, document policies, and keep evidence current.\">\n<style>\n :root{\n --ink:#0e1330;\n --brand:#1c267a;\n --brand-2:#3a46c0;\n --accent:#00c2a8;\n --accent-soft:#e6f7f4;\n --paper:#ffffff;\n --mist:#f4f6fb;\n --line:#e3e7f2;\n --muted:#5a6284;\n --danger:#e2564d;\n --radius:16px;\n --shadow:0 1px 2px rgba(16,19,48,.04),0 12px 40px rgba(16,19,48,.06);\n --maxw:860px;\n }\n *{box-sizing:border-box}\n html{scroll-behavior:smooth}\n body{\n margin:0;\n font-family:-apple-system,BlinkMacSystemFont,\"Segoe UI\",Inter,Roboto,Helvetica,Arial,sans-serif;\n color:var(--ink);background:var(--paper);line-height:1.65;-webkit-font-smoothing:antialiased;\n }\n a{color:var(--brand-2);text-decoration:none}\n a:hover{text-decoration:underline}\n\n .topbar{border-bottom:1px solid var(--line);background:rgba(255,255,255,.9);backdrop-filter:saturate(160%) blur(8px);position:sticky;top:0;z-index:20}\n .topbar-inner{max-width:1120px;margin:0 auto;padding:14px 24px;display:flex;align-items:center;justify-content:space-between;gap:16px}\n .logo{display:flex;align-items:center;gap:9px;font-weight:800;letter-spacing:-.02em;color:var(--brand);font-size:20px}\n .logo-mark{width:26px;height:26px;border-radius:8px;background:linear-gradient(135deg,var(--brand),var(--brand-2));display:grid;place-items:center;color:#fff;font-size:14px;font-weight:800}\n .nav-cta{background:var(--brand);color:#fff;padding:9px 18px;border-radius:10px;font-weight:600;font-size:14px;white-space:nowrap}\n .nav-cta:hover{background:var(--brand-2);text-decoration:none}\n\n .wrap{max-width:var(--maxw);margin:0 auto;padding:0 24px}\n .breadcrumb{font-size:13px;color:var(--muted);padding:26px 0 6px}\n .breadcrumb a{color:var(--muted)}\n .eyebrow{display:inline-block;margin:22px 0 14px;font-size:12px;font-weight:700;letter-spacing:.14em;text-transform:uppercase;color:var(--brand-2);background:var(--mist);padding:6px 12px;border-radius:999px;border:1px solid var(--line)}\n h1{font-size:clamp(30px,5vw,46px);line-height:1.1;letter-spacing:-.03em;margin:0 0 18px;font-weight:800}\n .dek{font-size:19px;color:var(--muted);margin:0 0 8px;max-width:50ch}\n\n .meta{display:flex;flex-wrap:wrap;gap:8px 20px;align-items:center;font-size:13px;color:var(--muted);margin:22px 0 4px;padding-bottom:26px;border-bottom:1px solid var(--line)}\n .meta .dot{width:4px;height:4px;border-radius:50%;background:var(--line)}\n\n .tldr{margin:30px 0;border:1px solid var(--line);background:linear-gradient(180deg,var(--accent-soft),#fff 70%);border-radius:var(--radius);padding:22px 24px}\n .tldr h2{margin:0 0 8px;font-size:13px;letter-spacing:.14em;text-transform:uppercase;color:var(--brand)}\n .tldr p{margin:0 0 10px;font-size:16.5px}\n .tldr p:last-child{margin:0}\n\n h2.sec{font-size:27px;letter-spacing:-.02em;margin:52px 0 14px;font-weight:800;scroll-margin-top:80px}\n h3{font-size:20px;margin:34px 0 10px;letter-spacing:-.01em;font-weight:700}\n p{margin:0 0 16px;font-size:16.5px}\n .lead-in{color:var(--muted)}\n em{font-style:italic}\n\n .jump{background:var(--mist);border:1px solid var(--line);border-radius:var(--radius);padding:20px 24px;margin:30px 0}\n .jump h4{margin:0 0 12px;font-size:13px;letter-spacing:.1em;text-transform:uppercase;color:var(--muted)}\n .jump ol{margin:0;padding-left:20px;columns:2;column-gap:32px}\n .jump li{margin:6px 0;font-size:15px}\n @media(max-width:560px){.jump ol{columns:1}}\n\n .analogy{background:var(--mist);border-radius:var(--radius);padding:20px 22px;margin:22px 0;border:1px solid var(--line);font-size:16.5px}\n .analogy strong{color:var(--brand)}\n\n ul.clean{padding-left:0;list-style:none;margin:16px 0}\n ul.clean li{position:relative;padding:6px 0 6px 30px;font-size:16px;border-bottom:1px solid var(--mist)}\n ul.clean li:last-child{border-bottom:none}\n ul.clean li::before{content:\"\";position:absolute;left:4px;top:14px;width:9px;height:9px;border-radius:3px;background:var(--accent)}\n ul.warn li::before{background:var(--danger)}\n\n \/* TSC cards *\/\n .tsc{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:22px 0}\n .tsc-card{border:1px solid var(--line);border-radius:14px;padding:18px;background:#fff}\n .tsc-card.req{border-color:var(--brand);background:#f6f8ff}\n .tsc-card .tag{font-size:11px;font-weight:700;letter-spacing:.08em;text-transform:uppercase;color:var(--muted)}\n .tsc-card.req .tag{color:var(--brand)}\n .tsc-card h4{margin:6px 0 6px;font-size:16px;color:var(--ink)}\n .tsc-card p{font-size:14px;color:var(--muted);margin:0}\n @media(max-width:720px){.tsc{grid-template-columns:1fr 1fr}}\n @media(max-width:480px){.tsc{grid-template-columns:1fr}}\n\n \/* stat band *\/\n .fig{margin:30px 0;border:1px solid var(--line);border-radius:var(--radius);overflow:hidden;box-shadow:var(--shadow)}\n .fig-head{padding:16px 22px;background:var(--brand);color:#fff;display:flex;align-items:baseline;justify-content:space-between;gap:12px;flex-wrap:wrap}\n .fig-head .ttl{font-weight:700;font-size:15px;letter-spacing:.02em}\n .fig-head .src{font-size:11.5px;color:#b9c0f0}\n .fig-foot{padding:14px 22px;border-top:1px solid var(--line);font-size:12.5px;color:var(--muted);background:#fbfcfe}\n .stat-band{display:grid;grid-template-columns:repeat(3,1fr)}\n .stat-cell{padding:24px 16px;text-align:center;border-right:1px solid var(--line)}\n .stat-cell:last-child{border-right:none}\n .stat-cell .num{font-size:30px;font-weight:800;color:var(--brand);letter-spacing:-.02em;line-height:1.05}\n .stat-cell .num.accent{color:var(--accent)}\n .stat-cell .lab{font-size:12.5px;color:var(--muted);margin-top:8px;line-height:1.4}\n @media(max-width:560px){.stat-band{grid-template-columns:1fr}.stat-cell{border-right:none;border-bottom:1px solid var(--line)}.stat-cell:last-child{border-bottom:none}}\n\n \/* timeline *\/\n .timeline{padding:8px 24px 4px}\n .tl-item{display:grid;grid-template-columns:130px 1fr;gap:16px;padding:14px 0;border-bottom:1px solid var(--mist)}\n .tl-item:last-child{border-bottom:none}\n .tl-date{font-weight:800;color:var(--brand);font-size:14px}\n .tl-what{font-size:14.5px}\n .tl-what b{display:block;margin-bottom:2px}\n @media(max-width:520px){.tl-item{grid-template-columns:1fr;gap:2px}}\n\n .tablewrap{overflow-x:auto;margin:22px 0;border:1px solid var(--line);border-radius:var(--radius);box-shadow:var(--shadow)}\n table{border-collapse:collapse;width:100%;min-width:600px;font-size:14.5px}\n thead th{background:var(--mist);text-align:left;padding:14px 16px;font-size:12.5px;text-transform:uppercase;letter-spacing:.05em;color:var(--muted);border-bottom:1px solid var(--line);font-weight:700}\n thead th.osto{background:var(--brand);color:#fff}\n tbody td{padding:14px 16px;border-bottom:1px solid var(--line);vertical-align:top}\n tbody tr:last-child td{border-bottom:none}\n tbody td:first-child{font-weight:600;color:var(--ink)}\n td.osto{background:#f6f8ff;font-weight:600}\n .yes{color:var(--accent);font-weight:700}\n .no{color:var(--danger);font-weight:700}\n\n .callout{border:1px solid var(--line);border-radius:var(--radius);padding:24px;margin:44px 0;background:linear-gradient(135deg,#141b52,#2a34a0);color:#fff;box-shadow:var(--shadow)}\n .callout h3{margin:0 0 8px;color:#fff}\n .callout p{color:#cfd4f5;margin:0 0 18px}\n .callout a.btn{display:inline-block;background:#fff;color:var(--brand);font-weight:700;padding:11px 22px;border-radius:10px;font-size:15px}\n .callout a.btn:hover{text-decoration:none;background:#eef0ff}\n\n .disclaimer{font-size:13.5px;color:var(--muted);background:var(--mist);border:1px solid var(--line);border-radius:12px;padding:16px 18px;margin:34px 0}\n\n .faq{border-top:1px solid var(--line);margin-top:48px;padding-top:8px}\n details{border-bottom:1px solid var(--line);padding:6px 0}\n summary{cursor:pointer;list-style:none;padding:16px 4px;font-weight:600;font-size:17px;display:flex;justify-content:space-between;align-items:center;gap:16px}\n summary::-webkit-details-marker{display:none}\n summary::after{content:\"+\";color:var(--brand-2);font-size:22px;font-weight:400}\n details[open] summary::after{content:\"\u2013\"}\n details p{padding:0 4px 18px;color:var(--muted);margin:0}\n\n footer{border-top:1px solid var(--line);margin-top:60px;background:var(--mist)}\n .foot-inner{max-width:1120px;margin:0 auto;padding:36px 24px;display:flex;flex-wrap:wrap;gap:16px;justify-content:space-between;align-items:center;font-size:14px;color:var(--muted)}\n .foot-inner .logo{font-size:17px}\n\n .related{margin:42px 0 0}\n .related h3{margin-bottom:14px}\n .related-grid{display:grid;grid-template-columns:1fr 1fr;gap:14px}\n .rc{border:1px solid var(--line);border-radius:12px;padding:16px 18px;background:#fff}\n .rc .k{font-size:11px;letter-spacing:.1em;color:var(--brand-2);font-weight:700;text-transform:uppercase}\n .rc a{font-weight:600;color:var(--ink);display:block;margin-top:6px;font-size:15.5px}\n @media(max-width:640px){.related-grid{grid-template-columns:1fr}}\n\n \/* --- bright, clean additions --- *\/\n .bright-strip{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:30px 0}\n .bright-strip .bcard{border-radius:16px;padding:22px 20px;color:#fff}\n .bright-strip .bcard .n{font-size:26px;font-weight:800;line-height:1.1}\n .bright-strip .bcard .l{font-size:13px;margin-top:6px;opacity:.95;font-weight:500}\n .bc-navy{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n .bc-teal{background:linear-gradient(135deg,#00c2a8,#12b3d6)}\n .bc-indigo{background:linear-gradient(135deg,#3a46c0,#5a63d6)}\n @media(max-width:640px){.bright-strip{grid-template-columns:1fr}}\n\n .pillrow{display:flex;gap:10px;flex-wrap:wrap;margin:22px 0}\n .pill{border-radius:999px;padding:9px 16px;font-size:14px;font-weight:600;background:var(--accent-soft);color:#0a7a68;border:1px solid #bfece4}\n .pill.i{background:#eef0ff;color:#3a46c0;border-color:#d6dbff}\n\n .bigcards{display:grid;grid-template-columns:repeat(3,1fr);gap:14px;margin:26px 0}\n .bigcard{border-radius:16px;padding:22px;background:#fff;border:1px solid var(--line);box-shadow:0 8px 30px rgba(16,19,48,.05)}\n .bigcard .ic{width:44px;height:44px;border-radius:12px;display:grid;place-items:center;font-size:20px;font-weight:800;color:#fff;margin-bottom:12px}\n .bigcard h4{margin:0 0 6px;font-size:16px;color:var(--ink)}\n .bigcard p{margin:0;font-size:13.5px;color:var(--muted)}\n @media(max-width:720px){.bigcards{grid-template-columns:1fr}}\n\n .keyrow{display:grid;grid-template-columns:1fr 1fr;gap:0;border-radius:16px;overflow:hidden;border:1px solid var(--line);margin:26px 0}\n .keyrow>div{padding:20px 22px}\n .keyrow .k1{background:#eef0ff}\n .keyrow .k2{background:var(--accent-soft)}\n .keyrow .lab{font-size:11px;font-weight:800;letter-spacing:.08em;text-transform:uppercase;margin-bottom:6px}\n .keyrow .k1 .lab{color:#3a46c0}.keyrow .k2 .lab{color:#0a7a68}\n .keyrow .big{font-size:19px;font-weight:800;color:var(--brand);margin-bottom:4px}\n .keyrow .sm{font-size:13.5px;color:var(--muted)}\n @media(max-width:560px){.keyrow{grid-template-columns:1fr}}\n\n .flow{display:flex;gap:8px;flex-wrap:wrap;align-items:stretch;margin:26px 0}\n .flow .step{flex:1;min-width:130px;border-radius:14px;padding:16px 14px;text-align:center}\n .flow .step .t{font-weight:800;font-size:14px}\n .flow .step .d{font-size:12px;margin-top:4px;opacity:.9}\n .flow .arrow{align-self:center;color:#c3c9e6;font-size:20px;font-weight:700}\n\n\n .bbox{border-radius:14px;background:#fff;padding:16px 20px;margin:22px 0;font-size:14.5px;line-height:1.6}\n .bbox strong{color:var(--brand)}\n .bbox.navy{border:2px solid #1c267a}.bbox.indigo{border:2px solid #3a46c0}.bbox.teal{border:2px solid #00c2a8}\n .bbox .bt{font-size:11px;font-weight:800;letter-spacing:.06em;text-transform:uppercase;margin-bottom:5px}\n .bbox.navy .bt{color:#1c267a}.bbox.indigo .bt{color:#3a46c0}.bbox.teal .bt{color:#0a7a68}\n .checkgrid{display:grid;grid-template-columns:repeat(2,1fr);gap:12px;margin:24px 0}\n .checkarea{border:1px solid var(--line);border-radius:14px;padding:16px 18px;background:#fff;box-shadow:0 6px 24px rgba(16,19,48,.04)}\n .checkarea .h{display:flex;align-items:center;gap:10px;margin-bottom:8px}\n .checkarea .num{width:28px;height:28px;border-radius:8px;background:linear-gradient(135deg,#1c267a,#3a46c0);color:#fff;font-weight:800;font-size:13px;display:grid;place-items:center;flex:none}\n .checkarea h4{margin:0;font-size:14.5px;color:var(--ink)}\n .checkarea ul{margin:0;padding:0;list-style:none}\n .checkarea li{font-size:12.8px;color:var(--muted);padding:4px 0 4px 18px;position:relative}\n .checkarea li:before{content:\"\";position:absolute;left:0;top:9px;width:9px;height:9px;border:2px solid var(--accent);border-radius:3px}\n @media(max-width:640px){.checkgrid{grid-template-columns:1fr}}\n .sampleflow{display:flex;align-items:center;gap:0;flex-wrap:wrap;margin:22px 0;border:1px solid var(--line);border-radius:14px;overflow:hidden}\n .sampleflow .sf{flex:1;min-width:150px;padding:16px 18px;text-align:center}\n .sampleflow .sf .t{font-weight:800;font-size:14px;color:var(--brand)}\n .sampleflow .sf .d{font-size:12.5px;color:var(--muted);margin-top:4px}\n .sampleflow .sf.a{background:#eef0ff}.sampleflow .sf.b{background:#f4f6fb}.sampleflow .sf.c{background:#fdeceb}\n .sampleflow .sarr{color:#c3c9e6;font-size:18px;font-weight:700;padding:0 6px}\n @media(max-width:640px){.sampleflow{flex-direction:column}.sampleflow .sarr{display:none}.sampleflow .sf{border-bottom:1px solid var(--line)}}\n .docpills{display:flex;gap:8px;flex-wrap:wrap;margin:10px 0}\n .docpills .dp{font-size:12.5px;padding:7px 13px;border-radius:999px;background:var(--mist);color:var(--brand);border:1px solid var(--line);font-weight:500}\n\n .callout a[href*=\"book-demo\"]{color:#ffffff !important;font-weight:700;text-decoration:underline}\n .callout a[href*=\"book-demo\"] span{color:#ffffff !important}\n \/* Osto branded comparison table *\/\n .otable{overflow-x:auto;margin:26px 0;border-radius:16px;border:1px solid #e3e6f5;box-shadow:0 10px 34px rgba(28,38,122,.10)}\n table.regtable{border-collapse:separate;border-spacing:0;width:100%;min-width:520px;font-size:14.5px;background:#fff;margin:0}\n table.regtable thead tr,table.regtable tr:first-child{background:linear-gradient(135deg,#1c267a,#3a46c0)}\n table.regtable th,table.regtable tr:first-child td{background:transparent;color:#fff;text-align:left;padding:15px 18px;font-size:13px;font-weight:800;letter-spacing:.03em;border:none}\n table.regtable td{padding:14px 18px;border-bottom:1px solid #eef0f7;vertical-align:top;color:#33384f}\n table.regtable tr:nth-child(even):not(:first-child){background:#f7f9ff}\n table.regtable tr:last-child td{border-bottom:none}\n table.regtable td:first-child{font-weight:700;color:#0e1330}\n table.regtable tr td:first-child{border-right:1px solid #eef0f7}\n table.regtable tr:first-child td:first-child,table.regtable th:first-child{border-right:1px solid rgba(255,255,255,.18)}\n table.regtable tr:first-child td{border-bottom:none}\n\n<\/style>\n<body>\n<div class=\"wrap\">\n <p class=\"dek\">A HIPAA compliance checklist that follows how the work really happens: five ordered phases, each with the exact items to tick off and the mistake that most often trips teams up.<\/p>\n\n <div class=\"meta\">\n <span>Osto Security Team<\/span><span class=\"dot\"><\/span><span>9 min read<\/span><span class=\"dot\"><\/span><span>Compliance & Trust<\/span>\n <\/div>\n\n <div class=\"tldr\">\n <h2>TL;DR<\/h2>\n <p>HIPAA compliance follows a logical order: scope where PHI lives, run a risk analysis, implement the administrative, physical, and technical safeguards, document policies and train staff, then keep evidence current through regular review.<\/p>\n <p>The step teams most often get wrong is the first real one, risk analysis, which is also the most-cited enforcement gap. Doing the phases in order, with controls that genuinely operate, is what makes the checklist hold up over time.<\/p>\n <\/div>\n\n <div class=\"jump\">\n <h4>On this page<\/h4>\n <ol>\n <li><a href=\"#roadmap\">The five phases<\/a><\/li>\n <li><a href=\"#phases\">The checklist, phase by phase<\/a><\/li>\n <li><a href=\"#fail\">Where checklists break down<\/a><\/li>\n <li><a href=\"#osto\">The lean-team path<\/a><\/li>\n <\/ol>\n <\/div>\n\n <h2 class=\"sec\" id=\"roadmap\">The HIPAA compliance checklist, in five phases<\/h2>\n <p>A checklist is only useful if it mirrors the real order of the work. HIPAA compliance is not a flat list of boxes to tick in any sequence; it is a chain where each phase depends on the one before it. Map your data first, understand your risks, fix them, formalise them, then prove it, continuously.<\/p>\n\n <div style=\"background:linear-gradient(135deg,#0e1444,#1c267a 55%,#242f86);border-radius:20px;padding:36px 34px 32px;margin:30px 0;box-shadow:0 18px 50px rgba(14,20,68,.28);position:relative;overflow:hidden\">\n <div style=\"position:absolute;top:-50px;right:-40px;width:260px;height:260px;background:radial-gradient(circle,rgba(58,70,192,.45),transparent 68%);pointer-events:none\"><\/div>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#aeb6ee;margin-bottom:6px\">The path at a glance<\/div>\n <div style=\"font-size:21px;font-weight:800;color:#fff;margin-bottom:28px;letter-spacing:-.01em\">Five phases from zero to HIPAA-ready<\/div>\n <svg viewBox=\"0 0 720 232\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;display:block\" role=\"img\" aria-label=\"Five phase HIPAA readiness roadmap: scope PHI, risk