Compliance isn’t just for big companies: What every business needs to know

Small business compliance starts with one question: what kind of data do you hold? Most data protection rules apply because of the data, whatever your headcount. A five-person tax practice falls under the same FTC Safeguards Rule as a national lender, and a two-doctor clinic needs the same HIPAA risk analysis as a hospital.

The work itself is a short list done consistently: know what data you have, protect it with sensible controls, write down what you do, and check it on a schedule.

Small business compliance: which rules apply to you?

What each rule expects, in plain terms

Size usually changes how much paperwork is expected. It rarely changes whether a rule applies. HHS says the security measures that fit a small practice may differ from those for a large one, but the risk analysis itself is still required. The FTC Safeguards Rule trims a few requirements for firms with fewer than 5,000 customers, and the core program still applies.

HIPAA, for healthcare and its vendors

Medical, dental, behavioral health and other providers that bill electronically are covered entities. Any vendor that creates, receives or stores protected health information for them, including IT providers, billing companies and cloud services, is a business associate and must sign a business associate agreement. We hold signed BAAs with every vendor in our own stack that can touch PHI. Our healthcare IT page covers how this works day to day, and our guide to conducting a HIPAA risk assessment walks through the analysis step by step.

FTC Safeguards Rule, for tax, lending and other financial firms

Under the Gramm-Leach-Bliley Act, the FTC treats tax preparation firms, mortgage brokers, non-bank lenders, collection agencies, investment advisors not registered with the SEC and similar businesses as financial institutions. The IRS states plainly that federal law requires all professional tax preparers to create and implement a data security plan, and its Publication 5708 is a starting template for that written information security plan (WISP). Since May 2024, covered firms must notify the FTC within 30 days of discovering that unencrypted information on 500 or more consumers was acquired without authorization. More on our accounting and financial firms page.

Confidentiality rules, for law firms

Louisiana’s Rule 1.6(c) says a lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client. That reaches email, file sharing, laptops and any cloud tool that holds client files.

PCI DSS, for anyone who takes cards

Version 4.0 became the only active version of the standard in March 2024, and its remaining future-dated requirements became mandatory after March 31, 2025. Most small merchants can shrink their scope a lot by using a payment terminal or hosted checkout, so card numbers never touch their own systems.

Louisiana law, for almost everyone

The breach law above applies to any business holding residents’ personal information. Separately, the Louisiana Data Privacy Act, signed May 29, 2026, takes effect January 1, 2027. It applies to businesses with more than $25 million in annual revenue or that handle personal information of 75,000 or more consumers, and it exempts HIPAA covered entities, GLBA financial institutions and nonprofits. If you serve clients in other states, their breach and privacy laws can apply too. Our post on what to do when data privacy laws change follows the state laws.

The baseline every rule shares

Read enough regulations and the same expectations keep coming back. Build these once and you cover most of what any single rule asks for:

• An inventory of the sensitive data you hold, where it lives, and which systems and vendors touch it.
• A written risk assessment, updated when things change.
• Individual accounts with only the access each person needs, protected by multifactor authentication.
• Encrypted laptops, encrypted data in transit, and tested backups an attacker can’t delete.
• The right agreements with vendors that handle your data, such as a BAA for anyone touching PHI. Our guide to supply chain security covers vendor oversight.
• Staff training on phishing and data handling, with records that it happened.
• An incident response plan that says who does what, who must be notified, and by when.
• Written rules for how long you keep data and how access ends when people leave. See our guides to data retention and employee offboarding.

If it isn’t written down, an auditor or insurer will treat it as not done. The NIST Cybersecurity Framework 2.0, released in February 2024, has a Small Business Quick-Start Guide that helps organize the work.

What we find when a new client onboards

Every new client goes through our 14-page onboarding checklist, and Chad Odom, our owner, performs and signs the review himself. Across healthcare practices, nonprofits, accounting firms and law offices, the gaps look much the same:

• Administrative safeguards missing entirely: no written policies, training records or procedures.
• Physical safeguards missing for offices, workstations and devices.
• Technical safeguards in place but misconfigured.

That third group usually traces back to Microsoft 365 running on Microsoft’s defaults, with auditing off and no conditional access. Fixing those settings covers a large share of what every rule above asks for.

What happens if you ignore it

Enforcement against smaller organizations is real. HHS’s Office for Civil Rights runs a Risk Analysis Initiative aimed at organizations that never did a proper HIPAA risk analysis. In June 2026 it announced its 14th enforcement action under that initiative, a $450,000 settlement with a health plan after a ransomware attack.

The larger costs tend to land elsewhere: breach notification and legal fees, insurance claims questioned because a promised control wasn’t in place, and contracts you can’t win because you can’t answer the security questionnaire. A firm with a current risk assessment, written policies and MFA can answer that questionnaire in an afternoon.

Where to start

1. List the kinds of sensitive data you hold, match each to the table above, and ask your attorney or CPA if you’re unsure.
2. Map where that data lives and who else can reach it.
3. Do a risk assessment and rank the gaps by risk, not by how easy they are to fix.
4. Close the big gaps first: MFA everywhere, encrypted devices, protected backups, and no shared or stale accounts.
5. Write down your policies, risk assessment, vendor agreements and incident plan, short enough that people will read them.
6. Revisit the risk assessment at least yearly and whenever you add a system, a vendor or an office.

HIPAA covered entities should also keep an eye on the proposed Security Rule update. It is still a proposal, and HHS’s 2026 regulatory plan lists it as a long-term action with a target of July 2027, so there is nothing new to comply with yet. Our post on the new HIPAA Security Rule tracks where it stands.

Not sure which of these rules reach the patient, client or donor data you hold? Settle it before an insurer or auditor asks. Book a 15-minute call, or read more about our compliance services and our work with small and mid-size businesses.

Related reading: Security log management: Event logging best practices for a small business, What is data governance? A practical guide for small businesses and Employee monitoring: The pros, cons and rules to know.

Frequently asked questions

What is regulatory compliance?

Regulatory compliance means meeting the rules that apply to your organization because of the data you hold and the work you do. For most small businesses that’s HIPAA for patient data, the FTC Safeguards Rule for tax and financial firms, PCI DSS for card payments, Rule 1.6(c) for Louisiana lawyers, and Louisiana’s breach notification law for residents’ personal information. Size rarely changes whether a rule applies.

What does compliance mean for a small business?

Compliance means following the data protection rules that apply to you and being able to show it. For a small business the work is a short list done consistently: know what sensitive data you have, protect it with sensible controls, write down what you do, and check it on a schedule. If it isn’t written down, an auditor or insurer will treat it as not done.