HIPAA Audit Readiness Checklist for Area Agencies on Aging

Use this checklist to organize policies, risk assessments, workforce evidence, technical safeguards, vendor records, and privacy documentation before an audit. First, confirm how HIPAA applies to your agency: an area agency on aging is not automatically a covered entity just because it handles health-related or social-service information. HIPAA applies to covered entities and business associates as defined by the rule, so review your agency’s services, transactions, contracts, and relationships with covered entities. See HHS guidance on covered entities and business associates.

If HIPAA applies to your agency, focus on evidence that shows how written policies work in practice. If it does not, other laws, contracts, grant conditions, or state requirements may still govern the information you handle.

Which HIPAA policies and governance records should an area agency maintain?

Keep a central, access-controlled collection of current HIPAA policies and governance documents. The Security Rule requires covered entities and business associates to maintain written policies and procedures, document required actions and assessments, review documentation periodically, and update it as needed. HHS summarizes these Security Rule documentation requirements.

• HIPAA applicability analysis: Record why the agency considers itself a covered entity, business associate, or neither, including the relevant services, data flows, and contracts. Revisit the analysis when programs or partnerships change.
• Assigned security responsibility: Identify the person accountable for developing and implementing security policies. Include the relevant privacy, IT, records-management, and incident-response contacts.
• Core policies: Keep current policies for workforce access, security awareness and training, incident response, contingency planning, sanctions, device and media handling, and management of business associates, as applicable.
• Governance evidence: Retain approval dates, version histories, review records, responsibility assignments, and notes showing how policies were communicated and put into practice.
• Related agreements: Organize applicable business associate agreements, subcontractor assurances, data-use agreements, and other contracts that set PHI privacy or security requirements.

The HIPAA audit protocol identifies policy and procedure records, assigned responsibilities, sanction policies, training evidence, and business associate agreements among the materials an auditor may examine. Use the HHS HIPAA Audit Protocol to check whether your documentation addresses the relevant standards.

How should agencies document risk analysis and remediation?

Your HIPAA Security Rule risk analysis should explain how the agency identifies and assesses risks to the confidentiality, integrity, and availability of electronic protected health information (ePHI). Document the systems and locations in scope, how ePHI is created, received, maintained, or transmitted, anticipated threats and vulnerabilities, existing safeguards, and the method used to assess and prioritize risk. HHS’s risk analysis guidance describes these documentation elements.

• Maintain an inventory of systems, devices, applications, service providers, and workflows that handle ePHI.
• Record identified threats and vulnerabilities, their potential impact, likelihood, and priority, along with the safeguards already in place.
• Connect each significant risk to a remediation step, accountable owner, target date, and evidence of completion or a documented decision to accept or otherwise manage the risk.
• Keep dated versions of the analysis and updates so reviewers can see what changed and why.

HIPAA does not set a universal annual schedule for a comprehensive risk analysis. HHS says the process should be ongoing, with updates as needed; timing depends on the organization and its environment. Review the analysis when systems, services, vendors, locations, or threats change, and after relevant incidents. See HHS guidance on risk analysis and ongoing review.

Keep risk analysis and remediation records together. The audit protocol looks for evidence that risks identified in an assessment were addressed through implemented or planned security measures, including action plans and implementation notes. See the HHS Audit Protocol.

What workforce training and accountability evidence should be ready?

The Security Rule requires a security awareness and training program for all workforce members, including management. Keep the training materials, dates, attendance or completion records, and evidence that training addressed your agency’s actual systems and procedures. HHS’s Security Rule summary describes the workforce training requirement.

Make training relevant to the work people do. For example, staff and volunteers who handle referrals, case notes, assessments, or service coordination should know how to verify identity, share information appropriately, protect screens and devices, report suspected incidents, and follow role-specific access rules. Keep records of training for new personnel and of later security updates or reminders.