analysis, safeguards, policies and training, evidence and review\">\n <defs>\n <linearGradient id=\"node\" x1=\"0\" y1=\"0\" x2=\"0\" y2=\"1\"><stop offset=\"0\" stop-color=\"#ffffff\"\/><stop offset=\"1\" stop-color=\"#eef1ff\"\/><\/linearGradient>\n <marker id=\"rmArr\" markerWidth=\"10\" markerHeight=\"10\" refX=\"6\" refY=\"4\" orient=\"auto\"><path d=\"M0 0 L8 4 L0 8 Z\" fill=\"#5b64c8\"\/><\/marker>\n <\/defs>\n <g font-family=\"Inter,Arial,sans-serif\">\n \n <line x1=\"70\" y1=\"70\" x2=\"650\" y2=\"70\" stroke=\"#3a4699\" stroke-width=\"6\" stroke-linecap=\"round\"\/>\n <line x1=\"70\" y1=\"70\" x2=\"650\" y2=\"70\" stroke=\"#5b64c8\" stroke-width=\"6\" stroke-linecap=\"round\" stroke-dasharray=\"2 22\"\/>\n \n <g>\n <line x1=\"150\" y1=\"70\" x2=\"182\" y2=\"70\" stroke=\"#5b64c8\" stroke-width=\"0\" marker-end=\"url(#rmArr)\"\/>\n <\/g>\n \n <g text-anchor=\"middle\">\n \n <circle cx=\"70\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"70\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">1<\/text>\n <circle cx=\"215\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"215\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">2<\/text>\n <circle cx=\"360\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"360\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">3<\/text>\n <circle cx=\"505\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"505\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">4<\/text>\n <circle cx=\"650\" cy=\"70\" r=\"30\" fill=\"url(#node)\"\/><text x=\"650\" y=\"80\" font-size=\"24\" font-weight=\"800\" fill=\"#1c267a\">5<\/text>\n <\/g>\n \n <g text-anchor=\"middle\" fill=\"#ffffff\" font-size=\"13.5\" font-weight=\"700\">\n <text x=\"70\" y=\"140\">Scope PHI<\/text>\n <text x=\"215\" y=\"140\">Risk analysis<\/text>\n <text x=\"360\" y=\"140\">Safeguards<\/text>\n <text x=\"505\" y=\"140\">Policies &<\/text><text x=\"505\" y=\"157\">training<\/text>\n <text x=\"650\" y=\"140\">Evidence &<\/text><text x=\"650\" y=\"157\">review<\/text>\n <\/g>\n \n <g text-anchor=\"middle\" fill=\"#aeb6ee\" font-size=\"11\">\n <text x=\"70\" y=\"186\">where it lives<\/text>\n <text x=\"215\" y=\"186\">find the gaps<\/text>\n <text x=\"360\" y=\"186\">fix the gaps<\/text>\n <text x=\"505\" y=\"203\">document it<\/text>\n <text x=\"650\" y=\"203\">keep it current<\/text>\n <\/g>\n <\/g>\n <\/svg>\n<\/div>\n\n <div class=\"bbox teal\"><div class=\"bt\">How to use this checklist<\/div>Work the phases in order. Each one produces the input the next one needs: your data map scopes the risk analysis, the risk analysis prioritises the safeguards, and the safeguards are what your policies and evidence describe. Skipping ahead is what creates gaps.<\/div>\n\n <h2 class=\"sec\" id=\"phases\">The checklist, phase by phase<\/h2>\n <p>Each phase below has the concrete items to complete and the pitfall that most often derails teams at that step.<\/p>\n\n <div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">1<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 1<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Scope where your PHI lives<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">You cannot protect or assess what you have not located. Map every place protected health information is created, received, stored, or transmitted, so the rest of the work has a defined boundary.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>List every system, database, backup, and log that touches PHI<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Identify all third-party services that process it<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Confirm which vendors need a business associate agreement<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Document the data flows end to end<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">Backups, logs, and analytics tools are the places teams forget. If PHI can reach it, it is in scope.<\/span>\n <\/div>\n <\/div>\n<\/div><div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">2<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 2<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Run a real risk analysis<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">With scope mapped, assess the threats to that data: where it could be exposed, altered, or lost, and how likely and serious each risk is. This is the single most important phase and the deficiency regulators cite most.