HIPAA Audit Readiness Checklist for Disorders of Consciousness Programs

Use this checklist to organize the policies, records, and evidence your disorders of consciousness program may need to demonstrate how it protects electronic protected health information (ePHI). HIPAA obligations depend on whether your organization is a covered entity or business associate; confirm which rules apply to your organization and program. The checklist is an audit-preparation aid, not a certification or guarantee of compliance.

How to conduct and document an ePHI risk analysis

Start with an accurate, thorough assessment of risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI the organization creates, receives, maintains, or transmits. The HIPAA Security Rule requires a risk analysis but does not prescribe one format or a universal schedule. HHS guidance on risk analysis describes its scope, documentation, and ongoing nature.

• Define the scope: Include the program’s clinical systems and workflows, not only its primary electronic health record. Inventory ePHI in assessments, care plans, diagnostic imaging, EEG or other monitoring records, communications, workstations, portable media, backups, and systems operated by vendors, as applicable.
• Map where information moves: Document how staff create, view, transmit, store, and dispose of ePHI, including access by treating teams, authorized representatives, researchers where applicable, and business associates.
• Assess threats and vulnerabilities: Record relevant risks, existing safeguards, likelihood and potential impact, and how risks could affect confidentiality, integrity, or availability. Consider the program’s actual care environment, such as bedside access, shared work areas, and authorized clinical handoffs.
• Track risk decisions: Keep the assessment, risk ratings, chosen safeguards, unresolved risks, and a risk-management plan with accountable owners and target dates. Explain why a safeguard or alternative measure is reasonable and appropriate for the identified risk.
• Review and update: Revisit the analysis when operations, systems, vendors, workforce, or risks change, and after relevant incidents. HHS says the Security Rule does not specify a single frequency; the appropriate cadence depends on the organization and its environment.

Retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later. This is a retention rule for required documentation, not a universal retention period for clinical records or every system log. HHS’s Security Rule summary explains the documentation requirement and its six-year period.

Which administrative physical and technical safeguards should the checklist cover

Organize evidence across the Security Rule’s administrative, physical, and technical safeguards. The risk analysis should inform which measures are reasonable and appropriate for the organization; “addressable” implementation specifications are not simply optional. Document the rationale and any equivalent alternative measure where applicable. HHS’s Security Rule summary outlines the safeguard categories.

• Administrative safeguards: Keep current security policies, assigned security responsibility, workforce access-authorization procedures, security awareness and training records, incident-response procedures, periodic evaluations, and contingency plans.
• Physical safeguards: Document how facility and workstation access is controlled, how workstations and devices are used and secured, and how electronic media containing ePHI are handled, moved, reused, or disposed of.
• Technical safeguards: Maintain evidence of unique user identification, access controls, emergency access procedures, audit controls, integrity protections, authentication measures, and transmission-security decisions. Show how accounts and permissions are approved, changed, and removed.
• Role-based access: Check that access matches job responsibilities and is reviewed when duties change or employment ends. Apply the minimum necessary standard where it applies; it does not apply to disclosures to, or requests by, a health care provider for treatment purposes. HHS guidance on the minimum necessary requirement explains the standard and its exceptions.

For a disorders of consciousness program, consider whether safeguards reflect the actual use of clinical and monitoring records, shared work areas, mobile devices, and bedside workflows. Document how staff can access information needed for treatment while limiting access for other purposes to what is appropriate.

How to review audit logs and investigate inappropriate access

The Security Rule requires procedures to regularly review records of information-system activity, including audit logs, access reports, and security incident tracking reports. The rule does not set one universal review frequency for every organization. The HHS audit protocol identifies review policies, review records, timing, responsible personnel, and follow-up investigation as relevant evidence.

• Document which systems generate activity records, what activity they capture, and whether logging is enabled for systems containing or transmitting ePHI.
• Keep the written review procedure, assigned reviewer roles, review schedule, completed review records, and escalation criteria.
• Investigate patterns that appear inconsistent with assigned duties or approved access, such as unusual access times, repeated failed logins, unexpected exports, or access to records without an apparent work-related purpose.
• Record the alert or concern, systems and accounts examined, relevant timestamps, findings, evidence preserved, notifications or escalations, corrective action, and closure decision.
• Use a documented retention schedule for logs and access reports based on applicable requirements, operational needs, and risk. Do not assume the Security Rule’s six-year documentation period applies automatically to every raw log.

Keep review records legible and attributable to the reviewer. When an access concern becomes a security incident, link the log review to the incident record and subsequent investigation.

Which privacy notices and patient rights procedures should be documented

Keep the current Notice of Privacy Practices (NPP), the process for providing it, and records of required notices and acknowledgments. For covered health care providers with direct treatment relationships, HHS says the notice must generally be given no later than the first service delivery, with a good-faith effort to obtain written acknowledgment. HHS’s Notice of Privacy Practices guidance describes these requirements.

Document how the organization receives, routes, tracks, and responds to individual requests, including requests for access, amendment, accounting of disclosures, restrictions, and confidential communications. Maintain complaint procedures and records of complaints and their disposition.

For a patient who cannot exercise rights personally, verify the authority of the person making a request before disclosing records or accepting instructions. A family relationship alone does not always establish authority to act as a personal representative; the applicable authority generally depends on state or other law. HHS guidance on personal representatives explains this role and relevant exceptions.