HIPAA does not establish a universal annual training or certificate-renewal schedule. Set a schedule that fits your risk analysis, policies, workforce changes, and applicable contracts or other requirements. A training completion certificate shows that a person completed a course; it does not, by itself, establish that the agency is HIPAA-compliant. HHS identifies the training program as an organizational safeguard, alongside other required policies and procedures. See the HHS Audit Protocol.

Maintain a workforce sanctions policy and evidence that accountability procedures are used consistently. Keep documentation of reported policy violations, investigations, decisions, and sanctions where applicable, while limiting access to sensitive personnel records. The Security Rule requires a sanction policy and appropriate sanctions for workforce members who fail to follow security policies. See HHS’s Security Rule summary.

How can agencies verify access controls and audit log monitoring?

Show that access to ePHI is authorized, appropriate to job responsibilities, and removed or changed when a person’s role or employment status changes. A role-based access control approach can help match permissions to duties, but the agency should be able to demonstrate how access decisions are approved, documented, and reviewed.

• Keep current user and access-rights listings for systems that contain ePHI.
• Retain records of access requests, approvals, changes, periodic reviews, and prompt termination of access when needed.
• Use unique user accounts where supported so activity can be associated with an individual; document any approved exceptions and compensating controls.
• Preserve evidence of administrator access reviews and procedures for emergency access.

The Security Rule requires access controls, audit controls that record and examine activity in systems containing ePHI, and regular review of system activity records such as audit logs, access reports, and security incident tracking reports. Keep HIPAA audit log review procedures and evidence showing what was reviewed, when, by whom, what exceptions were identified, and how they were resolved. See the HHS Security Rule summary and HHS Audit Protocol.

Set a review cadence that reflects your risk analysis and document it. The HIPAA Security Rule requires regular review but does not prescribe one universal review interval for every agency or system. Avoid relying solely on a vendor’s assurance that logging is enabled; retain evidence that your agency reviewed relevant activity and acted on findings.

Which safeguards protect electronic and physical PHI?

Organize evidence of administrative, technical, and physical safeguards for both electronic and paper records. Your risk analysis should inform which measures are appropriate to protect ePHI and how the agency evaluates their effectiveness. HHS describes the safeguard categories in its Security Rule summary.

• Electronic safeguards: Document access restrictions, authentication, audit controls, secure transmission, backups, and procedures for protecting information on agency-managed or approved devices.
• Electronic protected health information encryption: Record whether data is encrypted in transit and at rest where appropriate, how encryption is managed, and how the agency assessed any alternative safeguards. Under the current Security Rule, encryption is an addressable implementation specification: the agency must assess whether it is reasonable and appropriate and document its decision and any alternative measures. See HHS guidance on HIPAA encryption.
• Physical safeguards: Keep procedures for controlling facility access, protecting workstations and screens, securing paper files, managing portable devices and media, and disposing of records and equipment securely.
• Contingency safeguards: Maintain evidence of retrievable backups, recovery procedures, emergency-mode operations, and any testing or revisions to contingency plans.

Evidence may include configuration records, access-control reviews, device inventories, encryption assessments, backup and restoration test results, facility procedures, and secure disposal records. The specific documentation should correspond to the safeguards your agency selected and the risks identified. See the HHS Security Rule guidance on technical safeguards.

How should agencies document incident response and business associate oversight?

Keep a written incident-response process that explains how workforce members report suspected incidents, who evaluates them, how the agency contains and mitigates harm, and how it documents the investigation and outcome. Maintain a record of reported security incidents, response steps, decisions, and corrective actions, including incidents that were investigated and determined not to be breaches.

For a potential breach of unsecured PHI, preserve the facts considered, the risk assessment and its conclusion, notifications made, and the basis for determining that notification was not required when that is the outcome. Covered entities must document required breach notifications or the basis for determining that notification was not required. HHS explains these duties in its Breach Notification Rule guidance. The rule generally requires notice to affected individuals without unreasonable delay and no later than 60 days after discovery; a business associate must notify the covered entity without unreasonable delay and no later than 60 days, subject to the applicable agreement.