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Assess threats and vulnerabilities to your ePHI<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Rate each risk by likelihood and impact<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Produce a prioritised list of gaps to fix<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Keep the analysis current as systems change<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">A one-page form is not a risk analysis. Regulators look for a genuine, documented, and updated assessment.<\/span>\n <\/div>\n <\/div>\n<\/div><div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">3<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 3<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Implement the safeguards<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">Now close the gaps your <a href=\"https:\/\/www.osto.one\/resources\/glossary\/risk-assessment\/\">risk analysis<\/a> surfaced, across all three safeguard categories. These are the controls buyers scrutinise and regulators enforce.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Administrative: access management, workforce procedures, sanction policy<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Physical: facility, workstation, and device or media controls<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Technical: access control, encryption, audit logging, integrity<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Prioritise by the risk ratings from phase two<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">Documenting a control you have not actually built is a common and costly gap. Controls must operate.<\/span>\n <\/div>\n <\/div>\n<\/div><div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">4<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 4<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Document policies and train your people<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">Controls need policies behind them and people who follow them. Human error is a leading cause of breaches, so this phase reduces real-world risk, not just paperwork.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Write the required policies and procedures<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Train your workforce and record that training<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Assign clear ownership for each policy area<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Refresh training on a regular schedule<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">Training that is not recorded may as well not have happened. Keep evidence of who was trained and when.<\/span>\n <\/div>\n <\/div>\n<\/div><div style=\"border:1px solid #e3e6f5;border-radius:18px;margin:26px 0;overflow:hidden;box-shadow:0 8px 30px rgba(28,38,122,.08)\">\n <div style=\"display:flex;align-items:center;gap:16px;padding:20px 24px;background:linear-gradient(135deg,#141d5c,#2b3596)\">\n <div style=\"flex:none;width:48px;height:48px;border-radius:13px;background:rgba(255,255,255,.12);border:1px solid rgba(255,255,255,.28);display:grid;place-items:center;font-size:23px;font-weight:800;color:#fff\">5<\/div>\n <div><div style=\"font-size:11px;font-weight:800;letter-spacing:.12em;text-transform:uppercase;color:#aeb6ee\">Phase 5<\/div><div style=\"font-size:18px;font-weight:800;color:#fff;letter-spacing:-.01em\">Collect evidence and review regularly<\/div><\/div>\n <\/div>\n <div style=\"padding:20px 24px 22px;background:#fff\">\n <p style=\"margin:0 0 15px;font-size:14px;color:#3a4266;line-height:1.6\">HIPAA is ongoing, not a one-time project. Keep evidence that your safeguards operate, and revisit your risk analysis and controls on a regular cadence and whenever systems change materially.