HIPAA Compliance for NH Businesses: A Practical Guide

What HIPAA Is and Why It Reaches Beyond Hospitals

HIPAA stands for the Health Insurance Portability and Accountability Act of 1996. The law has grown into a stack of federal rules issued by the U.S. Department of Health and Human Services and enforced by the HHS Office for Civil Rights. The four pillars are the Privacy Rule, the Security Rule, the Breach Notification Rule, and the Enforcement Rule. Together they govern who handles protected health information, how they protect it, and what happens when something goes wrong.

Most New Hampshire business owners think HIPAA stops at the hospital door. It does not. The law reaches every covered entity and every business associate. A covered entity is a healthcare provider, a health plan, or a healthcare clearinghouse. A business associate is anyone who handles protected health information on behalf of a covered entity. This second category catches IT vendors, billing services, transcriptionists, marketing agencies, shredding companies, cloud storage providers, attorneys, accountants, document storage facilities, and a long list of other Granite State businesses with no stethoscope in the office.

The simple test is this. If your company touches a name plus a health detail in any format, paper or electronic, you operate under HIPAA. Our medical shredding service page lays out the destruction piece. This guide covers the full picture.

Which NH Businesses Must Comply With HIPAA in 2026

The HHS list of covered entities is short. The list of business associates is long, and it grows every year as more services move online. Here is the working roster of New Hampshire business types falling under HIPAA in 2026.

Covered entities

• Physician and dental practices in Manchester, Nashua, Concord, Portsmouth, and across the state.
• Hospitals, urgent care centers, ambulatory surgery centers, and behavioral health facilities.
• Pharmacies, both independent and chain.
• Home health, hospice, and durable medical equipment providers.
• Chiropractors, physical therapists, occupational therapists, speech therapists, and acupuncturists.
• Health plans, including self-insured employer plans with more than 50 participants.
• Clearinghouses translating claim data between providers and payers.

Business associates

• Medical billing and coding services.
• IT support, hosting, and managed service providers serving healthcare clients.
• Transcription, scribing, and translation services.
• Document storage, document destruction, and records management companies.
• Attorneys, accountants, and consultants who review patient records as part of an engagement.
• Marketing, web design, and analytics firms touching patient lists or appointment data.
• Cloud storage, email, and collaboration platforms used to handle PHI.
• Answering services and after-hours call centers.

If your New Hampshire business sits on either list, HIPAA applies. You need a written compliance program, signed Business Associate Agreements with downstream vendors, and a documented destruction process for any paper or electronic media you no longer need.

The Four HIPAA Rules in Plain English

The acronyms scare people off. The substance is straightforward.

Privacy Rule

Tells you who has the right to access protected health information, what counts as PHI, and what patients are allowed to do with their own records. Patients get the right to inspect, copy, and request amendments. Your office gets a list of permitted uses without authorization, like treatment, payment, and operations. Anything else needs written consent.

Security Rule

Sets administrative, physical, and technical safeguards for electronic PHI. Administrative covers policies, workforce training, and risk analysis. Physical covers facility access, workstation security, and device disposal. Technical covers access control, audit logs, integrity controls, and transmission security.

Breach Notification Rule

Defines what counts as a breach, who must be notified, and the timing. A breach means an unauthorized acquisition, access, use, or disclosure of PHI. The clock starts the day you discover it. Patients must be notified within 60 days. Breaches of 500 or more records also trigger notice to HHS and the media.

Enforcement Rule

Lays out the penalty structure and the investigation process. Four tiers run from $137 per violation at the low end to $2.1 million per category per year at the willful neglect tier. The Office for Civil Rights publishes the resolution agreements online, and small dental, behavioral health, and chiropractic practices appear on the list every year.

Each rule has its own deadlines and documentation requirements. The Office for Civil Rights expects every covered entity and business associate to have written policies covering all four areas, refreshed at least annually.

What Non-Compliance Costs: Real Settlement Numbers

The penalties are not theoretical. The Office for Civil Rights publishes settlement details, and the numbers tell the story.

• A dental practice in the Northeast paid $40,000 after dumping paper records in a public dumpster behind the office. The investigation found no Business Associate Agreement with the disposal vendor and no Certificate of Destruction.
• A behavioral health group paid $300,000 for an unsecured server breach exposing 6,800 patient records. The settlement noted the lack of a documented disposal process for the original paper intake forms.
• A physical therapy practice paid $25,000 after a former employee shared patient testimonial photos online without authorization. The investigation found gaps in workforce training and disposal policy.
• A specialty practice paid $750,000 after a laptop with PHI was stolen from a car. The settlement included paper disposal findings on top of the electronic media gap.

