HIPAA Audit Readiness Checklist for Eating Disorder Treatment Centers

Use this checklist to organize evidence that your eating disorder treatment center protects patient information across clinical care, billing, technology, and facility operations. First confirm whether the center is a HIPAA covered entity or business associate: a health care provider is generally a covered entity if it conducts certain standard transactions electronically, such as electronic billing. The HHS overview of covered entities explains who must comply.

HIPAA does not create a separate category of protected health information (PHI) for eating-disorder treatment. However, identifying information about a patient’s treatment is sensitive, and psychotherapy notes that meet HIPAA’s specific definition receive additional protections. Use the steps below to check your safeguards and assemble supporting records.

How to map ePHI and document risk analysis and risk management

Start by identifying where your center creates, receives, maintains, or transmits electronic protected health information (ePHI). Include systems and workflows used for intake, assessments, diagnoses, treatment plans, meal plans, progress notes, weights, laboratory results, medication management, scheduling, billing, patient portals, email, backups, and referrals.

• Inventory electronic health record systems, billing platforms, devices, shared drives, messaging tools, backup systems, and removable media that may contain ePHI.
• Map how information moves among clinicians, dietitians, nurses, behavioral health staff, admissions teams, billing personnel, patients, and outside providers.
• Identify vendors and other external parties that create, receive, maintain, or transmit ePHI on the center’s behalf.
• Document reasonably anticipated threats and vulnerabilities, existing safeguards, the likelihood and potential impact of risks, and any gaps that need action.

The HIPAA Security Rule risk analysis must cover the confidentiality, integrity, and availability of all ePHI—not only information stored in the main EHR. HHS’s Guidance on Risk Analysis explains that organizations should identify ePHI, assess threats and vulnerabilities, and document the analysis. HIPAA does not prescribe one method for doing this.

Risk analysis identifies risks; risk management is the process of implementing safeguards to reduce them. Keep a risk register or equivalent record that connects each identified risk to an assigned owner, planned action, target date, and status. Revisit the analysis when technology, vendors, workflows, facilities, or known threats change, and conduct periodic evaluations rather than treating the assessment as a one-time task. HHS describes the distinction in its guidance on risk analysis and risk management.

How to review privacy practices and patient rights

Compare the center’s written privacy procedures with its actual handling of identifiable patient information. Review how staff communicate with patients and families, respond to requests, share information with other providers, and manage disclosures for care coordination, billing, and operations.

• Confirm that the Notice of Privacy Practices is current, provided as required, and available to patients who request it.
• Check how staff process requests for access to records, amendments, and accounting of disclosures, including requests involving records held by a vendor.
• Review authorization forms and procedures for disclosures that require patient authorization.
• Make sure staff know how to verify identity and authority before discussing a patient’s care with a family member, representative, or other third party.
• Review policies for secure conversations, printed documents, email, voicemail, patient portals, and group or family treatment settings.

The Privacy Rule’s minimum necessary standard generally requires reasonable steps to limit many uses, disclosures, and requests for PHI to what is needed for the purpose. It does not apply to disclosures to or requests by a health care provider for treatment, among other exceptions. Check that your policies explain when the standard applies and that role-based access control is used to support appropriate access—not as a substitute for understanding the rule. See HHS guidance on the minimum necessary requirement.

Patients generally have rights to access and request amendments to information in designated record sets, subject to limited exceptions. Psychotherapy notes are treated differently when they meet HIPAA’s definition: they must be maintained separately from the rest of the medical record, and access and disclosure rules differ. Ordinary clinical records, such as progress notes and treatment plans, do not become psychotherapy notes simply because they concern mental health treatment. Review HHS explanations of medical-record rights and HIPAA protections for mental health information.

How to verify role-based access controls and audit-log monitoring

Check whether each workforce member’s access matches their job duties and whether access is removed or changed promptly when a person changes roles or leaves the center. Role-based access control can help apply appropriate permissions, but HIPAA requires the center to establish and implement access controls that are reasonable and appropriate for its environment.

• Review user lists for the EHR, billing system, email, file storage, patient portal, and other systems containing ePHI.
• Confirm that each user has a unique account; avoid shared logins that prevent reliable attribution of activity.
• Check permissions for clinicians, dietitians, nurses, admissions, billing, IT administrators, temporary staff, and contractors.
• Verify that access is changed or terminated promptly after job changes, termination, leave, or contract end.
• Review emergency-access procedures and document how emergency access is controlled and monitored.

HIPAA requires audit controls: mechanisms that record and examine activity in information systems containing or using ePHI. Define how the center conducts a HIPAA audit log review, including which events are reviewed, who reviews them, how often reviews occur, how anomalies are escalated, and how findings are documented. Look for unusual access to patient records, access outside assigned responsibilities, repeated failed logins, bulk exports, and activity by privileged accounts. HHS summarizes the requirements for access controls and audit controls and provides review criteria in its HIPAA audit protocol.

Which policies, training records, and compliance documentation to maintain

Prepare a controlled set of current policies and records that shows how the center meets applicable Privacy, Security, and Breach Notification Rule requirements. Make sure staff responsible for carrying out a policy can access the current version, and retain evidence that required procedures are followed.

• Maintain privacy and security policies, including access management, device use, incident reporting, backups, contingency planning, disposal, and facility safeguards.
• Keep risk analyses, risk-management plans, periodic evaluations, access reviews, audit-log review records, and corrective-action documentation.
• Retain training materials and records showing who completed training, when it occurred, and how training relates to job responsibilities and center policies.
• Document sanctions and other responses to workforce policy violations, when applicable.
• Keep current business associate agreements and records of vendor reviews, incident reporting expectations, and relevant security responsibilities.

