HIPAA Audit Readiness Checklist for Children With Special Health Care Needs Programs

Use this checklist to organize evidence about how your program protects health information, supports families’ privacy rights, and responds to security events. HIPAA requirements apply to covered entities and business associates; first confirm your program’s role and responsibilities, including any obligations established by contracts or other laws.

How should programs assess and manage ePHI risks?

Document a HIPAA Security Risk Analysis covering electronic protected health information (ePHI) your organization creates, receives, maintains, or transmits. Include records held in electronic health records, care-coordination systems, email, mobile devices, telehealth platforms, backups, and systems managed by vendors.

• Maintain an inventory of systems, devices, applications, data flows, users, and external parties that may handle ePHI.
• Identify reasonably anticipated threats and vulnerabilities, and assess how they could affect ePHI’s confidentiality, integrity, or availability.
• Record existing safeguards, identified gaps, risk decisions, assigned owners, target dates, and actions taken to reduce risk.
• Revisit the analysis when systems, services, staffing, locations, or identified risks change, and keep evidence of reviews and updates.

HIPAA does not prescribe one risk-analysis method or a universal annual schedule. HHS describes risk analysis as an ongoing process; the appropriate review frequency depends on the organization’s circumstances and changes in its environment. Keep the written analysis and connect its findings to documented risk-management decisions. HHS Guidance on Risk Analysis

Which privacy policies and patient-rights procedures should be documented?

Keep current, approved privacy policies and procedures that explain how your organization handles protected health information (PHI). Document the process for receiving, assigning, tracking, and responding to privacy complaints and requests for access, amendment, and accounting of disclosures, as applicable to your organization’s role.

• If your organization is a covered entity required to provide a HIPAA Notice of Privacy Practices, retain the notice versions, distribution procedures, and related acknowledgments or documentation of outreach.
• Document who is authorized to act for a child and how staff verify that authority. A parent is generally a minor’s personal representative when applicable law gives the parent authority to make relevant health-care decisions, subject to HIPAA exceptions and state law.
• Maintain procedures for disclosures to parents, guardians, care teams, schools, and other partners, including when authorization or another legal basis is required.
• Record complaints and their disposition, and document decisions and communications related to individual-rights requests.

A Notice of Privacy Practices is a covered-entity requirement with specified exceptions; a business associate should follow its agreement and assist the covered entity as required. HIPAA’s rules for parental access can depend on state law and the circumstances of a minor’s care. HHS Summary of the HIPAA Privacy Rule and HHS Business Associate Contract Provisions

Which administrative, physical, and technical safeguards should be verified?

Gather evidence that safeguards are implemented and appropriate to your organization’s risks. The HIPAA Security Rule calls for administrative, physical, and technical safeguards to protect ePHI; the specific measures should reflect the organization’s circumstances and risk analysis.

• Administrative safeguards: Verify security policies, assigned security responsibilities, workforce access procedures, incident response, risk management, and periodic evaluations.
• Physical safeguards: Review facility and workstation protections, visitor controls where relevant, and procedures for handling, moving, reusing, and disposing of devices or media containing ePHI.
• Technical safeguards: Check that access is limited to authorized users, users have unique identification, identity is authenticated, and systems record and examine activity involving ePHI.
• Transmission and integrity: Review protections against unauthorized access or improper changes when ePHI is transmitted or stored. Document decisions about addressable implementation specifications, including encryption, based on whether a measure is reasonable and appropriate and, if not, what equivalent measure is used where appropriate.

Keep evidence such as approved policies, access-control settings, device procedures, risk-based safeguard decisions, and evaluation results. HHS summarizes the Security Rule’s safeguard standards and implementation specifications. HHS Summary of the HIPAA Security Rule

How should audit logs and compliance records be reviewed?

Confirm that systems containing or using ePHI have mechanisms to record and examine activity. Document which systems are covered, what activity is reviewed, who performs the review, how suspected issues are escalated, and how follow-up is recorded.

• Review access and activity logs for patterns that may indicate inappropriate access, use, or disclosure.
• Keep review notes, investigation records, incident referrals, and documented corrective steps, following your organization’s policies and applicable retention requirements.
• Maintain a controlled, organized file of current and superseded policies, risk analyses, evaluations, decisions, training records, and other required compliance documentation.
• Retain HIPAA-required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later. This is a compliance-documentation rule, not a general HIPAA medical-record retention period.