Maintain a current inventory of vendors and service providers whose work may involve PHI on behalf of a covered entity. Determine whether each relationship requires a business associate agreement (BAA); a vendor is not automatically a business associate merely because it provides a service. A written BAA is generally needed when a business associate performs covered functions or services involving PHI, and subcontractors that handle PHI on a business associate’s behalf may also have obligations. Review HHS’s Business Associates guidance for definitions and exceptions.

• Keep signed BAAs, amendments, renewal or review records, and a list of services and PHI involved.
• Check that agreements address permitted uses and disclosures, safeguards, incident and breach reporting, subcontractors, and PHI return or destruction at termination, as applicable.
• Document vendor security reviews, identified issues, follow-up actions, and termination or remediation decisions.
• Track subcontractors when relevant and retain evidence that required contractual assurances are in place.

HHS provides sample business associate agreement provisions that describe key contract terms. Use them as a reference, not as a substitute for reviewing the agency’s actual services, data flows, and agreement.

What records and privacy forms should be organized for an audit?

Make records easy to retrieve by organizing them by topic, owner, date, and system. HIPAA documentation required under the Security Rule must generally be retained for six years from its creation or the date it was last in effect, whichever is later. The rule also requires periodic review and updates as needed. See the HHS Audit Protocol and the documentation requirements summarized in the HHS Security Rule guidance. Check other applicable laws and contracts for additional retention periods.

Gather the records that apply to the agency’s HIPAA role and operations, such as:

• Current policies, procedures, approvals, and prior versions.
• Risk analyses, remediation plans, progress updates, and evaluation records.
• Workforce training materials, completion records, security reminders, and sanctions-policy documentation.
• User access lists, access approvals and changes, audit log review records, and incident tracking reports.
• Incident investigations, breach risk assessments, notification records, and corrective actions.
• BAAs, vendor inventories, subcontractor assurances, and vendor review records.
• Backup and recovery plans, test records, device inventories, and physical-security procedures.

Privacy forms depend on whether the agency is a covered entity and on the services it provides. If applicable, organize the current Notice of Privacy Practices, records of providing or attempting to provide it, individual authorizations, and documentation of privacy requests and responses. A Notice of Privacy Practices is required for covered providers and health plans, not automatically for every organization that handles health-related information. HHS explains the notice and related acknowledgement in its Notice of Privacy Practices guidance.

In short: Confirm your agency’s HIPAA role, keep required policies and evidence current, connect risk findings to remediation, and make training, access, incident, vendor, safeguard, and applicable privacy records easy to produce.

FAQs

How often should an area agency on aging review its HIPAA risk analysis?

HIPAA does not set one fixed annual frequency for every organization. HHS describes risk analysis as an ongoing process that should be revisited and updated as needed, including when changes to systems, operations, vendors, or the security environment affect ePHI. See HHS guidance on risk analysis.

What evidence should an agency provide during a HIPAA audit?

Be prepared to provide the policies, procedures, and records relevant to the standards under review. Examples include risk analyses and remediation evidence, workforce training and sanctions records, access and audit log review evidence, incident and breach documentation, contingency records, and applicable business associate agreements. The HHS Audit Protocol lists documentation auditors may review.

Which vendors need a business associate agreement?

A BAA is generally required when a vendor acts on behalf of a covered entity and its functions or services involve creating, receiving, maintaining, or transmitting PHI. Some relationships are exceptions, so assess the vendor’s actual role and access rather than relying only on its industry or contract label. See HHS’s Business Associates guidance.

What HIPAA records should be retained for audit readiness?

Retain required HIPAA policies and documentation, including records of required actions and assessments, for six years from creation or from the date the record was last in effect, whichever is later. This is not a universal retention rule for every record an agency holds; other laws, agreements, and operational needs may require different periods. See the HHS Audit Protocol.