I'd say the first step is "Is this data even the kind where HIPAA compliance might be required?" The number of people I know who conflate "human subjects data"

I'd say the first step is "Is this data even the kind where HIPAA compliance might be required?" The number of people I know who conflate "human subjects data" and "HIPAA data" is staggering.