HIPAA Audit Readiness Checklist for Employed Physician Groups

How to document and update the HIPAA risk analysis

The HIPAA Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Begin with an electronic protected health information (ePHI) inventory that identifies where ePHI is created, received, maintained, or transmitted—including clinical and billing systems, diagnostic images, email, mobile devices, remote access, cloud services, and paper-to-electronic workflows that lead to ePHI. HHS OCR’s Guidance on Risk Analysis

For each relevant system, location, or workflow, retain evidence showing how the group considered threats, vulnerabilities, likelihood, and potential impact. The risk analysis does not need to use a prescribed template, but it should be sufficiently detailed to explain the risks identified and how the group reached its conclusions. 45 CFR § 164.308

• Record the scope, participating departments, responsible officials, and date of the assessment.
• Document systems and data flows, including vendor-hosted platforms and remote work arrangements.
• List identified risks, their prioritization, existing safeguards, and planned corrective actions.
• Track each remediation item to an owner, target date, status, and documented decision if risk is accepted or work is deferred.
• Keep prior versions and evidence of approval so reviewers can follow how the program changed.

Risk analysis is ongoing, but HIPAA does not set one universal annual schedule for completing a full analysis. Establish a review cadence that fits your environment, and reassess when changes—such as new technology, acquisitions, clinic moves, major staffing changes, or security incidents—could affect ePHI risks. HHS OCR’s guidance on periodic review and updates

Which HIPAA policies and records should be audit-ready?

Maintain current, approved policies and procedures that reflect how your group actually operates. Organize the material so that the responsible staff can find and use it, and preserve evidence of implementation—not just policy documents. The Security Rule requires covered entities to maintain written or electronic policies and required action records, review documentation periodically, and update it as needed when relevant environmental or operational changes occur. 45 CFR § 164.316

For an employed physician group, a well-organized audit file commonly includes:

• Privacy and security policies, including versions, approval dates, and assigned privacy and security responsibilities.
• The risk analysis, risk-management plan, security evaluations, and corrective-action records.
• Workforce training records, access authorization records, and applicable sanction documentation.
• Security incident and breach files, including investigation and notification decisions.
• Business associate agreements (BAAs), vendor records, and relevant contract amendments.
• Contingency plans, backup and restoration evidence, and records of testing or revision.
• Privacy complaints and their disposition, where applicable.

Required Security Rule documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. The Privacy Rule has a similar six-year requirement for its required documentation. These HIPAA documentation periods do not establish how long every medical record must be kept; other state and federal requirements may apply to clinical records. 45 CFR § 164.316 and 45 CFR § 164.530

How to verify workforce training and access authorization

Keep a reliable roster of workforce members, including employed physicians, clinical and administrative staff, temporary workers, trainees, and others who meet HIPAA’s workforce definition. Compare it with training records to confirm that required Privacy Rule training was provided, including to new workforce members within a reasonable period and to staff whose functions are affected by material policy changes. The Security Rule also requires a security awareness and training program for all workforce members. HIPAA does not impose a universal annual training or certificate-renewal requirement; follow applicable law, employer policy, and any other requirements that apply to your group. 45 CFR § 164.530 and 45 CFR § 164.308

For each role, be ready to show how access is requested, approved, changed, and removed. Maintain records that connect access rights to job duties, such as approved access requests, role assignments, periodic reviews, and evidence that access was removed when a physician or staff member left or changed roles. The Security Rule requires appropriate workforce access and procedures for terminating access when employment or another arrangement ends. 45 CFR § 164.308

Apply the minimum necessary standard where it applies by defining reasonable, role-based access that limits unnecessary exposure of PHI. Use clinical and operational judgment when setting access; the standard is not an absolute restriction and does not replace professional judgment or treatment needs. HHS guidance on the minimum necessary standard

Which technical and physical safeguards should you document?

Build an evidence set showing how administrative, technical, and physical safeguards protect ePHI across the group’s systems and locations. Safeguards should reflect the group’s risk analysis and the nature of its work, including in-person care, shared workstations, telehealth, remote access, and systems managed by a parent organization or vendor.

• Technical safeguards: Document user identification and access controls, emergency access procedures, audit-log capabilities and review, authentication, integrity protections, and transmission safeguards. Retain relevant configuration records, access reviews, sample audit-log reviews, and documented follow-up to unusual activity. 45 CFR § 164.312
• Physical safeguards: Keep facility and workstation procedures, access or visitor controls where used, and records for device and media handling, disposal, and reuse. Document how the group restricts unauthorized access to workstations that can access ePHI. 45 CFR § 164.310
• Administrative safeguards: Maintain security responsibilities, risk-management decisions, security incident procedures, and records of periodic information-system activity review. 45 CFR § 164.308

For safeguards described as “addressable” in the Security Rule, document how your group assessed whether the implementation specification was reasonable and appropriate, whether it was implemented, and—if not—why not and what reasonable alternative measure was used, if appropriate. Addressable does not mean optional without assessment.

