Minimum HIPAA IT Compliance Checklist for Businesses in Northern Virginia, DC & Maryland

Across Northern Virginia, Washington DC, and Maryland, healthcare providers, dental offices, and professional services firms are increasingly targeted by cyber threats.

The Ten Areas at a Glance

Use the checklist below as the minimum set of IT controls to cover.

• Risk analysis

  Document all systems handling ePHI, map data flows, and identify threats, vulnerabilities, and controls.

• Access controls

  Unique user accounts, role-based access, automatic session timeouts, and MFA everywhere.

• Encryption

  TLS 1.2+ in transit, AES-256 at rest, and full disk encryption plus MDM on devices.

• Audit logging

  Track who accessed what and when, log failed login attempts, and retain logs for at least 6 years.

• Endpoint security

  Antivirus / EDR on all systems, patched operating systems and applications, and screen lock within 15 minutes.

• Network security

  Business-grade firewall, segmentation of ePHI systems, and VPN required for remote access.

• Backup and disaster recovery

  Automated encrypted backups, offsite or cloud storage, and annual restore testing.

• Vendor and third-party management

  Business Associate Agreements required for cloud, email, backup, and IT providers.

• Incident response plan

  Define breach vs security incident; the 60-day notification rule starts at discovery.

• IT staff responsibilities

  Annual documented HIPAA training, a written sanctions policy, and a designated Security Officer.

The HIPAA IT Compliance Checklist

1. Risk Analysis (Your First and Most Critical Step)

• Document all systems handling ePHI
• Map data flows across your environment
• Identify threats, vulnerabilities, and controls
• Assign likelihood and impact ratings
• Update whenever your environment changes

2. Access Controls

• Unique user accounts (no shared logins)
• Role-based access to limit exposure
• Automatic session timeouts
• Multi-Factor Authentication (MFA) everywhere
• Immediate offboarding when employees leave

In DMV-based healthcare environments, poor access control is one of the leading causes of breaches.

3. Encryption Requirements

• Data in transit: TLS 1.2+ (HTTPS, secure email)
• Data at rest: AES-256 encryption
• Devices: Full disk encryption + MDM
• USB/Media: Encrypt or prohibit
• Email: Encrypted email solutions only

Unencrypted email is still one of the most common HIPAA violations in Virginia and DC.

4. Audit Logging

• Track who accessed what and when
• Log failed login attempts
• Monitor privilege changes
• Retain logs for at least 6 years
• Ensure logs cannot be altered or deleted

5. Endpoint Security

• Install antivirus / EDR on all systems
• Keep OS and applications patched
• Enable full disk encryption
• Enforce screen lock within 15 minutes
• Restrict personal device usage without MDM

6. Network Security

• Business-grade firewall with documented rules
• Network segmentation (separate ePHI systems)
• Secure Wi-Fi (no public access to ePHI)
• VPN required for remote access
• Disable unused ports/services

This is where many small businesses in Maryland and Northern Virginia fall short.

7. Backup and Disaster Recovery

• Automated encrypted backups
• Offsite or cloud storage
• Annual restore testing
• Defined RTO and RPO
• Business continuity plan

8. Vendor and Third-Party Management

• Business Associate Agreements (BAA) required
• Applies to cloud, email, backup, IT providers
• Verify vendor security practices
• Review contracts regularly

9. Incident Response Plan

• Define breach vs security incident
• 60-day notification rule starts at discovery
• Preserve forensic evidence
• Assign response roles (legal, reporting)

10. IT Staff Responsibilities

• Annual HIPAA training (documented)
• Background checks for sensitive roles
• Written sanctions policy
• Designated Security Officer

Priority Order for Businesses Starting from Scratch

1. Risk Analysis
2. MFA Everywhere
3. Encryption
4. Access Control and Offboarding
5. Audit Logging
6. Backups
7. Vendor BAAs
8. Policies and Training

For businesses across Herndon, Reston, Fairfax, Arlington, Washington DC, and Maryland, implementing these controls correctly requires both technical expertise and regulatory understanding.