Apply the minimum necessary standard to uses, requests, and disclosures where it applies, and document the organization’s policies. Do not use it to restrict provider-to-provider disclosures for treatment in situations where the standard does not apply.

How to prepare workforce policies training and sanction records

Keep current, written workforce policies and procedures that address appropriate ePHI access, security practices, privacy responsibilities, incident reporting, and sanctions for violations. Maintain records showing that workforce members received training on applicable policies and procedures, along with training content, dates, and completion records.

HIPAA requires security awareness and training for workforce members and appropriate sanctions for workforce members who violate privacy policies and procedures. It does not establish a universal annual certificate-renewal requirement. Document the organization’s training schedule and any additional employer-specific or role-specific instruction, such as procedures for bedside access, handling monitoring records, or responding to suspected inappropriate access. HHS’s Security Rule summary describes the training and sanctions requirements.

• Retain onboarding and refresher-training materials, attendance or completion records, and records of policy updates communicated to staff.
• Document access approvals, changes, periodic reviews, and termination or transfer procedures for workforce accounts.
• Keep the sanction policy and records showing that reported violations were reviewed and addressed consistently with applicable organizational procedures.

How to document incident response breach assessment and notifications

Maintain written procedures for identifying, reporting, responding to, mitigating, and documenting suspected or known security incidents. Keep an incident file for each event that records the report, timeline, systems and ePHI involved, investigation steps, impact, mitigation, outcome, and any corrective action.

For a potential impermissible use or disclosure of PHI, document the breach assessment and its conclusion. HHS explains that the assessment considers the nature and extent of the PHI, the unauthorized recipient, whether the information was actually acquired or viewed, and the extent to which risk was mitigated. HHS’s Breach Notification Rule guidance describes the assessment, exceptions, and notification obligations.

If a breach of unsecured PHI requires notification, document the notices and their dates, recipients, content, and method of delivery. Covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery; additional notice to HHS and, in certain cases, the media may be required. A business associate must notify the covered entity of a breach as required by the rule and its agreement. Record the decision and supporting rationale if the organization determines notification is not required.

For each incident, retain relevant audit logs, access reports, security incident tracking reports, communications, investigation notes, risk assessment, mitigation records, and evidence of any required notifications. Keep these materials organized so reviewers can trace the event from initial report through resolution.

How to assess business associates backups and disaster recovery

Inventory vendors and other business associates that create, receive, maintain, or transmit ePHI for the program. Keep each applicable business associate agreement (BAA), its effective dates, covered services, and records of review or renewal. A BAA must address appropriate safeguards and other required terms; it should also address reporting of security incidents and breaches and, where relevant, the business associate’s role in supporting individual rights. HHS’s sample business associate agreement provisions describe required contract terms.

Document how the program evaluates whether its arrangements protect ePHI, including any assurances or evidence requested under its own risk-management process. HIPAA does not expressly require every business associate to provide security documentation or permit a customer audit; contract terms may establish additional assurances. HHS’s guidance on cloud service providers explains this distinction.

• Identify which systems and records each business associate can access, and confirm that applicable subcontractors are addressed through required agreements.
• Keep evidence of backup procedures and successful restoration tests, including the systems, data, date, results, and follow-up actions.
• Maintain the contingency plan, including data backup, disaster recovery, and emergency mode operation procedures. Document testing and revision procedures and criticality analysis where applicable; these specifications have different implementation designations under the Security Rule. HHS’s ransomware fact sheet summarizes contingency-planning components.
• Record recovery responsibilities, communication steps, and how authorized staff will maintain access to necessary ePHI during an outage or other disruption.

In short, audit readiness means keeping a current risk analysis, showing that safeguards and access reviews are implemented, documenting workforce and incident procedures, and maintaining clear evidence for vendors and recovery plans.

FAQs

How often should a disorders of consciousness program review its ePHI risk analysis?

HIPAA does not prescribe a fixed annual interval. Review and update the analysis as needed based on your organization’s environment, including significant operational or technology changes, new risks, vendor changes, and relevant security incidents. Document the review and why the chosen cadence fits the program. HHS risk analysis guidance discusses ongoing review and notes that frequency varies.

What audit logs and access records should the program retain?

Retain the activity records needed to support your documented review process, such as audit logs, access reports, and security incident tracking reports. Keep the procedures for reviewing them, review records, escalations, investigations, and outcomes. The Security Rule’s six-year period applies to required documentation; it does not automatically set a retention period for every raw log.

What documentation should be available for business associate safeguards?

Keep applicable BAAs, a record of the services and ePHI involved, relevant subcontractor arrangements, and evidence or assurances requested under your own risk-management process. Depending on the relationship, useful records may include incident-reporting procedures, safeguard summaries, backup and recovery information, and responses to identified concerns. HIPAA does not expressly require every business associate to provide security documentation or permit audits, so specify any additional evidence expectations in the agreement where appropriate.

Which HIPAA records should be reviewed after a security incident?

Review relevant audit logs, access reports, security incident records, risk analysis and management documentation, workforce access and training records, applicable BAA terms, investigation notes, mitigation records, and any breach assessment and notification documentation. Record which materials were reviewed, what they showed, and how the findings informed the response and any corrective actions.