HIPAA requires workforce security awareness and training as reasonable and appropriate, but it does not establish a universal annual training certificate-renewal requirement. Centers should follow their own policies and any applicable obligations, and ensure staff understand the center’s procedures. A training completion certificate is evidence of training; it does not by itself establish that the organization is HIPAA-compliant.

Security Rule documentation generally must be retained for six years from its creation or from the date it was last in effect, whichever is later. This documentation rule is not a general HIPAA requirement to keep medical records for six years; state law and other applicable requirements may govern clinical-record retention. HHS explains the Security Rule’s documentation and retention requirements and clarifies that HIPAA does not set a general medical-record retention period in its FAQ on medical-record retention.

How to assess physical safeguards and facility access

Review how the center protects areas, devices, and media that may contain or provide access to ePHI. Physical safeguards apply to electronic information systems whether they are on-site or located elsewhere.

• Inspect reception areas, clinical workstations, nursing stations, records storage, medication areas, and rooms used for administrative work.
• Check whether screens are positioned or locked to limit unauthorized viewing, and whether printed records are secured when not in use.
• Review facility-access procedures, including staff credentials, visitor control, access to restricted spaces, and how access is removed when no longer needed.
• Confirm that devices and media are tracked when moved, repaired, reused, or disposed of.
• Review procedures for workstation security, maintenance, backup equipment, and secure disposal of paper and electronic media.

For an audit, retain relevant policies, inventories, visitor or access records where maintained, device-disposal documentation, and evidence of corrective actions. HHS describes the Security Rule’s physical safeguards, including facility access controls, workstation use, workstation security, and device and media controls.

How to investigate and document suspected breaches

Make sure staff know how to promptly report a suspected loss, misdirected message, unauthorized record access, stolen device, or other possible impermissible use or disclosure. Preserve relevant information, restrict further exposure where appropriate, and assign an investigator who can coordinate with privacy, security, clinical, and leadership teams.

For each incident, document when it was discovered, who reported it, what happened, which systems and records were involved, whose PHI may have been affected, who may have received or accessed it, and what containment or mitigation steps were taken. Keep a timeline of investigative steps, decisions, communications, and follow-up actions.

An impermissible use or disclosure of unsecured PHI is generally presumed to be a breach unless an exception applies or the center documents a risk assessment showing a low probability that the PHI was compromised. The HIPAA breach risk assessment must consider the nature and extent of the PHI, who used or received it, whether it was actually acquired or viewed, and the extent to which risk was mitigated. Document the reasoning and keep evidence of any required notifications—or why notification was not required. See HHS’s Breach Notification Rule guidance.

How to review business associates and eating-disorder treatment records

Inventory vendors and other outside organizations that handle PHI for the center. A business associate agreement (BAA) is generally required when a vendor performs a service on the center’s behalf that involves creating, receiving, maintaining, or transmitting PHI, subject to applicable HIPAA exceptions.

• Review EHR and billing vendors, cloud-storage providers, IT support, transcription services, document-destruction vendors, and other service providers that may access or maintain PHI.
• Confirm that each required BAA is signed before the vendor receives or accesses PHI, and that it describes permitted uses, safeguards, incident reporting, and relevant subcontractor responsibilities.
• Check whether vendors’ actual services and system configurations match the agreements and the center’s risk analysis.
• Distinguish vendors that handle PHI on the center’s behalf from vendors that merely sell software without access to PHI.

For example, a cloud provider that stores ePHI for a covered entity generally needs a BAA, even if the information is encrypted and the provider does not hold the decryption key. HHS provides guidance on cloud services and ePHI and a list of common examples in its business associates FAQ.

Eating-disorder treatment records may include identifiable information about intake, assessments, diagnoses, treatment plans, nutrition care, weights, laboratory results, medication, progress notes, referrals, and billing. When held by a covered entity or its business associate, these records may be PHI. Identify which records are electronic, where they are stored, who can access them, and whether any separately maintained psychotherapy notes meet HIPAA’s definition. In short, audit readiness depends on knowing what information the center handles, limiting and monitoring access appropriately, documenting its decisions, and following through on identified risks.

FAQs

Which eating-disorder treatment records are protected health information under HIPAA?

When a covered entity or its business associate holds individually identifiable information about a person’s health, care, or payment for care, it may be PHI. This can include eating-disorder assessments, diagnoses, meal or treatment plans, progress notes, laboratory results, medication records, referrals, and billing information. Separately maintained psychotherapy notes that meet HIPAA’s definition have distinct protections; not every mental health or treatment note qualifies as a psychotherapy note.

How often should a treatment center review its ePHI risk analysis?

HIPAA does not set a fixed annual schedule for completing a risk analysis. The center should keep its analysis current, review it periodically, and update it when changes in systems, vendors, workflows, facilities, or risks could affect ePHI. The analysis must remain accurate and thorough for the center’s environment.

What should a center document when investigating a suspected HIPAA breach?

Document the discovery and reporting timeline, facts of the incident, PHI and individuals potentially involved, who may have accessed or received the information, containment and mitigation steps, and investigative findings. If assessing whether a breach occurred, document the required risk-assessment factors, the decision and rationale, and any required notifications—or the basis for determining that notification was not required.

Which vendors need a business associate agreement?

Generally, a vendor needs a BAA when it creates, receives, maintains, or transmits PHI on the center’s behalf to perform a service or function. Examples may include a cloud provider storing ePHI, an EHR vendor with access to patient information, or an IT contractor whose support involves PHI access. A vendor that only sells software and has no access to PHI may not be a business associate; assess the vendor’s actual access and role rather than relying only on its product description.