First timers with HIPAA most often skip or shelve the risk analysis, treat addressable specifications as optional, forget business associate agreements, keep thin documentation, and misread the breach clocks. The regulation text itself shows why each one hurts, and each is fixable with a written process.
1. No real risk analysis
The Security Rule's administrative safeguards at 45 CFR 164.308(a)(1) make risk analysis and risk management required implementation specifications. A template questionnaire is not an analysis. Identify where electronic protected health information lives and moves, list threats and vulnerabilities, assess current controls, rate likelihood and impact, and record the result and the plan. Redo it when systems or operations change.
2. Reading addressable as optional
Several specifications, such as automatic logoff and encryption in 164.312, are labelled addressable. That means you assess whether each is reasonable and appropriate, implement it, or document why not and what you did instead. A blank is the mistake. Keep a short decision record for every addressable item.
3. Missing business associate agreements
A covered entity must have a written contract or arrangement with each business associate, and business associates must do the same with subcontractors under 164.314. First timers send protected data to a cloud tool, an analytics service or an AI assistant with no agreement. List every vendor that touches protected health information, and sign agreements before data flows.
4. No named officials
The Security Rule requires assigned security responsibility, and the Privacy Rule requires a privacy official and a contact person for complaints. Name them in writing. A shared mailbox is not an official.
5. Training once, then never
Section 164.530 requires training for workforce members as needed for their roles, training new hires within a reasonable time, and retraining after material changes that affect their duties. Keep dated records and track who is overdue.
6. No sanction policy and no complaint process
A sanction policy is a required specification under the Security Rule, and the Privacy Rule requires you to document sanctions and every complaint with its disposition. Without both, you cannot show that rules have consequences.
7. Thin documentation
Under 164.316 you must retain required documentation for six years from creation or from when it was last in effect, whichever is later, and keep it available and updated. Store versions, approvals and review dates. Policies that exist only in someone's head or only in the current version will not support you after an incident.
8. A late or confused breach response
Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. A breach is treated as discovered on the first day it is known, or would have been known with reasonable diligence, to any workforce member or agent other than the person who committed it. For 500 or more people, HHS is notified at the same time as individuals; for fewer, you log breaches and report within 60 days after the end of the calendar year. A business associate must notify the covered entity within 60 days. You carry the burden of proof for the notices. Write the process, name the decision maker and run a practice scenario.
9. Confusing a product with compliance
Buying software that says it is HIPAA ready does not discharge your obligations. Configuration, access control, audit controls, contingency plans and vendor agreements remain yours.
10. Skipping contingency planning
Data backup, disaster recovery and emergency mode operation plans are required specifications under 164.308(a)(7). Testing and revision are addressable. Test restores and write down the result.
What to do
- Run and record a real risk analysis, then write the risk management plan.
- Document a decision for each addressable specification.
- Inventory vendors that touch protected data and sign agreements.
- Name privacy and security officials in writing.
- Train staff by role, track completion and retrain after changes.
- Adopt sanction and complaint procedures.
- Version every document and keep it for six years.
- Write the breach procedure with the 60 day clocks and rehearse it.
- Test backups and recovery.
Quick check
Is risk analysis really required?
Yes. Risk analysis is a required implementation specification in 45 CFR 164.308(a)(1).
What is the outer limit to notify affected individuals of a breach?
Without unreasonable delay and no later than 60 calendar days after discovery, under 45 CFR 164.404.
How Safeguard helps automate this
Several of these mistakes come from technical controls that were assumed, not checked. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between reviews, saving your team time for other work. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, not just policies. The agent can open tested fix pull requests for vulnerable dependencies and other findings, but it is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare evidence; it does not make you HIPAA compliant or replace legal advice. Book a call.
Sources
- 45 CFR Part 164 Subpart C, Security Standards
- 45 CFR 164.530, Administrative requirements
- 45 CFR Part 164 Subpart D, Breach Notification
Last reviewed: 18 October 2026.
