Here's a pretty good checklist of things you ought to be doing to be HIPAA compliant. From HIPAAdvisory. And here's a list of HIPAA resources, especially helpful for the impending train wreck/TCS deadline.