HIPAA Audit Readiness Checklist for County Public Health Clinics

A practical audit-readiness process helps your clinic show how it protects patient information, identifies security risks, and follows through on corrective actions. Use this checklist to organize evidence around your clinic’s actual systems, workforce, vendors, and public health operations—not just a collection of policies.

Determine HIPAA coverage and define the clinic’s organizational scope

Start by determining which county department or clinic functions are covered by HIPAA. A county public health department is not automatically covered simply because it is a government agency. A clinic generally must assess whether it operates as a health care provider that conducts covered electronic transactions, or whether another covered-entity basis applies. HHS explains that county health departments operating clinics may be covered providers when they conduct those transactions. See the HHS guidance on county and local health departments.

If the county performs both covered and non-covered functions, determine whether it has designated itself as a hybrid entity healthcare component. Document the designation, the units included in the healthcare component, the officials responsible for it, and how access or disclosures between components are controlled. A department-wide label alone does not establish the operational boundary: show which staff, facilities, systems, and services are within the component.

• Record the clinic’s covered-entity analysis, including the services and electronic transactions considered.
• Map organizational units, workforce roles, facilities, applications, vendors, and data flows that touch protected health information (PHI) or electronic protected health information (ePHI).
• Identify systems operated by the county’s central IT department and clarify who administers them and who is accountable for HIPAA safeguards.
• Keep documentation of any hybrid-entity designation and relevant healthcare-component boundaries with the clinic’s audit materials.

Document ePHI risk analysis and track remediation

The HIPAA Security Rule risk analysis must accurately and thoroughly assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Begin with an inventory of where the clinic creates, receives, maintains, or transmits ePHI, including electronic health records, laboratory and immunization systems, email, mobile devices, backups, cloud services, and removable media. HHS states that there is no single required risk-analysis method; the analysis should fit the organization’s size, complexity, and environment. Review the HHS Guidance on Risk Analysis and 45 CFR § 164.308.

For each important asset or data flow, record relevant threats and vulnerabilities, existing safeguards, likely impact, and how the clinic will address remaining risk. Include the county’s shared systems and third-party services where they store, transmit, or provide access to clinic ePHI. An assessment is not complete simply because risks are listed: connect identified issues to decisions, safeguards, and follow-up evidence.

• Keep the analysis dated and identify its preparers, reviewers, scope, methods, and systems covered.
• Maintain a remediation register with the risk, planned action, accountable owner, priority, target date, status, and evidence of completion or accepted disposition.
• Revisit the analysis when material changes occur, such as a new system, clinic service, vendor, facility, security incident, or significant change in threats or operations.
• Record why a safeguard or implementation option was selected, including the rationale and any equivalent measure when an addressable specification is not reasonable and appropriate for the clinic.

HIPAA does not prescribe one universal interval for repeating a comprehensive risk analysis. HHS describes risk analysis as an ongoing process and says frequency varies with the organization and its circumstances. Use a documented review schedule, and trigger reassessment when relevant changes or incidents warrant it; see HHS risk-analysis guidance.

Organize current policies and audit evidence

Make it easy to connect written procedures to what staff and systems actually do. Organize current security policies, procedures, approvals, and implementation records in a controlled repository. Assign an owner and review date to each document, retain prior versions as appropriate, and make current procedures available to the people responsible for carrying them out.

Build an evidence index that points to records without unnecessarily copying patient data into an audit folder. Useful evidence may include the risk analysis and remediation register, system and device inventories, access approvals, training records, activity-review records, incident files, vendor agreements, backup or recovery test records, and device-disposal documentation. Restrict the evidence repository to authorized users and protect any PHI it contains.

• Use a consistent naming convention and label each record with its date, owner, system or process, and applicable policy.
• Keep evidence that shows implementation—not only policy language—such as completed reviews, approvals, tickets, test results, and follow-up actions.
• Track policy changes and approvals so the clinic can show which version applied during a particular period.
• Check that audit evidence matches current clinic practices and that unresolved gaps are recorded rather than concealed.