Beyond the headline number, every case includes a Corrective Action Plan running two to three years. The plan requires written policies, workforce retraining, vendor audits, periodic reports to HHS, and regular updates to the disposal process. The administrative cost of a Corrective Action Plan often exceeds the original fine.

State penalties stack on top. The New Hampshire Attorney General will pursue claims under RSA 359-C-19 and RSA 359-C-20, the state data breach notification statutes. Civil suits from affected patients pile on as well. The total bill for a single improper disposal event will clear seven figures.

The Paper Destruction Process for Staying Compliant

The largest single category of HIPAA violations involves improper disposal of paper records. The fix is simple, and it costs less than a single staff hour per month for most small practices.

Step 1: Write a destruction policy

One page. Name the methods you will use, the vendor relationships, the retention schedule, and the staff role responsible. Sign and date it. Refresh it annually.

Step 2: Sign a Business Associate Agreement

Your shredding vendor must sign one. So must your IT vendor, your billing service, and any cloud platform you use to handle PHI. We include a signed BAA with every clinic account.

Step 3: Lock the storage point

Use locked totes or consoles for documents awaiting destruction. A cardboard box in the back hallway is not a locked storage point. Most clinics in Manchester, Nashua, and Salem use a 32-gallon locked console at the front desk and a larger tote in the chart room.

Step 4: Use a documented chain of custody

When the totes leave your office, you sign a chain of custody receipt. The vehicle is logged, the load is sealed, and the destruction is recorded at the plant.

Step 5: Keep the Certificate of Destruction

The Certificate names the date, weight, method, and operator. File it in your compliance binder for six years. If the Office for Civil Rights asks how a specific record was destroyed, you point to the Certificate.

Our 2026 pricing covers the documentation. Drop-off runs $0.99 per pound or $15 per small box and $20 per large box with a 10 box minimum on box pricing. Witnessed shredding runs $1.99 per pound with a $100 minimum. Off-site adds transportation starting at $129.95 with zone-based pricing. The HIPAA Filing Fee of $14.95 and the Plant Environment Fee of $19.95 apply to every job. Ground-level or elevator access is required for all on-site work.

Workforce Training and Annual Risk Analysis

Paper is one leg of the stool. Workforce training and risk analysis are the other two. The Office for Civil Rights expects every covered entity and business associate to train every workforce member at hire and at least annually after the hire date. Training covers the Privacy Rule, the Security Rule, the Breach Notification process, and the specific policies your office uses.

What good training looks like

• A short live session or recorded module covering the four HIPAA rules.
• A walkthrough of your written policies for access control, disposal, breach response, and minimum necessary use.
• A scenario set drawn from your actual workflow. Front desk check-in, chart pulls, phone calls, faxes, and discarded sticky notes are all rich training material.
• A signed acknowledgment from each employee, kept in the personnel file for six years.

The annual risk analysis

HIPAA requires every covered entity and business associate to perform a written risk analysis at least once a year. The analysis identifies threats to PHI, evaluates current safeguards, and produces a mitigation plan. The Office for Civil Rights asks for the most recent risk analysis in every investigation. Practices unable to produce one usually settle for higher amounts.

A right-sized risk analysis for a small NH practice fills five to ten pages. It covers physical security at the office, electronic system access, vendor relationships, paper disposal, and workforce training. Most practices schedule it for January, alongside annual policy refresh, training renewal, and a vendor BAA audit.

Vendor Management: The BAA Audit Every NH Office Skips

The fastest growing category of HIPAA enforcement involves vendor relationships. The Office for Civil Rights opens investigations on covered entities, then traces the breach back to a downstream business associate without a signed agreement. Both ends pay.

Build the vendor inventory

List every outside party touching your office data. Most NH practices land between 15 and 40 vendors. The list includes the EHR platform, the billing service, the IT support firm, the cloud backup provider, the answering service, the medical waste hauler, the document shredding company, the website host, the email platform, the analytics tool, the appointment reminder service, the accountant, the practice attorney, the cleaning crew with after-hours building access, the photocopier lease vendor with hard drives in the machines, and the office supply company holding chart numbers in delivery records.

Score each vendor

For each one, note three things. First, does the vendor touch PHI in any form. Second, is there a current Business Associate Agreement on file. Third, when was the agreement last reviewed. Anything older than three years needs a fresh review against the current OCR template language.

Refresh expired BAAs

Some vendors send updated BAAs each year. Others coast on a 2014 agreement signed during the original HIPAA Omnibus rollout. Send a renewal request to every vendor with an expired or stale agreement. Most respond within two weeks. Vendors who refuse a BAA should be replaced before they trigger a problem.

Document the audit

Save the vendor list, the BAA file, and the audit dates in a single compliance binder. When the Office for Civil Rights asks how you manage vendor risk, you hand over the binder. Practices skipping this step end up with $50,000 to $250,000 fines on a routine audit. Practices keeping the binder current usually close the audit with a minor finding and no penalty.

