HIPAA Audit Readiness Checklist for Biometric Screening Vendors

Use this checklist to organize the contracts, system records, policies, and operational evidence a biometric screening vendor may need to show during a HIPAA review. Your obligations depend on your role and the services you provide; a screening vendor is not automatically subject to HIPAA just because it handles biometric or health-related information.

The HIPAA Security Rule applies to covered entities and business associates that create, receive, maintain, or transmit electronic protected health information (ePHI). The rule calls for appropriate administrative, physical, and technical safeguards, with decisions informed by the organization’s risks. See the HHS overview of the HIPAA Security Rule.

Determine whether your company is a business associate and review BAAs

Start by examining what your company does for each client—not just how your contracts label the relationship. A vendor may qualify as a business associate when it performs a function or service on behalf of a covered entity that involves creating, receiving, maintaining, or transmitting PHI. A subcontractor handling PHI for a business associate may also qualify. HHS explains these relationships in its business associate guidance.

For example, if a health plan or provider hires your company to collect screening results, process them, store them, or report them for the client, that work may create a business associate relationship when the data is PHI. By contrast, merely selling software that cannot access a covered entity’s PHI does not, by itself, create that relationship, according to HHS business associate FAQs.

• Assess each service and data flow. Identify which clients are covered entities or business associates, what information your company handles, and whether you handle it on their behalf.
• Confirm a written business associate agreement (BAA). Where required, make sure it is in place before handling PHI and accurately describes permitted uses and disclosures, safeguards, incident reporting, subcontractors, and what happens to PHI when the work ends.
• Check subcontractors. Identify cloud hosts, screening platforms, analytics providers, and other vendors that handle PHI for you. Document the required written assurances and flow-down protections.
• Verify termination terms. The BAA should address returning or destroying PHI when feasible and safeguarding it if return or destruction is infeasible.

Use the HHS sample business associate contract provisions as a reference, not as a substitute for checking the agreement against your actual services and client requirements.

Map where PHI is collected, stored, transmitted, and accessed

Create a practical inventory of the information and systems involved in each screening program. A participant’s identifiable screening results may be PHI when handled in a covered-entity or business-associate relationship. Do not assume every biometric identifier or health-related data point is automatically HIPAA-regulated; assess the information and the context in which your company handles it.

Map the full flow from collection through deletion. Include on-site screening devices, tablets, paper forms, staff workstations, portals, cloud storage, email or file transfer, backups, support tools, and systems used by subcontractors. Record where information is entered, who can access it, where it travels, and how long it remains in each system.

• List the categories of participant information collected, such as identifiers, measurements, screening results, and notes.
• Record the applications, devices, storage locations, and vendors that create, receive, maintain, or transmit ePHI.
• Document how information moves between field staff, your organization, subcontractors, and the client.
• Identify access points used for remote support, troubleshooting, reporting, and system administration.
• Update the map when you change a service, vendor, device, or data transfer method.

This inventory helps you show that your risk analysis considers the ePHI your company actually holds or handles, rather than only the systems that are easiest to review.

Document risk analyses, policies, training, and mitigation evidence

The HIPAA Security Rule requires an accurate and thorough risk analysis of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. It also requires risk management measures to reduce identified risks to a reasonable and appropriate level. The HHS risk analysis guidance explains that the analysis should address the ePHI your organization creates, receives, maintains, or transmits.

Keep records that show how you identified risks, assessed their likelihood and impact, selected safeguards, assigned responsibility, and tracked mitigation. A checklist stating that a safeguard exists is not a substitute for documenting the risks it is meant to address and how you determined it was suitable.

• Maintain a dated risk analysis covering relevant systems, devices, locations, users, and vendors.
• Keep risk-treatment plans, remediation tickets, approvals, target dates, and evidence that completed actions were verified.
• Retain current security policies and procedures, including version dates and approval records.
• Document periodic evaluations and updates made in response to changes in technology, operations, or identified risks.
• Keep evidence of training, access reviews, incident handling, and other required activities.

Required Security Rule documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later. Review the documentation requirements in 45 CFR § 164.316 and align your retention process with applicable contracts and other requirements.

Verify role-based access, unique accounts, and audit-log reviews

Limit access to ePHI based on job duties and the access needed to perform authorized work. Role-based access control (RBAC) can help translate those duties into permissions for screeners, clinicians, customer support staff, administrators, and other users. Check that permissions remain appropriate when someone changes roles or leaves the organization.

• Assign each user a unique account so activity can be attributed to an individual; avoid shared logins where individual accountability is needed.
• Document how access is approved, changed, reviewed, and removed.
• Test whether users can see only the information and functions needed for their responsibilities.
• Review audit controls and access logs for unusual access, failed logins, administrative changes, and other relevant activity.
• Record the review date, reviewer, scope, findings, and any follow-up actions.

The Security Rule requires unique user identification and audit controls, and calls for procedures to regularly review system activity records. It does not prescribe one universal review frequency. Set and document a risk-based schedule, then investigate and record exceptions. See 45 CFR § 164.312 and the administrative safeguard requirements in 45 CFR § 164.308.

