HIPAA Audit Readiness Checklist for Federally Qualified Health Center Networks

What does a HIPAA audit cover for an FQHC network?

A HIPAA audit may review selected requirements of the Privacy, Security, and Breach Notification Rules. The scope depends on the entity and requirements being examined; an FQHC network should be ready to show how its policies work in practice across the locations, systems, and workforce members within scope. The HHS OCR audit protocol outlines the kinds of documents and implementation evidence auditors may review.

Start by confirming which legal entities and locations are included, who has responsibility for shared services, and where ePHI is created, received, maintained, or transmitted. A network-wide view should account for central functions and local workflows, including systems and vendors that serve multiple sites. Keep a current ePHI data flow inventory showing systems, interfaces, users, storage, transmission routes, and responsible owners.

Organize evidence so reviewers can trace each policy or risk finding to implemented safeguards and records. A central evidence index can point to shared documents while identifying any location-specific procedures or exceptions. OCR’s protocol notes that requested documents should be provided in response to specific requests, rather than relying on auditors to search through large policy compilations.

How should the network document its ePHI risk analysis and remediation?

Maintain a documented Security Rule risk analysis that covers ePHI throughout the network, including data held or handled by vendors. HHS says the analysis should assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI an organization creates, receives, maintains, or transmits. Its risk analysis guidance explains that the Security Rule does not prescribe one methodology or format.

For each identified risk, record the affected system or workflow, relevant threats and vulnerabilities, likelihood and impact assessment, existing safeguards, and the decision about additional measures. Link findings to a corrective action plan that names an accountable owner, priority, target date, interim controls where appropriate, and evidence of completion or approved acceptance. HHS guidance describes documenting risk levels and corrective actions, then using risk-analysis results to inform risk management.

Keep the analysis current as operations, technologies, locations, and threats change. HIPAA does not set a fixed annual interval for every organization’s risk analysis; HHS describes the process as ongoing and says frequency varies with the entity’s circumstances. Document periodic reviews as well as reviews prompted by significant changes, incidents, or newly identified risks.

Which HIPAA policies and records should be ready for review?

Maintain current, approved policies and procedures that address the safeguards applicable to the network, together with records showing that required actions and assessments occurred. Depending on the audit scope, useful evidence may include risk analyses and evaluations, risk-management decisions, access-management records, incident records, training documentation, contingency-plan testing, and records of policy approvals and updates. The HHS Security Rule summary describes the administrative, physical, and technical safeguard requirements.

Use a controlled repository or index that identifies each record’s owner, applicable entity or site, version, approval date, and review or retention information. Separate binding regulatory requirements from the network’s own policy commitments: if a policy promises a particular review cadence or process, be prepared to show how the organization followed it.

The Security Rule’s documentation standard requires written policies and procedures and written records of required actions, activities, or assessments. It also requires six-year Security Rule retention: retain required documentation for six years from its creation or the date it was last in effect, whichever is later. This period applies to documentation required by the Security Rule; it should not be described as a universal retention rule for every type of medical or business record. See 45 CFR § 164.316 in the HHS Security Rule text.

How can the network demonstrate workforce training and accountability?

Keep records showing that workforce members received training relevant to their responsibilities and applicable policies. Training evidence can include assigned materials, completion dates, attendance records, acknowledgment of policies, and documentation of follow-up for incomplete training. The Security Rule requires a security awareness and training program for all workforce members; the Privacy Rule also requires appropriate training on privacy policies and procedures. HHS’s audit protocol describes reviewing training policies and evidence of implementation.

HIPAA does not establish one universal annual certificate-renewal schedule. Set and document training intervals in line with applicable rules, organizational policies, workforce roles, and changes to systems or procedures. Keep evidence that new workforce members and people affected by material policy changes receive appropriate training within the organization’s established process.

Maintain a consistent way to document reported violations, investigations, corrective coaching, and sanctions when applicable. Limit access to personnel records and provide auditors only the relevant evidence requested, with appropriate safeguards for confidential information.

How should business associates and vendors be assessed?

Maintain an inventory of business associates and relevant subcontractors that create, receive, maintain, or transmit ePHI for the network. For each relationship, track the services provided, ePHI involved, responsible internal owner, contract dates, and the applicable business associate agreement (BAA). HHS explains that HIPAA requires covered entities and business associates to have written arrangements that address applicable privacy and security obligations; see the HHS business associate guidance.

As practical oversight evidence, retain completed vendor assessments, security documentation reviewed, identified issues, follow-up requests, and decisions about whether safeguards are appropriate to the service and risk. These records help show how the network manages vendor risk, but do not imply that HIPAA universally requires covered entities to monitor every detail of a business associate’s security operations. HHS says a covered entity generally is not required to oversee the means by which a business associate implements safeguards; if it learns of a material breach or violation of the agreement, it must take reasonable steps to cure the breach or end the violation, and terminate the arrangement if those steps fail. See the HHS FAQ on business associate oversight.

