Five Compliance Gaps Small Medical Practices Commonly Overlook

Small practices are subject to the same core federal privacy and security obligations as large health systems, but usually without a dedicated compliance team. The result is rarely bad intent. It is drift: processes that made sense once and were never revisited. These five gaps come up often.

1. Shared logins and unclear access

When staff share a username for the EHR, the practice management system, or email, the practice loses the ability to know who accessed what. The HIPAA Security Rule includes a technical safeguard for unique user identification, and HHS describes access controls as a core part of protecting electronic health information. Practical fix: give every person their own credentials, remove access promptly when roles change, and document who has access to which systems.

2. No current security risk analysis

HHS treats an accurate and thorough risk analysis as foundational to Security Rule compliance. Many small practices either never completed one or did it once during setup. A risk analysis should reflect your current systems, vendors, and workflows, and it should lead to a documented plan for addressing what it finds.

3. Template policies that do not match practice

Downloaded policies are a reasonable starting point, but a policy that describes processes the practice does not follow can create more risk than it removes. Review policies against how work is actually done, and update one or the other.

4. Missing or outdated business associate agreements

Vendors that create, receive, maintain, or transmit protected health information on your behalf (for example, some billing, IT, or cloud vendors) generally need a business associate agreement. Keep an inventory of vendors and confirm which ones require an agreement.

5. Training that is not documented

Training at onboarding is common; ongoing, documented training is less so. Short, role-specific sessions with a simple attendance record make it easier to show that expectations were communicated.

Where to start

Pick one gap, assign an owner, and set a date. A short internal assessment can help prioritize the rest. If any of these issues involves a potential breach or a legal question, it is worth discussing with an attorney promptly.