How to review business associate agreements and oversight

Maintain a current inventory of vendors and service providers that create, receive, maintain, or transmit PHI on the group’s behalf, and determine whether each relationship requires a business associate agreement (BAA). Keep executed agreements and amendments together with the vendor record, including the services provided, the data involved, and the relevant group contact.

Check that each required BAA addresses permitted uses and disclosures, safeguards, incident and breach reporting, applicable individual-rights support, subcontractors, and the return or destruction of PHI when the agreement ends where feasible. HHS sample business associate agreement provisions

For audit readiness, make it easy to show that agreements are in place before relevant PHI is shared and that staff know how to report vendor incidents. A structured review of vendor changes, contract terms, and available security information can help the group manage risk, but HIPAA does not generally require covered entities to monitor the specific methods business associates use to carry out safeguards. If the group becomes aware of a material contractual violation, it must take reasonable steps to address it and, if unsuccessful, terminate the arrangement when feasible. HHS guidance on business associate oversight

How to prepare incident response and breach documentation

Keep written procedures for reporting, triaging, investigating, mitigating, and documenting suspected or known security incidents. Make sure employed physicians and staff know how to report a lost device, misdirected message, suspicious access, or other concern promptly, and preserve relevant logs and communications for investigation.

For each event, retain a clear timeline and record the systems and PHI involved, the people or parties affected, how the issue was discovered, containment and mitigation steps, and the outcome. If an impermissible use or disclosure may have involved unsecured PHI, document the breach risk assessment or the applicable exception and the rationale for the group’s decision. HHS identifies the nature and extent of the PHI, the unauthorized recipient, whether the information was actually acquired or viewed, and mitigation as factors in the assessment. Keep evidence of required notifications or the basis for determining that notification was not required. HHS Breach Notification Rule guidance

Keep incident-response and breach files organized so that the group can demonstrate its investigation, mitigation, and notification decisions. Where a business associate is involved, retain its report and the group’s follow-up, and make sure the BAA’s reporting terms support timely coordination.

How to test backup and disaster recovery plans

Document a contingency plan that covers retrievable copies of ePHI, restoration of lost data, and continued protection of ePHI during emergency operations. The Security Rule requires data backup, disaster recovery, and emergency-mode operation plans. It also identifies testing and revision procedures and applications-and-data criticality analysis as addressable implementation specifications. 45 CFR § 164.308

• List the systems and data the group needs to restore, including clinical, scheduling, billing, imaging, and communications systems.
• Document backup responsibilities, storage locations, restoration procedures, and emergency access processes.
• Test restoration and emergency workflows periodically, then retain the date, scope, participants, results, and identified gaps.
• Track corrective actions to completion and revise procedures when tests, incidents, or operational changes reveal a need.

Testing a backup job alone may not demonstrate that the group can restore usable data and continue critical care operations. HHS recommends periodically testing restorations to verify backup integrity and recovery capability. HHS guidance on ransomware and HIPAA

In short, audit readiness depends on a complete risk analysis, current policies, verifiable workforce and vendor records, documented safeguards, and evidence that response and recovery plans work in practice. Keep the records organized, assign owners to gaps, and update the evidence as the group’s operations change.

FAQs

How often should an employed physician group update its HIPAA risk analysis?

HIPAA does not prescribe a single fixed frequency for a full risk analysis. The process should be ongoing, with updates when environmental or operational changes may affect ePHI security—for example, new technology, changes in services or locations, or a security incident. Set a review cadence suited to the group’s environment and document the rationale and updates. HHS OCR’s risk analysis guidance

How long should HIPAA audit documentation be retained?

Required Security Rule documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later. The Privacy Rule also requires six-year retention for its required documentation. Separate rules may set different retention periods for medical records. 45 CFR § 164.316 and 45 CFR § 164.530

What records should a physician group maintain for business associates?

Maintain a current vendor inventory, documented determinations about whether a relationship requires a BAA, executed agreements and amendments, and records of relevant vendor incidents and the group’s follow-up. The BAA should address required safeguards, permitted uses and disclosures, reporting, applicable subcontractor obligations, and what happens to PHI at termination where feasible. HHS sample business associate agreement provisions

What evidence should be available for a HIPAA breach investigation?

Keep the incident timeline, the PHI and systems involved, the parties who accessed or received the information, investigation and mitigation records, and the group’s written breach risk assessment or documentation of an applicable exception. Also retain copies of required notices or the documented basis for deciding notice was not required. HHS Breach Notification Rule guidance