The Year-End HIPAA Close-Out: 12 Things to Settle Before December 31

November 13, 2026 · HIPAA Security Suite

Why December Is the Right Deadline

A lot of HIPAA obligations are annual by convention rather than by statute — training, policy review, risk analysis refresh. Because the law rarely names a date, the date tends to drift, and drifting annual obligations have a way of becoming eighteen-month obligations and then two-year ones.

Picking December 31 solves that cheaply. It is memorable, it aligns with everything else your organization closes out, and it means that when someone asks "when did you last review this," the answer is a year that ended rather than a season you half-remember. Here is the pass.

Documents That Expire With the Calendar

1. Refresh the risk analysis if anything material changed. New location, new EHR, new remote-work arrangement, a merger, a significant incident. If none of those happened, confirm in writing that you reviewed it and nothing changed — that note is itself the evidence of review.
2. Close or formally accept last year's findings. Every item should end the year either done, or explicitly accepted in writing by someone with authority, with a review date. Items silently carried forward for a third year are the ones that read badly later.
3. Review your policies and date the review. You do not need to rewrite them. You need a record that a human read them this year and confirmed they still describe what you do. Policies describing a workflow you abandoned in 2024 are worse than no policy.
4. Confirm the training roster is complete. Everyone who touches PHI, including anyone hired mid-year, plus contractors and volunteers. Chase the stragglers now rather than in a deposition.

People and Access

5. Run a full access review. Pull user lists from the EHR, email, practice management, and any portal, and compare against current staff and current roles. Remove departed users; downgrade anyone whose access exceeds their job. This is the item that most reliably finds something.
6. Verify the offboarding process actually ran. For every departure this year, was access revoked, and when? Our 24-hour offboarding window covers what good looks like. Gaps here are common and easy to fix going forward.
7. Confirm who holds each compliance role. Security Officer and Privacy Officer are named roles. If the person who held one left in March, the role has been vacant for most of the year, and someone needs to be assigned before it appears in a finding.

Vendors and Agreements

8. Reconcile the vendor list against reality. Add what you started using this year; remove what you stopped. Most practices adopt at least one new tool a year without anyone updating the inventory.
9. Check BAA coverage and renewal dates. Every vendor touching PHI needs a signed agreement, and some carry expirations. Given that most large 2026 breaches came through vendors, this hour is well spent.

Evidence and Readiness

10. Review the incident log for the whole year. Every event, reportable or not, with the assessment that justified the conclusion. If the log is empty, that is not a clean year — it almost certainly means events were handled informally and never recorded.
11. Test one restore. Pick a system, restore something, write down the date and result. Doing this once a year with evidence is dramatically better than assuming it works.
12. Reconfirm your response contacts. Who leads, which outside firm you call, which attorney, and how you reach each of them if email and the network are unavailable. Update the page and put it somewhere physical.

How to Actually Get Through It

Twelve items sounds like a project. It is closer to a long afternoon if you sequence it, because several depend on the same source material.

Start with the access review (item 5), because pulling user lists also gives you what you need for offboarding verification and role confirmation. Then do the vendor reconciliation and BAA check together. Then the document items, which are mostly reading and dating. Save the restore test for last since it runs in the background.

Assign a single owner. Year-end compliance passes distributed across four people tend to produce four partial passes and no record of completion.

What You Get Out of It

Two things. First, a defensible position: if anyone asks in 2027 what your compliance posture was at the end of 2026, you have a dated, specific answer rather than a reconstruction.

Second, and more useful day to day, you start the year knowing what is actually true — who has access, which vendors hold your data, what is unresolved. Most practices operate on a mental model that is twelve to eighteen months stale, and the gap between the model and reality is where incidents live.

Call to Action

A year-end pass is much shorter when the records are already in one place instead of six. Schedule a walkthrough to see how risk analysis, policies, training, vendors, and incidents stay current together — or take the 3-minute readiness quiz to see where you would finish the year today.