What to Do If a Breach Happens in Your NH Office

Breaches happen. A laptop walks. A fax goes to the wrong number. A staff member shares a chart with the wrong family member. A box of records sits in a contractor’s truck overnight. The Office for Civil Rights does not expect zero events. It expects a documented response when they occur.

1. Contain the breach. Recover the laptop, retrieve the fax, lock the record, secure the box.
2. Document the discovery. Note the date, the time, the people involved, and what PHI was exposed.
3. Run a four-factor risk assessment. The Breach Notification Rule requires you to evaluate the nature and extent of the PHI, the unauthorized person who received it, whether PHI was in fact acquired or viewed, and the extent of risk mitigation.
4. Notify affected individuals. Within 60 days of discovery, send written notice by first-class mail. Use email only if the patient agreed to electronic notice.
5. Notify HHS. Breaches of 500 or more records go to HHS within 60 days and to the media. Smaller breaches go in an annual log filed within 60 days after the end of the calendar year.
6. Notify the NH Attorney General. State law adds its own breach notification path under RSA 359-C-20.
7. Document the corrective action. Update policies, retrain staff, replace vendors if needed, and shred any lingering exposed paper.

If the breach involves paper records pulled from a dumpster or recycling bin, the corrective action almost always includes a switch to a documented shredding partner. The cost of switching vendors is a fraction of the cost of a second breach.

Physical Safeguards for NH Practice Spaces

The Security Rule asks for physical safeguards in plain language. Lock the doors. Lock the cabinets. Track who comes in. Track who leaves with what. The list is short, but the implementation gaps run wide across New Hampshire practices.

Front desk and waiting area

Patient sign-in sheets are PHI. Replace open sheets with a single-name slip system or a tablet check-in. Position monitors away from the waiting area sight line. Cover the front-desk printer tray to keep walk-ups from grabbing a chart sheet by mistake.

Chart room and storage

Active charts live in lockable cabinets behind a closed door. Archive charts live in a locked back room or off-site facility under a documented chain of custody. Awaiting-destruction charts live in a locked tote or console. A cardboard box in the hallway is the most common audit finding in NH small practices.

After-hours access

Cleaning crews, building maintenance, and HVAC vendors all enter the office at night. Log every after-hours visit, escort sensitive zones during the visit, and require the vendor sign a confidentiality form even if the work does not touch PHI directly. The contract language sets the standard for accountability if a record goes missing.

Device disposal

Old printers, photocopiers, scanners, and fax machines all hold hard drives with stored PHI. When you retire the device, the drive comes out and gets destroyed alongside the paper. We accept media destruction for hard drives, SSDs, USB drives, optical media, and backup tapes at the Tewksbury plant. The Certificate of Destruction covers both the paper and the media on the same chain of custody.

The disposal console

A 32-gallon locked console at the front desk or chart room captures the day’s discards. Staff drop in the patient labels, the misprinted forms, the obsolete intake sheets. The console stays locked until pickup or drop-off. The simple habit closes 80 percent of the casual disposal risk in a typical NH practice.

Local NH Resources and How to Book Your First Visit

HIPAA compliance is easier when you build the program with local partners. Here are the New Hampshire resources worth knowing about in 2026.

• NH Medical Society: publishes practice management guidance, including templates for HIPAA policies and disposal logs.
• NH Hospital Association: hosts annual training on Privacy and Security Rule updates.
• NH Attorney General Consumer Protection Bureau: handles state breach notifications and complaints under RSA 359-C.
• HHS Office for Civil Rights, Region 1 (Boston): handles federal HIPAA enforcement for New Hampshire, with guidance and complaint forms at hhs.gov/ocr.
• NH Bar Association Health Law Section: publishes case updates and offers referrals to compliance counsel.

For the destruction piece, our Tewksbury facility sits minutes from the NH border at 1215 Main Street, Unit 115. Manchester practices reach the site in under 45 minutes via Route 93. The Manchester shredding page has the corridor map, the parking notes, and the typical turnaround windows for both drop-off and off-site work.

To book a first visit, call 978-636-0301 or use the online scheduling portal. Bring or send the box count, the document type, and the preferred service path. We respond with a quote including the HIPAA Filing Fee, the Plant Environment Fee, and any transportation, all in writing before the service date.

Trusted by NH clinics since 2007, BBB A+ rated, AAA-Certified by the Boston Business Association, with zero data breaches across our entire service history. The Certificate of Destruction lands in your compliance binder on every job.

2026 Pricing

Transparent rates with flat fees on every job. Use this table when budgeting your shredding job.

Frequently Asked Questions