HIPAA Audit Readiness Checklist for Alzheimer’s Disease Research Centers

Use this checklist to organize research privacy records, ePHI safeguards, access reviews, and audit evidence. First determine whether your center—or the organization operating it—is a HIPAA covered entity or business associate; conducting Alzheimer’s research alone does not automatically make a center subject to HIPAA. The HHS overview of covered entities and business associates explains who must comply.

How should research authorizations and waivers be documented?

For each project that uses or discloses protected health information (PHI), keep records showing the legal basis for access. Depending on the study, that may be a valid individual authorization, an approved waiver or alteration of authorization, a limited data set with a data use agreement, or another permitted research pathway. A Common Rule consent form is not automatically a HIPAA authorization; track each requirement separately.

• For authorizations: retain the signed and dated form and verify that it identifies the PHI, the persons or groups permitted to use or disclose it, the recipients, the purpose, and an expiration date or event. Check for required statements about revocation, conditioning, and potential redisclosure. Research authorizations may use “end of the research study” or similar language as the expiration event. See HHS guidance on HIPAA and research.
• For a waiver or alteration: retain documentation identifying the approving IRB or Privacy Board and approval date, stating that the required waiver criteria were met, describing the PHI needed, indicating the review procedure, and bearing the required chair or designee signature.
• For waiver criteria: keep the board’s determination that the privacy risk is no more than minimal, the research could not practicably be conducted without the waiver or alteration, and—where required—the research could not practicably be conducted without access to and use of PHI. The determination also addresses plans to protect identifiers, destroy them at the earliest appropriate opportunity, and prevent impermissible reuse or disclosure. The specific requirements appear in HHS’s research guidance.
• For other pathways: retain the applicable documentation, such as a data use agreement for a limited data set or the required representations for preparatory research or research on decedents. Do not assume every pathway requires the same IRB waiver paperwork; HHS clarifies when waiver-approval documentation is required.

Link each approval to the protocol version, data fields, study personnel, source systems, and permitted uses it covers. When an amendment changes the data or access, confirm that the authorization or board determination still supports the activity before proceeding.

How can centers assess and remediate ePHI security risks?

Maintain a documented electronic protected health information risk analysis that accounts for ePHI the organization creates, receives, maintains, or transmits. Map where study and clinical data reside and move—including electronic health records, participant registries, imaging and laboratory systems, research databases, cloud services, endpoints, portable media, backups, and transfers to collaborators. HHS describes the required scope as risks to the confidentiality, integrity, and availability of all ePHI, regardless of its location or medium, in its risk analysis guidance.

• Record identified threats and vulnerabilities, existing safeguards, likelihood and impact assessments, and the resulting risk decisions.
• Maintain a security risk remediation plan that assigns an owner, action, target date, and status to each finding. Document decisions to mitigate, transfer, or accept risk and the rationale for those decisions.
• Reassess when systems, vendors, workflows, facilities, or study practices change, and after incidents or newly recognized risks. Keep evidence of follow-up evaluations and completed remediation.
• Use the analysis to guide safeguards and priorities; a checklist or tool alone does not establish that the analysis covers the center’s actual environment.

HIPAA does not set one universal calendar interval for repeating a comprehensive risk analysis. HHS says the process should be ongoing and the appropriate frequency depends on the organization and its circumstances. Plan periodic reviews and trigger-based updates rather than treating an annual review as a universal federal rule. See HHS guidance on reviewing and updating risk analysis.

Which systems and activities should audit controls cover?

Define the systems that contain or use ePHI, then use risk analysis to determine what activity should be recorded and examined. For an Alzheimer’s research center, the inventory may include clinical records, recruitment and contact tools, cognitive assessment data, imaging platforms, laboratory and specimen-linked databases, study management systems, file-transfer tools, email, cloud platforms, backups, and vendor-hosted applications.

Audit controls are required for information systems containing or using ePHI, but HIPAA does not prescribe one universal log format or review interval. The HHS audit-controls guidance says organizations should determine the appropriate scope based on risk and organizational factors, and that the Rule does not specify how often audit reports must be reviewed.

• Confirm logs can attribute activity to individual users and record relevant actions, such as viewing, creating, changing, exporting, or deleting ePHI, where supported by the system and appropriate to the risk.
• Document the audit control activity review process: who reviews which reports, how often, what triggers an investigation, and how findings are escalated.
• Retain evidence of completed reviews, investigated anomalies, decisions, and corrective actions. Check that vendor systems provide the logs or reports your own risk-based procedures require.
• Test whether logs are accessible, usable, and protected from unauthorized changes, and whether review procedures cover major systems and data flows rather than only the main clinical application.

How can access and use be limited to the minimum necessary?

Apply the minimum necessary standard where it applies: establish reasonable policies that limit PHI uses, disclosures, and requests to what is needed for the purpose. Build access around job function and protocol duties, not general membership in a research team. HHS explains that routine activities may use standard protocols, while non-routine requests and disclosures should be evaluated under the organization’s criteria. See the HHS minimum necessary guidance.

• Maintain role-based access matrices showing which roles may access each system, dataset, and data element, and who approved access.
• Use separate accounts and permissions for investigators, coordinators, analysts, clinicians, laboratory staff, administrators, and external collaborators when their duties differ.
• Review access when a worker joins, changes roles, leaves, or no longer needs a study dataset. Remove or adjust permissions promptly and preserve approval and review records.
• For research requests made under an approved IRB or Privacy Board waiver, retain the supporting documentation. HIPAA allows a covered entity to reasonably rely on a researcher’s appropriate waiver documentation about the minimum amount needed, while retaining discretion to assess the request. See HHS guidance on waiver documentation and minimum necessary.

