HIPAA Audit Readiness Checklist for Community Oncology Practice Networks

Use this checklist to organize evidence across network locations, systems, and workflows that create, receive, maintain, or transmit electronic protected health information (ePHI). First confirm which organization is responsible for each practice, system, and process; responsibilities depend on the entities’ legal and operational arrangements. This is a practical preparation aid, not an official OCR checklist or certification.

How should a network document its HIPAA risk analysis and remediation plans?

Keep a documented Security Risk Assessment (SRA) that covers the ePHI within each applicable organization’s environment. Include relevant systems and workflows—such as the EHR, infusion operations, imaging, laboratory interfaces, patient communications, and remote access—along with the locations and vendors involved. HIPAA requires an accurate and thorough assessment of risks and vulnerabilities to ePHI’s confidentiality, integrity, and availability; HHS explains that the Security Rule does not prescribe a single assessment format. See HHS guidance on risk analysis and 45 CFR § 164.308.

• Record the assessment’s scope, date, responsible contributors, systems and ePHI flows reviewed, existing safeguards, relevant threats and vulnerabilities, and how likelihood and potential impact were assessed.
• Maintain a remediation register that links each identified risk to the selected risk response, responsible owner, target date, progress, and evidence of completion. Record management decisions and any remaining risk.
• Document why an addressable implementation specification is not reasonable and appropriate, when applicable, and whether an equivalent alternative measure is reasonable and appropriate. “Addressable” does not mean automatically optional; see 45 CFR § 164.306.

HIPAA does not set a universal interval for repeating the full risk analysis. Keep the process ongoing and update the assessment when needed, including after material changes to systems or operations, significant incidents, or newly identified risks. HHS notes that frequency depends on the organization’s circumstances. HHS risk analysis guidance

Which HIPAA policies and workforce training records should be audit-ready?

Keep current, approved policies and procedures covering the network’s Security Rule safeguards and relevant Privacy Rule processes. Identify the privacy and security officials and show who is responsible for approving, distributing, reviewing, and updating each policy. For networked practices, make clear which policies apply centrally and which require site-specific procedures.

• Organize policies addressing risk management, workforce access, sanctions, security incidents, security awareness and training, contingency planning, and periodic evaluation.
• Keep version histories, approvals, review dates, and evidence that applicable policies were distributed or made available to the workforce.
• Retain training materials and records showing who completed relevant training and when. The Security Rule requires a security awareness and training program for all workforce members, including management; privacy training requirements also apply to covered entities. Training should address the organization’s policies and the person’s role. HIPAA does not establish a universal annual training or certificate-renewal schedule. See 45 CFR § 164.308 and 45 CFR § 164.530.
• Keep documentation required by the Security Rule for six years from its creation or the date it was last in effect, whichever is later. Apply any longer retention period required by other applicable rules or organizational obligations. 45 CFR § 164.316

How can practices review vendor risks and business associate agreements?

Maintain an inventory of vendors and other parties that create, receive, maintain, or transmit PHI for a covered entity, then determine which are business associates under HIPAA. A vendor’s access to a practice or its data does not, by itself, establish that the vendor is a business associate; assess the services and relationship. When a business associate relationship applies, a written Business Associate Agreement (BAA) or other permitted arrangement must meet the applicable requirements. See HHS guidance on covered entities and business associates and 45 CFR § 164.504.

• Keep an up-to-date vendor register with the services provided, the ePHI involved, the practice or network owner, contract status, and review dates.
• Confirm each required BAA is signed and reflects the applicable requirements, including permitted uses and disclosures, safeguards, reporting of security incidents and breaches, and applicable subcontractor obligations. See 45 CFR § 164.314.
• As a risk-management practice, document vendor reviews, the information considered, identified concerns, follow-up actions, and decisions. The HIPAA Rules do not expressly require every business associate to provide security documentation or permit customer audits; additional assurances can be addressed through contractual arrangements based on the organization’s risk analysis. HHS guidance on HIPAA and cloud computing

How should networks manage user access, audit logs, and technical safeguards?

Keep evidence that access to systems containing ePHI is authorized, appropriate to users’ roles, and reviewed. Maintain procedures for granting, changing, and removing access, including when workforce members change roles or leave. Use unique user identification and document how emergency access is provided. See 45 CFR § 164.308 and 45 CFR § 164.312.

• Retain access approvals and periodic review records for clinical and administrative systems, including EHR, prescribing, infusion, billing, and remote-access tools where they contain or access ePHI.
• Keep access-control audit logs and records of their review, including the review date, reviewer, exceptions identified, and follow-up actions. HIPAA requires procedures for regularly reviewing information-system activity records, such as audit logs and access reports.
• Document decisions about safeguards such as automatic logoff, encryption, and other technical protections. Where an implementation specification is addressable, assess whether it is reasonable and appropriate and document the decision and any applicable alternative measure.
• Keep records of relevant security evaluations, system changes, security incidents, and corrective actions so the network can show how safeguards are maintained and improved.

