The Private Practice’s HIPAA Cheat Sheet — Medical Edition.
Everything a 1–10 provider practice must do — and what it costs if you don’t — on one page. You went to med school, not law school, and “the EHR vendor handles compliance” is the assumption that gets practices fined. Here’s the whole picture in plain English, so you (or your practice manager) know the right questions to ask before an auditor or a breach decides it for you.
One short form. Instant download. We never ask for patient information.
Your cheat sheet is ready.
Download it now — we’ve also emailed you a copy so it’s easy to find later.
⬇ Download the Medical HIPAA Cheat Sheet Book your free security review →
Not sure where your practice stands? The review is a free HIPAA technical security review — a plain-English findings list, no obligation.
One page. The whole compliance picture.
The mandate — what law actually applies
HIPAA (federal) and CMIA (California’s stricter layer, where patients can sue you directly). Why a single California breach is a two-front problem: a federal regulator and a courtroom full of patients’ attorneys.
The must-do list
The Security Risk Analysis (the #1 thing OCR fines practices for not having), EHR access logging and unique logins, patient-portal security, a signed BAA with every vendor that touches PHI — including the clearinghouse and e-prescribing — and the three safeguard layers.
The 2026 penalty reality
Current HIPAA civil-penalty tiers and what an OCR investigation looks like — plus how California’s CMIA stacks $1,000-per-patient lawsuits on top — no need to prove actual harm, though a 2026 California Supreme Court ruling now requires showing a significant risk the data was accessed. Real numbers, with the as-of date.
The “my EHR vendor handles this” myth
The one question to ask: “When was our last documented Security Risk Analysis, and can I see it?” Your EHR vendor secures their platform and signs their BAA — they don’t run your network, review your access logs, or confirm your clearinghouse and e-prescribing BAAs.
General information only — not legal or compliance advice. The free review is a technical assessment of your IT environment, not a legal audit or a determination of compliance status.
Written for small medical practices — by people who speak your EHR.
Down the road, not across the country.
- Based in Menifee — Craig answers the phone himself.
- Remote-first — on-site across Menifee, Sun City, Murrieta, Temecula, Wildomar, Lake Elsinore when you need it.
- Member, Menifee Valley Chamber of Commerce.
- We sign the BAA and own your HIPAA technical safeguards.