Apply the standard with attention to the specific legal pathway and any applicable exceptions; do not assume that every HIPAA use or disclosure is subject to the same minimum-necessary analysis.

What security safeguards protect ePHI from improper access or alteration?

Use administrative, physical, and technical safeguards suited to the risks identified for the center’s systems and workflows. The HIPAA Security Rule requires access controls, audit controls, integrity protections, authentication, and transmission security. Its technical safeguards also address unique user identification, emergency access, and encryption. The exact regulatory standards are set out in 45 CFR § 164.312; for official agency guidance, consult HHS’s Summary of the HIPAA Security Rule.

• Use unique user IDs and procedures to verify identity; control access to systems, workstations, devices, rooms, and paper records containing PHI.
• Protect integrity by using appropriate controls to detect or prevent improper alteration or destruction, and maintain backup and recovery procedures for ePHI.
• Evaluate the need for encryption at rest and in transit. Encryption implementation specifications are designated “addressable,” which requires an assessment of whether the measure is reasonable and appropriate in the organization’s circumstances—not an assumption that the safeguard can simply be ignored.
• Document the ePHI transmission encryption decision and the protections used for email, file transfer, remote access, mobile devices, and exchanges with collaborators. Protect transmitted data from unauthorized access and address integrity so improper modification can be detected.
• Keep incident-response procedures, including how to report, investigate, contain, mitigate, and document suspected security incidents.

Which policies, approvals, and records should be ready for an audit?

Prepare an organized, current evidence set that connects written procedures to actual practice. A reviewer should be able to trace each study’s authority to use PHI, each relevant system’s safeguards, and the organization’s response to identified risks.

• Current privacy and security policies, assigned security responsibilities, and procedures for access, workforce changes, incident response, contingency planning, and evaluation.
• Study protocols and amendments, IRB or Privacy Board approvals, HIPAA authorizations or waiver records, data use agreements, and other documentation supporting the specific research pathway.
• Risk analyses, risk-management decisions, remediation plans, periodic evaluations, system inventories, data-flow descriptions, and evidence that findings were addressed.
• Access approvals and reviews, workforce training records, incident records, audit-control review evidence, and applicable business associate agreements.
• Documentation showing when procedures were reviewed, updated, approved, and communicated to relevant staff.

Under the Security Rule, required policies and documentation must generally be retained for six years from creation or the date they were last in effect, whichever is later. This rule concerns required documentation; it does not itself set one retention period for every clinical record or every technical log. See HHS’s Security Rule documentation summary and confirm whether state law, contracts, grants, or institutional policy require longer retention.

How do workforce roles and biospecimen research requirements affect audit readiness?

Document who is responsible for privacy, security, study oversight, and system administration, and make sure each role has only the access needed for its duties. Keep role descriptions, access approvals, training records, and evidence of access changes when personnel join, change roles, or depart. HIPAA requires a security awareness and training program for workforce members; HHS’s audit protocol describes the types of training and access evidence that may be reviewed. Training records demonstrate completion of training; they do not by themselves establish that the organization is HIPAA compliant.

For biospecimen studies, distinguish the physical specimen from the health information associated with it. HHS explains that HIPAA applies to individually identifiable health information, not to the biospecimen itself; data derived from or linked to a specimen may still require privacy review. The OHRP Revised Common Rule Q&As discuss this distinction and when identifiable private information or identifiable biospecimens may bring research within the Common Rule’s human-subject provisions.

Assess HIPAA and Common Rule applicability independently for each activity. Depending on the organization, funding, assurances, data, specimens, and study procedures, one, both, or neither framework may apply. Keep the IRB’s determination and the institution’s rationale with the protocol; Common Rule review does not replace any HIPAA authorization or permitted-use requirement that applies.

In short, audit readiness depends on matching each study’s data access to a documented legal basis, assessing and addressing ePHI risks, reviewing system activity, and keeping evidence that safeguards and workforce procedures operate as intended.

FAQs

What must a HIPAA research waiver document?

For a waiver or alteration under the HIPAA research provision, retain documentation identifying the IRB or Privacy Board and approval date; stating that the required criteria were met; briefly describing the PHI needed; indicating whether normal or expedited review was used; and bearing the required chair or designee signature. The board’s determination must address the applicable privacy-risk and practicability criteria. See HHS’s HIPAA research guidance.

How often should an Alzheimer’s research center review ePHI security risks?

Review risk as an ongoing process, with periodic reassessment and updates when systems, operations, or recognized risks change. HIPAA does not specify one universal interval for a comprehensive risk analysis; HHS says frequency depends on the organization’s circumstances. An annual review may be a useful internal schedule, but it is not a universal federal requirement. See HHS risk analysis guidance.

What evidence should be available to demonstrate audit controls?

Keep the procedures that define which ePHI systems and activities are monitored, relevant log or activity reports, documented review dates and reviewers, investigation records, and evidence of follow-up actions. HIPAA does not prescribe one universal log format or review frequency, so document how the center’s risk analysis informed its approach. See HHS guidance on audit controls.

Do biospecimen studies need to comply with HIPAA and the Common Rule?

It depends on the institution and the study. HIPAA applies to PHI handled by covered entities and business associates, not to the physical biospecimen itself; identifiable health information associated with a specimen may still be subject to HIPAA. The Common Rule may apply when its scope and human-subject criteria are met. Evaluate both frameworks separately and document the institution’s determinations. See OHRP’s Revised Common Rule Q&As and HHS HIPAA research guidance.