<\/p>\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.1em;text-transform:uppercase;color:#2b3596;margin-bottom:2px\">Your checklist<\/div>\n <ul style=\"list-style:none;margin:0 0 16px;padding:0\"><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Retain audit logs, access reviews, and training records<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Re-run the risk analysis at least annually<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Review controls after any material system change<\/span><\/li><li style=\"display:flex;align-items:flex-start;gap:11px;padding:10px 0;border-bottom:1px solid #eef0f8;font-size:13.5px;color:#28304f;line-height:1.55\"><span style=\"flex:none;width:21px;height:21px;border-radius:6px;background:#eaf7f4;border:1px solid #b8e6dd;display:inline-grid;place-items:center;margin-top:1px\"><span style=\"color:#0a7d6c;font-size:12px;font-weight:800\">✓<\/span><\/span><span>Keep evidence organised and readily producible<\/span><\/li><\/ul>\n <div style=\"display:flex;gap:11px;align-items:flex-start;background:#f6f8ff;border-left:3px solid #2b3596;border-radius:8px;padding:12px 15px\">\n <span style=\"flex:none;font-size:13px;font-weight:800;color:#2b3596;margin-top:1px\">Watch out<\/span>\n <span style=\"font-size:12.5px;color:#3a4266;line-height:1.55\">This is the phase that quietly decays. Manual evidence collection is the first thing to lapse under pressure.<\/span>\n <\/div>\n <\/div>\n<\/div>\n\n <h2 class=\"sec\" id=\"fail\">Where HIPAA checklists break down<\/h2>\n <p>Most teams can push through phases one to four in a concentrated effort. The failure point is almost always the same: treating HIPAA as a project with an end date rather than an ongoing state. The difference between the two shows up clearly.<\/p>\n\n <div style=\"background:#f6f8ff;border:1px solid #e3e6f5;border-radius:20px;padding:32px 34px;margin:30px 0;box-shadow:0 12px 40px rgba(28,38,122,.08)\">\n <div style=\"font-size:11px;font-weight:800;letter-spacing:.14em;text-transform:uppercase;color:#2b3596;margin-bottom:6px\">Where checklists break down<\/div>\n <div style=\"font-size:20px;font-weight:800;color:#0e1330;margin-bottom:22px\">The gap between a one-time push and durable compliance<\/div>\n <div style=\"display:grid;grid-template-columns:1fr 1fr;gap:16px\">\n <div style=\"background:#fff;border:1px solid #e4e7f2;border-radius:14px;padding:22px\">\n <div style=\"display:flex;align-items:center;gap:9px;margin-bottom:14px\"><span style=\"width:24px;height:24px;border-radius:7px;background:#eef1f7;display:grid;place-items:center;color:#8a92ad;font-weight:800;font-size:13px\">✕<\/span><span style=\"font-size:13.5px;font-weight:800;color:#5b6178\">The one-time push<\/span><\/div>\n <div style=\"display:flex;flex-direction:column;gap:11px;font-size:12.5px;color:#6b7194\">\n <div style=\"padding-left:2px\">Safeguards set up once, then left alone<\/div>\n <div style=\"padding-left:2px\">Evidence gathered manually, in a scramble<\/div>\n <div style=\"padding-left:2px\">Risk analysis done once and forgotten<\/div>\n <div style=\"padding-left:2px\">Compliance decays quietly after the project ends<\/div>\n <\/div>\n <\/div>\n <div style=\"background:#fff;border:1px solid #cdd3f0;border-radius:14px;padding:22px;box-shadow:0 6px 22px rgba(43,53,150,.10)\">\n <div style=\"display:flex;align-items:center;gap:9px;margin-bottom:14px\"><span style=\"width:24px;height:24px;border-radius:7px;background:#eaf7f4;border:1px solid #b8e6dd;display:grid;place-items:center;color:#0a7d6c;font-weight:800;font-size:13px\">✓<\/span><span style=\"font-size:13.5px;font-weight:800;color:#1c267a\">Durable compliance<\/span><\/div>\n <div style=\"display:flex;flex-direction:column;gap:11px;font-size:12.5px;color:#28304f\">\n <div style=\"padding-left:2px\">Safeguards run continuously on one platform<\/div>\n <div style=\"padding-left:2px\">Evidence collected automatically, always current<\/div>\n <div style=\"padding-left:2px\">Risk analysis revisited on a set cadence<\/div>\n <div style=\"padding-left:2px\">Compliance stays provable between audits<\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n <div class=\"bbox indigo\"><div class=\"bt\">The phase to protect<\/div>Phase five, continuous evidence and review, is where compliance quietly erodes once the initial push is over. Automating evidence collection is what keeps the whole checklist alive without constant manual effort.<\/div>\n\n <h2 class=\"sec\" id=\"osto\">The lean-team path through the checklist<\/h2>\n <p>Look across the five phases and a pattern emerges: the heaviest, most repeatable work, implementing safeguards and sustaining evidence, is technical. That is exactly the part a lean team struggles to maintain across scattered tools, and exactly where the checklist tends to break down over time.