Check encryption, device security, and secure media disposal

Review how ePHI is protected on screening devices, laptops, removable media, mobile devices, servers, and during electronic transmission. The Security Rule makes encryption an addressable implementation specification: assess whether it is reasonable and appropriate in your environment, implement it when appropriate, or document the decision and any reasonable alternative. Addressable does not mean you can ignore the safeguard without assessment. See HHS guidance on encryption.

• Keep an inventory of devices that store or access ePHI, including field equipment and devices used for remote support.
• Document device protections and procedures for configuration, updates, authentication, lost-device response, and secure access.
• Assess safeguards for ePHI in transit, including transfers between screening equipment, your systems, subcontractors, and clients.
• Define procedures for the final disposition of ePHI and the reuse or disposal of electronic media.
• Keep sanitization or destruction records for equipment and media, including who performed the work and when.

Before reusing or disposing of a device or storage medium, ensure ePHI is removed or the media is destroyed using a method appropriate to the circumstances. HHS describes these expectations in its guidance on reusing or disposing of electronic media.

Prepare workforce training and incident response records

Keep evidence that workforce members receive security awareness and training relevant to their responsibilities, including field collection, handling participant information, account security, and reporting suspected problems. HIPAA requires workforce training as applicable to the rules and each person’s functions, but it does not establish a universal annual certificate-renewal requirement. Your client, employer, contract, or other applicable policy may set a recurring schedule.

Retain training materials, completion records, dates, and evidence that relevant workforce members were informed of material policy changes. A training completion certificate documents training; it does not, by itself, establish that your organization or a client is HIPAA compliant.

Maintain written procedures for receiving, escalating, investigating, documenting, and mitigating security incidents. Your response records should include the incident timeline, systems and information involved, investigative steps, containment and remediation, and communications with the client.

Make sure your BAA and incident procedures explain how and when you will notify the covered entity. For a breach of unsecured PHI at or by a business associate, HIPAA requires notice to the covered entity without unreasonable delay and no later than 60 calendar days after discovery; a BAA may require earlier notice. See the HHS Breach Notification Rule guidance and 45 CFR § 164.410.

Review physical safeguards and participant data retention and deletion

Check protections at every location where staff collect, view, store, or discuss participant information. This includes screening areas, offices, vehicles, equipment storage, and remote-work locations. Consider access to facilities, workstation placement, unattended screens, paper sign-in sheets, printed results, and conversations that could expose participant information.

Set a data retention and deletion schedule that reflects the BAA, client instructions, operational needs, and any other applicable recordkeeping requirements. Track what is retained, where it is held, when it is due for deletion, and how deletion is verified across active systems, backups, and subcontractors. HIPAA’s six-year Security Rule documentation period is not a universal retention period for participant health records; HHS notes that the Privacy Rule does not set a general medical-record retention period, and other requirements may apply. See the HHS disposal and retention FAQs.

• Document safeguards for facilities, workstations, portable equipment, paper records, and screening sites.
• Make sure staff know how to secure materials during transport and at temporary or off-site locations.
• Follow the BAA’s return-or-destroy terms when services end; if destruction is infeasible, document why and continue protecting and limiting use of the retained PHI as required.
• Keep deletion, return, and media-sanitization records, including any exceptions or legal holds.

Your audit-readiness check is complete when you can connect each relevant system and data flow to a documented risk assessment, appropriate safeguards, responsible personnel, and evidence that your procedures are followed.

FAQs.

When does a biometric screening vendor qualify as a HIPAA business associate?

A vendor generally qualifies when it performs a function or service on behalf of a covered entity, or a business associate, that involves creating, receiving, maintaining, or transmitting PHI. Whether screening information is PHI depends on the information and the relationship in which it is handled; biometric data is not automatically subject to HIPAA solely because it is biometric. See HHS business associate guidance.

What evidence should a vendor provide for a HIPAA audit?

Prepare the relevant BAA and subcontractor agreements, data-flow and system inventories, risk analysis and mitigation records, current policies, access approvals and reviews, audit-log review records, workforce training evidence, incident records, device and media-disposal procedures, and retention or deletion records. The exact evidence depends on the vendor’s services, systems, and obligations.

How often should vendors review access logs and user permissions?

The Security Rule requires regular review of system activity, but it does not set one universal interval for all vendors. Establish a documented, risk-based schedule for reviewing audit logs and permissions, and review access when users change roles or leave. Investigate unusual activity and retain evidence of the review and any corrective action.

How should biometric screening vendors securely retain and delete PHI?

Follow the BAA and client instructions, apply safeguards for as long as PHI is maintained, and use documented procedures to return, delete, or securely destroy PHI when required. If destruction at contract termination is infeasible, document the reason and continue protecting the retained information while limiting its use and disclosure. Check for applicable state, contract, and other recordkeeping requirements before deleting participant records.