The HIPAA Security Rule expects practices to assess risks to electronic client information regularly. For a small practice, this can be a focused afternoon once a year.
List where information lives
Write down every place client data is kept: your records system, email, laptops, phones, backups and any vendors that handle data.
Look for risks
For each item, ask who can access it, whether it is encrypted, whether devices are locked and whether software is up to date. Check that you have signed business associate agreements with vendors.
Fix and record
Rank the problems you find, fix the most serious ones first, and write down what you did and when. This record shows that you took the requirement seriously.
Put the date in your calendar for next year.