<\/p>\n\n <div class=\"bbox navy\"><div class=\"bt\">Why Osto is the startup default<\/div>Osto is the one-stop security and compliance platform purpose-built for fast-moving startups. The safeguards the checklist calls for, access control, encryption, audit logging, and monitoring, run on one platform and produce evidence automatically, then map to HIPAA alongside 200+ other frameworks. Phases three and five, the ones teams struggle to sustain, become continuous rather than manual, which is why startups treat Osto as the default way to work the checklist.<\/div>\n\n <div class=\"callout\">\n <h3>Work the checklist without the manual grind.<\/h3>\n <p>Osto is the one-stop cybersecurity and compliance platform built for fast-moving startups. Implement the safeguards on one platform and let evidence collect itself, so HIPAA readiness stays current between audits. No security team required.<\/p>\n <p style=\"margin-top:16px;\"><a href=\"https:\/\/osto.one\/book-demo\/\" style=\"color:#ffffff;font-weight:700;text-decoration:underline;\" target=\"_blank\" rel=\"noopener\"><span style=\"color:#ffffff;\">Book a Demo →<\/span><\/a><\/p>\n <\/div>\n\n <h2 class=\"sec\" id=\"faq\">Frequently asked questions<\/h2>\n <details><summary>What is on a HIPAA compliance checklist?<\/summary><p>Five phases: scope where PHI lives, run a risk analysis, implement administrative, physical, and technical safeguards, document policies and train staff, and collect evidence with regular review. Each phase builds on the one before.<\/p><\/details>\n <details><summary>What is the first step to HIPAA compliance?<\/summary><p>Scoping your PHI, mapping every place protected health information is created, stored, or transmitted, including third-party services. You cannot protect or assess data you have not located, so this defines the scope for everything else.<\/p><\/details>\n <details><summary>What is the most important step?<\/summary><p>The risk analysis. It is an explicit HIPAA requirement, the foundation the safeguards build on, and the deficiency regulators cite most often. A genuine, current risk analysis directs the rest of the work.<\/p><\/details>\n <details><summary>How often should HIPAA compliance be reviewed?<\/summary><p>Regularly, at least annually, and whenever your systems change materially. HIPAA is an ongoing obligation, so evidence collection and periodic review of your risk analysis and controls are essential to keep compliance current.<\/p><\/details>\n <details><summary>Does a HIPAA checklist guarantee compliance?<\/summary><p>No checklist guarantees it. HIPAA compliance depends on controls that genuinely operate and on maintaining evidence over time. A checklist gives you the right order of work; real, sustained safeguards are what make it hold up.<\/p><\/details>\n <details><summary>Can a small team handle HIPAA compliance?<\/summary><p>Yes, especially when the technical safeguards and evidence collection are automated rather than manual. The phases that overwhelm small teams, implementing safeguards and sustaining evidence, become manageable when they run on one platform.<\/p><\/details>\n<\/div>\n<\/body>\n<\/html>\n","protected":false},"excerpt":{"rendered":"<p>HIPAA Compliance Checklist: A Step-by-Step Guide | Osto A HIPAA compliance checklist that follows how the work really happens: five\u2026<\/p>\n","protected":false},"author":8,"featured_media":818,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[319,318],"class_list":["post-817","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-hipaa-compliance-checklist","tag-hipaa-compliance-steps"],"_links":{"self":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/817","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/comments?post=817"}],"version-history":[{"count":1,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/817\/revisions"}],"predecessor-version":[{"id":819,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/posts\/817\/revisions\/819"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media\/818"}],"wp:attachment":[{"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/media?parent=817"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/categories?post=817"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.osto.one\/resources\/wp-json\/wp\/v2\/tags?post=817"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}