What physical safeguards protect oncology facilities, devices, and media?

Document how each practice limits physical access to facilities, systems, workstations, and devices that contain or can access ePHI while allowing authorized care to continue. Include areas such as reception, treatment spaces, staff work areas, records storage, and rooms containing network equipment as applicable. HIPAA requires physical safeguards, including facility access controls, workstation security, and device and media controls. 45 CFR § 164.310

• Keep site procedures for staff and visitor access, workstation use, screen positioning or locking, and protection against unauthorized access, tampering, or theft.
• Maintain inventories and procedures for receiving, moving, reusing, and disposing of devices and media that contain ePHI. Keep required records of secure disposal and removal of ePHI before media are reused.
• Retain applicable records of equipment movements, repairs, and security-related facility modifications. Where an implementation specification is addressable, document the organization’s assessment and its chosen safeguards.

How should teams document incidents, breach assessments, and notifications?

Maintain a process for reporting, triaging, investigating, mitigating, and documenting suspected or known security incidents. Keep an incident record even when an event is ultimately determined not to be a reportable breach. HIPAA’s Security Rule requires entities to identify and respond to security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes. 45 CFR § 164.308

• Record the discovery date, reporting source, systems and information involved, individuals potentially affected, investigation steps, containment and mitigation, decision-makers, and corrective actions.
• For an impermissible use or disclosure of PHI, document the breach notification assessment. Unless an exception applies, a breach is presumed unless the organization demonstrates a low probability that the PHI was compromised based on an assessment of the required factors. Retain the assessment or documentation supporting another applicable exception, and records of required notifications. HHS Breach Notification Rule guidance
• Track applicable notification responsibilities and dates. The Breach Notification Rule generally requires individual notice without unreasonable delay and no later than 60 days after discovery; business associates must notify covered entities without unreasonable delay and no later than 60 days, subject to applicable contractual terms. Assess other applicable legal requirements separately. HHS breach notification requirements

What contingency plans and privacy records should the network maintain?

Keep contingency procedures for emergencies that may damage systems containing ePHI or interrupt critical operations. Identify critical applications and data, responsible personnel, and procedures for data backup, recovery, and emergency-mode operations. The Security Rule requires data backup, disaster recovery, and emergency-mode operation plans; testing and revision procedures and applications-and-data criticality analysis are addressable implementation specifications. 45 CFR § 164.308

• Keep current plan versions, assigned roles, contact and escalation procedures, and records showing how critical oncology operations and ePHI will be protected during an outage.
• For contingency plan testing, retain the date, scope, systems and sites tested, participants, scenario, results, gaps, corrective actions, and evidence that corrective actions were completed. For backup and disaster recovery, keep evidence of backup completion and test results, including backup and restoration tests, issues, and resolutions.
• Maintain applicable Privacy Rule records, such as policies and procedures, workforce training documentation, complaints, and required documentation of disclosures or individual rights requests. Keep required HIPAA documentation for the applicable retention period, and check whether other rules require longer retention. 45 CFR § 164.530 and 45 CFR § 164.316

FAQs.

How often should a community oncology network review its HIPAA risk analysis?

HIPAA does not prescribe a universal schedule. Keep the process ongoing and review or update the analysis as needed, including after significant changes to systems, operations, or identified risks. Set a review cadence suited to the network’s environment and document the reasoning and updates. HHS risk analysis guidance

What records should support a HIPAA audit of business associates?

Keep the business associate inventory, signed BAAs or other applicable arrangements, vendor review records, and documentation of relevant follow-up. Where subcontractors handle ePHI on a business associate’s behalf, retain evidence that applicable contract or arrangement requirements are addressed. See 45 CFR § 164.314 and 45 CFR § 164.504.

How should a practice document a potential breach of protected health information?

Record the discovery and investigation, the PHI and people involved, mitigation, the breach notification assessment and its basis, and the decision about required notifications. If notification is not required, retain the assessment or other documentation supporting that conclusion. HHS Breach Notification Rule guidance

What evidence demonstrates that backup and disaster-recovery procedures have been tested?

Keep dated test plans and results that identify the systems and data covered, participants, recovery steps, whether data was successfully restored or operations resumed, issues found, and corrective actions with completion evidence. Also retain relevant backup records and current contingency plan versions. Testing and revision are addressable specifications, while data backup and disaster recovery plans are required. 45 CFR § 164.308

Audit readiness depends on organized, current evidence that reflects the network’s actual systems and practices. Keep risk analysis, remediation, policies, training, vendor, access, incident, physical safeguard, contingency, and privacy records together and maintain them for the applicable retention period.