The Security Rule requires covered entities and business associates to maintain required policies and documentation in written form, review and update documentation as needed, and retain it for the specified period. See 45 CFR § 164.316.

Verify workforce training and access oversight

Maintain records showing that workforce members receive security awareness and training appropriate to their work, along with any applicable privacy training and clinic-specific instruction. Include employees, temporary staff, volunteers, and other workforce members as relevant to their roles. Training completion certificates can support the record, but they do not establish that the clinic or county is HIPAA compliant. Federal HIPAA rules do not impose a universal annual certificate-renewal requirement; follow applicable requirements, your policies, and employer-specific training schedules.

Document how access is approved, changed, reviewed, and removed. Keep role or job-function access criteria, approvals for sensitive access, records of transfers and departures, and evidence that permissions were adjusted or disabled when no longer appropriate. The Security Rule requires workforce security measures and a security awareness and training program; see 45 CFR § 164.308.

• Maintain training dates, topics, assigned audiences, completion status, and follow-up for overdue or incomplete training.
• Show how personnel learn clinic-specific rules for handling ePHI, reporting incidents, using remote access, and working in shared or public-facing spaces.
• Retain access-request and approval records, periodic access-review results, and records of timely access changes after job changes or separation.
• Document applicable sanctions and corrective actions when workforce members fail to follow security policies.

Review access controls and system activity logs

Confirm that each system containing or using ePHI restricts access to authorized people and software. Evidence may include unique user-account settings, role-based permissions, authentication procedures, emergency-access processes, and the process for granting, modifying, and removing accounts. Shared accounts can make it harder to attribute activity to an individual, so document any approved exceptions and compensating controls.

HIPAA requires technical access controls and audit controls that record and examine activity in systems containing or using ePHI. It also requires procedures to regularly review information-system activity, including audit logs, access reports, and security incident tracking reports. See 45 CFR § 164.312 and 45 CFR § 164.308.

• List which ePHI systems generate activity records, what events they capture, and who can access or alter the logs.
• Document the clinic’s audit log review schedule, reviewer responsibilities, review scope, findings, escalation, and follow-up. HIPAA requires regular review, not one universal review interval for every clinic.
• Retain evidence of completed audit log review, such as dated review records, access reports, investigation tickets, and documented resolution of anomalies.
• Test whether the clinic can retrieve relevant logs promptly during an investigation and whether retention settings meet operational and applicable legal needs.

Document physical safeguards and device disposal

Review safeguards for clinic rooms, reception and records areas, server or network equipment, workstations, and devices used to access ePHI. Document how the clinic limits physical access, supervises visitors where appropriate, secures workstations, and protects equipment from theft, damage, and unauthorized use. These safeguards also apply to systems housed outside the clinic; see 45 CFR § 164.310.

Keep an inventory and custody trail for laptops, tablets, phones, removable media, and other hardware that may contain ePHI. Document approved procedures for device return, transfer, loss reporting, data removal, and final disposition. The Security Rule requires policies and procedures for disposing of ePHI and the hardware or media on which it is stored, and for removing ePHI before media are reused. HHS also explains that reasonable safeguards apply when disposing of PHI in any form; see the HHS guidance on disposal of protected health information.

• Retain disposal or sanitization records that identify the device or media, date, method, responsible person, and verification where available.
• Document controls for taking devices out of county facilities and for returning, reassigning, or retiring them.
• Review whether workstation placement and privacy protections reduce exposure to patients, visitors, and unauthorized staff.
• Include remote and off-site work arrangements in the review of device custody and physical safeguards.

Assess business associates and incident response

Identify vendors and other outside parties that create, receive, maintain, or transmit ePHI on the clinic’s behalf. Determine whether each is a business associate, document the services and information involved, and retain an executed business associate agreement when required. The agreement should address required safeguards and reporting of security incidents and breaches. HHS summarizes these obligations in its HIPAA Security Rule overview.

