A solo-practitioner internal medicine practice doesn’t have a compliance department, a dedicated IT security team, or the budget for one. What it needs is a HIPAA compliance program built to be maintained by the people already on staff. 

Amplix conducted the practice’s HIPAA Security Risk Assessment using a structured nine-step methodology, then built a compliance foundation designed around the practice’s actual capacity to sustain it: templated policies, bilingual patient notices, and a train-the-trainer model for onboarding new staff.   

Quick Answer  A HIPAA compliance program for a small or solo practice needs to be maintainable without a dedicated compliance team. Amplix’s assessment of a solo-practitioner medical practice delivered modifiable policy templates, a bilingual Notice of Privacy Practices, and a train-the-trainer program so the practice’s office manager could sustain compliance training independently going forward.

The Challenge 

Compliance Gaps Common to Small Practices 

The practice’s policies and procedures were incomplete, and its Notice of Privacy Practices wasn’t posted. A document request turned up records in unsearchable PDF image format, and no network diagram existed to show firewall, wireless encryption, or remote access configurations. 

• No previous vulnerability assessment had been conducted 
• Backups, laptops, and SD cards were unencrypted, and server hard drives may have been as well 
• Decommissioned equipment containing PHI was left in unsecured areas 
• Business associate agreements were often incomplete, out of date, or missing entirely 
• User accounts weren’t monitored or reviewed regularly, and staff scheduling made consistent training difficult to coordinate

The Approach 

A Nine-Step Risk Assessment, Scaled to a Small Practice 

Amplix scoped the engagement collaboratively, sending a document request list to gather existing policies, applications, and operational information, then scheduling interviews, a discovery session, and a site inspection around the practice’s own schedule. 

The assessment followed a structured nine-step methodology: scoping the assessment, gathering information, identifying realistic threats and potential vulnerabilities, assessing current security controls, determining the likelihood and impact of each threat, calculating the level of risk, recommending security controls, and documenting the results. 

The Solution 

A Compliance Program Built to Be Maintained, Not Just Delivered

Amplix’s recommendations focused on giving the practice tools it could actually keep using after the engagement ended:

• Reviewed and modified HIPAA Security and Privacy policies to reflect the practice’s current environment, delivered as editable Word templates the practice could update as things changed 
• Provided an updated Notice of Privacy Practices in both English and Spanish 
• Delivered a report outlining improvements to inventory and asset management for devices containing ePHI, including excess and decommissioned systems 
• Provided a business associate agreement tracking spreadsheet showing what’s in place, the scope of ePHI access granted, and when each was signed and reviewed 
• Delivered onsite HIPAA Privacy, Security, and Breach Notification training with Certificates of Completion, plus a train-the-trainer package so the office manager could train future onboarding staff independently

The Outcome 

A Program the Practice Can Run Without Outside Help 

The practice came away from the engagement with more than a one-time assessment. Editable policy templates meant future updates didn’t require starting from scratch. A bilingual Notice of Privacy Practices met the needs of the patient population the practice actually served. Most importantly, the train-the-trainer model meant HIPAA training for new hires no longer depended on scheduling an outside vendor, since the office manager now had the deck and materials to run it directly. 

Why Amplix 

A small practice needs the same HIPAA protections as a large health system, with a fraction of the staff to maintain them. Amplix builds compliance programs designed for the team that actually has to run them day to day. Learn more about Amplix’s cybersecurity capabilities, or talk with an Amplix advisor about your own practice’s HIPAA compliance. 

---

Frequently Asked Questions

Does a solo-practitioner medical practice need a HIPAA Security Risk Assessment?   

Yes. HIPAA’s Security Rule applies regardless of practice size, and a solo practice handling ePHI is required to conduct a risk assessment just as a larger health system would. 

What is a business associate agreement, and where can I find a template?

A business associate agreement (BAA) is a contract with any vendor that handles PHI on a covered entity’s behalf. Many compliance advisors and HHS provide template language, though templates should be adapted to each vendor relationship.

Does a Notice of Privacy Practices need to be available in multiple languages?  

While not always strictly required, providing a Notice of Privacy Practices in the languages a practice’s patient population speaks is considered a best practice and supports genuine patient understanding of their privacy rights.

How can a small practice keep up with HIPAA training for new staff? 

A train-the-trainer approach, where one staff member is equipped with training materials and certification templates, lets a practice onboard new hires without scheduling an outside trainer every time. 

What is a HIPAA Security Risk Assessment? 

It’s a structured evaluation of the administrative, physical, and technical safeguards protecting electronic protected health information (ePHI), required annually under HIPAA’s Security Rule.