HIPAA for small clinics: what actually matters

HIPAA compliance has a reputation for being impossibly complex. And if you're reading guidance written for hospital systems with dedicated compliance departments, it is. But for a small medspa, IV hydration clinic, or wellness practice with a team of 2–15 people, HIPAA compliance is actually achievable — and the core requirements are simpler than the vendor fear-mongering suggests.

This guide is written for the clinic owner who is also their own compliance officer. No legal jargon, no 80-page policy templates — just what you actually need to do.

Start here: what is PHI, exactly?

Protected Health Information (PHI) is any information that could identify a patient AND relates to their health, treatment, or payment. The "AND" is important — a name alone isn't PHI, and a diagnosis alone isn't PHI. Together, they are.

For a medspa or IV clinic, PHI includes: patient names combined with appointment records, treatment notes (SOAP notes, vitals), before/after photos, invoices tied to a patient name, and anything in your intake forms.

The three things that matter most

1. Business Associate Agreements (BAAs)

Any vendor that touches your PHI needs a signed BAA. This is the single most commonly missed requirement for small clinics. A BAA is a contract where the vendor agrees to protect your patients' data and be liable if they don't.

Vendors that require BAAs: your EMR/practice management software, your cloud storage provider (Google Workspace, Dropbox), your email marketing tool (if you send anything patient-specific), your telehealth platform, and your AI tools if they process notes.

• ▸Google Workspace: BAA available, must be enabled in admin settings
• ▸Dropbox Business: BAA available on business plans
• ▸Most EMRs: BAA included in contract
• ▸Generic consumer tools (iCloud, personal Gmail, WhatsApp): no BAA — do not use for PHI

2. Access controls

HIPAA's "minimum necessary" standard means staff should only access PHI required for their role. In practice for small clinics:

If your current software doesn't support role-based access, that's a real compliance gap. Your front desk staff should not be able to read clinical notes.

3. Breach response plan

You need to know what to do if something goes wrong. A breach is any unauthorized access, use, or disclosure of PHI. This includes: a staff member accessing records they shouldn't, a laptop with patient data getting stolen, or a vendor getting hacked.

The HIPAA breach notification rule requires you to notify affected patients within 60 days. If the breach affects 500 or more patients, you also notify HHS and the media. For small clinics, the most likely scenario is a small-scale incident — someone's email account gets compromised, or an employee leaves and still has access.

What you can stop worrying about

HIPAA compliance anxiety often comes from conflating "hospital-level requirements" with "small clinic requirements." Here's what you don't need if you're running a small practice:

• ▸A dedicated HIPAA compliance officer (you wearing the hat is fine at small scale)
• ▸On-premise servers (using HIPAA-compliant cloud services is fully acceptable)
• ▸Annual third-party audits (self-assessments are fine until you're much larger)
• ▸Paper policy binders — a Google Doc works if it's actually maintained
• ▸Encrypting conversations with patients about their own care (the "treatment" exception)

The practical checklist

1. 1List every vendor that touches patient data — EMR, email, storage, payments, AI tools
2. 2Confirm you have a signed BAA with each of them (or switch to one that offers BAAs)
3. 3Set up role-based access in your software — front desk shouldn't see clinical notes
4. 4Use strong, unique passwords and enable 2FA on every account that holds PHI
5. 5Train your staff annually — even a 30-minute walkthrough of what PHI is and isn't
6. 6Write a one-page breach response plan and store it somewhere everyone can find it
7. 7Post your Notice of Privacy Practices where patients can see it

A note on AI tools

If you're using AI to assist with charting — which you should be, it's a game-changer — make sure your AI provider offers a BAA. Anthropic (which powers Cliny's AI Scribe) offers BAA agreements for healthcare use. Generic consumer AI tools like the public versions of ChatGPT do not — don't paste patient notes into them.

Cliny handles this correctly: PHI processed through our AI Scribe is covered under our BAA, encrypted in transit and at rest, and never used to train models. This is what "HIPAA-compliant AI" actually means.

See Cliny in action

Request a demo and we'll walk you through how this works for your clinic.