Do not treat a vendor’s security brochure or contract as a substitute for the clinic’s own risk management. Keep a current vendor inventory, agreements, relevant contact and escalation details, and records of follow-up on identified concerns. Where services or data flows change, review whether the agreement and the clinic’s risk analysis still match the arrangement.

Maintain a written incident process that explains how staff report suspected incidents, who triages them, how evidence is preserved, and how the clinic contains, investigates, and documents events. For a potential breach of unsecured PHI, document the decision process and any required notification. The Breach Notification Rule generally presumes an impermissible use or disclosure to be a breach unless an applicable exception applies or the covered entity demonstrates a low probability that the PHI was compromised through a documented breach risk assessment. See the HHS Breach Notification Rule guidance.

• Keep security incident documentation that records when and how the event was discovered, systems and information involved, actions taken, findings, and resolution.
• Document the breach risk assessment and its supporting facts when applicable, along with the rationale for notification decisions.
• Retain incident response exercises, lessons learned, corrective actions, and evidence that assigned actions were completed.
• Confirm that workforce members know how to report an event and that vendor agreements support required incident reporting and coordination.

Apply HIPAA documentation retention requirements

For documentation required by the Security Rule, the retention period is six years from the date the documentation was created or the date it was last in effect, whichever is later. This applies to required policies and procedures and to records of actions, activities, or assessments that the Security Rule requires the clinic to document. See 45 CFR § 164.316(b)(2)(i).

Do not confuse this Security Rule documentation period with a general HIPAA medical-record retention rule. HIPAA’s six-year requirement described here is for specified compliance documentation; state law, grant or program rules, county records schedules, contracts, and other obligations may set separate periods for medical records or other records. Check those requirements before setting a disposal date.

• Maintain a retention schedule that identifies the record category, applicable requirement, retention trigger, and authorized disposal process.
• Calculate the six-year period using the later of creation or the date a document was last in effect.
• Preserve documentation through audits, investigations, litigation holds, or other applicable requirements, even if a routine schedule would otherwise permit disposal.
• Ensure records remain accessible to personnel responsible for implementing the procedures they document, and update them when environmental or operational changes affect ePHI security.

In summary: Audit readiness depends on a clearly defined HIPAA scope, a current risk analysis with tracked remediation, evidence that safeguards operate in practice, documented vendor and incident processes, and retention controls that reflect the applicable rules.

FAQs

When is a county public health clinic subject to HIPAA?

A county clinic is subject to HIPAA when it meets the definition of a covered entity—for example, when it functions as a health care provider and conducts covered transactions electronically. A county department with both covered and non-covered functions may designate a healthcare component as a hybrid entity. See the HHS guidance on county and local health departments. Assess the clinic’s actual functions and organizational structure rather than assuming every public health activity is covered or exempt.

How often should a clinic reassess risks to ePHI?

The Security Rule does not specify one universal interval for a comprehensive risk analysis. The clinic should maintain an ongoing process, use a schedule suited to its environment, and reassess when material operational, technical, or threat changes occur. HHS gives additional context in its Guidance on Risk Analysis.

What evidence should a clinic retain for a HIPAA audit?

Retain the records needed to demonstrate both policies and implementation: the covered-entity or hybrid-entity scope analysis, risk analysis and remediation tracking, current policies, workforce training records, access approvals and reviews, audit log review records, physical safeguard and device-disposal evidence, business associate agreements, incident records, and applicable retention schedules. Organize evidence so authorized reviewers can locate it without exposing unnecessary patient information.

How long must HIPAA Security Rule documentation be retained?

Required Security Rule documentation must be retained for six years from its creation date or the date it was last in effect, whichever is later. This requirement applies to specified Security Rule compliance documentation and is not a general HIPAA medical-record retention period. See 45 CFR § 164.316; also check state, county, program, and other applicable retention requirements.