Confirm that agreements address permitted uses and disclosures, safeguards, incident and breach reporting, subcontractors, and return or destruction of ePHI when the relationship ends, as applicable. Keep amendments and renewal records with the current agreement so staff can quickly identify the governing terms.

What technical safeguard evidence should each location maintain?

Each location should be able to identify the ePHI systems and devices it uses and show how network-wide controls apply locally. Maintain or have readily accessible current user and role lists, access approval and termination records, device and system inventories, and evidence that unique user identification and emergency access procedures are implemented where applicable.

Preserve samples of audit log review and the related procedures, including review dates, systems covered, reviewer or responsible role, investigated anomalies, and follow-up. The Security Rule requires mechanisms to record and examine activity in systems containing or using ePHI, and procedures to regularly review system-activity records. HHS’s audit protocol identifies audit logs, access reports, and security incident tracking reports as examples of evidence that may be reviewed.

Keep evidence appropriate to the network’s risk analysis and safeguards, such as configuration or control records for access, encryption decisions and implementation, transmission security, backup and restoration, physical protections, and contingency procedures. The Security Rule’s encryption specifications are addressable, not simply optional: document the assessment and, if encryption is not reasonable and appropriate, the rationale and any equivalent alternative measure adopted. The HHS Security Rule text sets out the technical safeguard standards.

How should incident response and breach notification procedures be tested?

Keep written procedures for identifying, reporting, containing, and responding to suspected or known security incidents, including how local staff escalate issues to network leadership. Preserve incident logs, investigation notes, mitigation steps, decisions, and post-incident reviews. The Security Rule requires covered entities to respond to and document security incidents and their outcomes.

Use periodic exercises to check whether staff know whom to contact, decision-makers can access the information needed to assess an event, and the network can coordinate across affected locations and vendors. Retain the exercise scenario, attendance, results, identified gaps, and follow-up actions. These exercises are a practical way to test readiness; do not present a particular exercise frequency as a universal HIPAA mandate.

For a suspected breach of unsecured PHI, document the assessment and decision, including the facts considered and any breach determination documentation. HIPAA generally presumes an impermissible use or disclosure is a breach unless an exception applies or a documented risk assessment demonstrates a low probability that the PHI was compromised. The HHS Breach Notification Rule guidance describes the assessment factors and documentation obligations.

Ensure procedures identify who coordinates required notifications and track applicable deadlines. Individual and, when required, media notices must be made without unreasonable delay and no later than 60 days after discovery; breaches affecting 500 or more individuals also require notice to HHS within that period. For breaches affecting fewer than 500 individuals, HHS notice may generally be submitted annually, no later than 60 days after the end of the calendar year in which the breaches were discovered. Keep copies of notices and proof of submission, or the assessment and documentation supporting a determination that notice was not required.

Audit readiness depends on a current network-wide view of ePHI, documented risk decisions and remediation, accessible records, trained and accountable staff, sound vendor agreements, and tested safeguards and incident procedures. Maintain evidence that connects written requirements to what each location and shared service actually does.

FAQs

How often should an FQHC network review its ePHI risk analysis?

HIPAA does not specify a fixed interval for every risk analysis. HHS describes risk analysis as an ongoing process whose frequency depends on the organization’s circumstances. Review it periodically and when material changes or new risks could affect ePHI; document the review and resulting decisions. See HHS guidance on risk analysis.

What HIPAA documentation should each network location maintain?

Each location should be able to identify its systems, devices, workflows, and local responsibilities involving ePHI, and access the relevant network policies and procedures. Keep or be able to retrieve applicable local evidence, such as workforce training and access records, audit-log review records, incident escalations, and contingency procedures. A central repository can hold shared documentation if records clearly show which locations and entities they cover.

How long must Security Rule documentation be retained?

Retain documentation required by the Security Rule for six years from its creation or from the date it was last in effect, whichever is later. This is the Security Rule documentation period under 45 CFR § 164.316(b)(2)(i), not a universal retention period for all records. See the HHS Security Rule text.

What evidence should an FQHC network keep for business associate oversight?

Keep a current business associate inventory, executed BAAs and amendments, service and ePHI descriptions, internal relationship owners, vendor assessments, relevant security documentation reviewed, identified issues, and follow-up decisions. These records can demonstrate the network’s oversight process. HHS clarifies that HIPAA generally does not require a covered entity to monitor the means by which a business associate implements safeguards, but reasonable steps are required if the covered entity learns of a material contractual breach or violation. See the HHS business associate oversight FAQ.