HIPAA requires audit controls but does not set one universal log-review frequency in the cited standard. Set and document a review schedule suited to your systems and risks. HHS HIPAA Audit Protocol and HHS Guidance on Medical-Record Retention

What workforce training records should be maintained?

Keep records showing that workforce members receive training on the privacy policies and procedures they need for their roles. For children’s special health care needs programs, training can address appropriate access to family records, secure care coordination, permitted disclosures, identity verification, and reporting suspected incidents.

• Maintain training dates, content or materials, attendees, completion evidence, and any follow-up for incomplete training.
• Document training for new workforce members within a reasonable period after they join and for affected staff after a material policy change, as required for covered entities by the Privacy Rule.
• Keep records of applicable sanctions and the organization’s process for addressing policy violations.
• Distinguish proof that someone completed a course from evidence that the organization has implemented its own required policies and safeguards.

HIPAA requires documented training as applicable, but it does not establish a universal federal annual certificate-renewal requirement. A program may set an annual schedule through its own policies, contracts, or other applicable requirements. HHS HIPAA Audit Protocol

How should programs document breach response and corrective actions?

Maintain written procedures for reporting, assessing, containing, investigating, and responding to suspected privacy or security incidents. Preserve a record of each incident, the facts reviewed, the decision about whether it was a breach of unsecured PHI, mitigation steps, notifications, and corrective actions.

• Record when and how the incident was discovered, the information and systems involved, the people or organizations affected, and the investigation’s findings.
• Document the breach assessment and the basis for any decision that notification was not required.
• Track containment, mitigation, assigned corrective actions, responsible owners, deadlines, and evidence that actions were completed.
• Retain copies of notices and records showing when and how required notifications were sent.

For a breach of unsecured PHI, covered entities generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Separate reporting rules apply to the HHS Secretary and, in certain cases, the media; business associates must notify the covered entity under the applicable rule and agreement. HHS Breach Notification Rule

Which business associate and contingency-planning records should be ready?

Maintain an up-to-date list of vendors and other partners that create, receive, maintain, or transmit PHI on your organization’s behalf. For relationships requiring a business associate agreement, keep the signed agreement and confirm that it addresses permitted uses and disclosures, safeguards, incident reporting, individual-rights support, subcontractors, and return or destruction of PHI when the relationship ends, as applicable.

• Track agreement owners, effective dates, amendments, services covered, and relevant subcontractor arrangements.
• Maintain contingency-planning records for data backup, disaster recovery, and emergency-mode operations.
• Keep evidence of contingency plan testing or exercises, restoration checks, identified gaps, and follow-up actions.
• Verify that plans identify critical systems and data needed to continue or restore essential program functions.

HIPAA’s Security Rule includes contingency-planning requirements. HHS identifies periodic testing as an activity that helps assess readiness; keep records of what was tested and how identified issues were addressed. HHS Business Associate Contract Provisions and HHS Ransomware and HIPAA Guidance

Audit readiness depends on clear evidence: a current risk analysis, documented privacy procedures, implemented safeguards, reviewed audit controls, role-appropriate training, incident records, and ready vendor and contingency-planning documentation. Keep required records organized, current, and accessible to the people responsible for carrying out the procedures.

FAQs.

How often should a children’s special health care needs program conduct a HIPAA risk analysis?

HIPAA does not set a universal annual frequency. HHS describes risk analysis as an ongoing process and says review frequency depends on the organization’s environment. Reassess when relevant systems, operations, or risks change, and document the review and resulting actions. HHS Guidance on Risk Analysis

What records should be available for a HIPAA audit?

Prepare applicable risk analyses and risk-management records, policies and procedures, safeguard and evaluation evidence, audit-control review records, training documentation, incident and breach files, individual-rights procedures, and business associate agreements. HIPAA-required compliance documentation generally must be retained for six years from creation or the date it was last in effect, whichever is later. HHS HIPAA Audit Protocol

Which HIPAA safeguards apply to workforce access to ePHI?

The Security Rule requires appropriate administrative, physical, and technical safeguards. For electronic access, verify that access is limited to authorized users, unique user identification and authentication are implemented, and activity in systems containing or using ePHI can be recorded and examined. HHS Summary of the HIPAA Security Rule

When must affected individuals be notified of a breach?

For a breach of unsecured PHI, covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The notification and reporting obligations can vary by the number of people affected and other circumstances. HHS Breach Notification Rule