01
Risk analysis
Document how the practice identifies, assesses, and prioritizes risks to ePHI.
Record the systems, people, locations, and workflows that touch ePHI; rank risks and assign a next action.
Inside the guide
Eight areas to review with your team.
A concise set of prompts for turning broad obligations into owned, documented work.
Risk analysis
Record the systems, people, locations, and workflows that touch ePHI; rank risks and assign a next action.
Policies and procedures
Check that written policies match how clinicians, schedulers, and administrators actually work today.
Workforce training
Keep role-appropriate training, onboarding, refreshers, and completion evidence together.
Business associate agreements
Review vendors that handle ePHI and document the agreement and responsibilities before relying on the service.
Safeguards
Walk through access, workstation, device and media, and transmission safeguards; note gaps and owners.
Download the full eight-area review guide.
Built for small teams with a lot to hold together.
The checklist speaks to the practical reality of care delivered across homes, clinics, shared systems, and outside vendors.
Home-health agencies
Physical, occupational, and speech therapy practices
The practical review
Make the next responsible action easier to see.
Use the prompts as a conversation guide, a lightweight internal review, or a way to organize the evidence your team already has.
02
Policies and procedures
Keep written safeguards current, practical, and available to the workforce.
Check that written policies match how clinicians, schedulers, and administrators actually work today.
03
Workforce training
Provide role-appropriate HIPAA training and keep completion accountable.
Keep role-appropriate training, onboarding, refreshers, and completion evidence together.
04
Business associate agreements
Review each business associate agreement for the services and ePHI involved, and confirm the practice has documented the agreement before relying on the vendor.
Review vendors that handle ePHI and document the agreement and responsibilities before relying on the service.
05
Safeguards
Document the administrative, physical, and technical safeguards that protect ePHI across office, field, and remote work.
Walk through access, workstation, device and media, and transmission safeguards; note gaps and owners.
06
Incident response
Use the federal baseline to define how the practice detects, responds to, documents, and evaluates security incidents; add any applicable state obligations before approval.
Make reporting, triage, containment, documentation, notification review, and post-incident learning explicit.
07
Documentation and evidence
Keep the records that demonstrate how your safeguards work in practice.
Keep approvals, risk work, training records, agreements, reviews, and remediation evidence easy to retrieve.
08
Ongoing review
Schedule periodic evaluations to confirm safeguards remain effective as work changes.
Set a review cadence and revisit controls when systems, vendors, locations, or care workflows change.
Quillward context
A downloadable starting point, with a living workflow behind it.
The PDF helps you begin. Quillward helps your team keep owners, evidence, and review cadence visible as the practice changes.
See plans and pricingA responsible starting point
Start with a federal baseline. Add reviewed local guidance when appropriate.
The downloadable checklist keeps the practical federal baseline visible. It does not present federal guidance as state-law advice or as an approved interpretation for your practice.
Designate responsible officials
Name the privacy and security officials accountable for the practice program.
Perform the risk analysis
Document how the practice identifies, assesses, and prioritizes risks to ePHI.
Document policies and procedures
Keep written safeguards current, practical, and available to the workforce.
Train the workforce
Provide role-appropriate HIPAA training and keep completion accountable.
Review business associate agreements
Review each business associate agreement for the services and ePHI involved, and confirm the practice has documented the agreement before relying on the vendor.
Plan incident response (federal baseline)
Use the federal baseline to define how the practice detects, responds to, documents, and evaluates security incidents; add any applicable state obligations before approval.
Enforce appropriate sanctions
Set a consistent process for responding to workforce violations of policy.
Maintain compliance evidence
Keep the records that demonstrate how your safeguards work in practice.
Review and evaluate controls
Schedule periodic evaluations to confirm safeguards remain effective as work changes.
Use qualified counsel or an independent compliance professional to confirm requirements that apply to your organization.
A clear boundary
This checklist is general educational guidance—not legal advice, HIPAA certification, or a guarantee of compliance.
Use the guide to organize questions and evidence. For decisions about your specific obligations, involve qualified counsel or an independent compliance professional.
Want a useful next step?
Tell Quillward where your practice is stuck.
The download is self-serve. If you want to talk through your current process, send a note and the team can follow up with context.
Talk through your starting point
Share a little context and we will follow up with a useful next step.
Educational guidance for responsible teams—not a certification or guarantee.