HIPAA Audit Readiness Checklist for Health System Research Institutes

Which research records and HIPAA approvals should be ready for an audit?

First, confirm which organization or component is the HIPAA covered entity or business associate. A research institute is not automatically covered by HIPAA simply because it conducts health research; applicability depends on the entity’s status and the role it performs. See HHS’s guidance on covered entities and business associates.

For each study that uses or discloses protected health information (PHI), organize records by protocol and data flow. Keep the documents that show the institute’s authority to use or disclose the information, who approved that pathway, what information was involved, and whether the approval or permission applied during the period under review.

• HIPAA authorizations: Keep the versions used, evidence of signed authorizations where applicable, and records of expiration or revocation relevant to the study. An authorization must meet HIPAA’s requirements; research consent alone does not necessarily serve as a HIPAA authorization.
• HIPAA authorization waiver documentation: If the study relied on a waiver or alteration, retain the IRB or Privacy Board documentation, including the approval date, findings, description of the PHI needed, review procedure, and authorized signature. HHS describes these elements in its HIPAA and research guidance.
• IRB Privacy Board approval records: Keep the relevant determination and the records that identify which study, data, and period it covered. Do not treat general IRB approval as a substitute for a HIPAA authorization or waiver when one is required.
• Research data use agreements: For limited data sets, retain the signed agreement and the records identifying the data provided and the permitted uses. A limited data set is a distinct HIPAA pathway; a data use agreement is required for its research disclosure. See HHS’s research guidance on limited data sets.
• Study and disclosure records: Keep applicable protocol versions, data requests, approvals, data-transfer records, and documentation of how the PHI was prepared or provided. Include de-identification documentation when that was the basis for the data flow.

HIPAA does not require an IRB to review every stand-alone HIPAA authorization form. HHS explains the distinction between HIPAA authorization requirements and IRB review in its guidance for Institutional Review Boards. Check the applicable research and institutional requirements separately.

How should security risk analysis and remediation be documented?

Maintain a documented Security Rule risk analysis that covers all electronic PHI (ePHI) the regulated entity creates, receives, maintains, or transmits—including research systems, repositories, endpoints, and relevant vendor services. HHS says the analysis must assess potential risks and vulnerabilities to ePHI’s confidentiality, integrity, and availability, but does not prescribe a specific format or fixed schedule. See HHS guidance on risk analysis.

Make the record useful for tracing findings to action. It should identify the assessment’s scope and date, systems and data reviewed, relevant threats and vulnerabilities, existing safeguards, likelihood and impact assessments, assigned risk levels, and the people responsible for approval and follow-up.

Pair the analysis with risk-management evidence. For each finding, retain the planned safeguard or corrective action, owner, target date, status, supporting implementation evidence, and any documented decision to accept or further monitor residual risk. Keep prior assessments and updates so an auditor can see how changes, incidents, or new systems affected the institute’s decisions.

The HIPAA Security Rule requires an accurate and thorough risk analysis and risk management; HHS describes the expected documentation and the connection between findings and corrective actions in its risk-analysis guidance. Avoid presenting an assessment as complete if it omitted research systems or other ePHI locations.

Which privacy and security governance records should be maintained?

Keep current, approved policies and procedures alongside their approval dates, effective dates, revision history, and responsible owners. Organize records for privacy and security responsibilities, workforce access, incident response, sanctions, vendor arrangements, and research data handling so you can show how the institute’s written procedures were implemented.

Maintain evidence of assigned privacy and security responsibilities, management review, and required security evaluations. This may include meeting or approval records, evaluation results, action plans, and documentation showing how significant findings were addressed. HHS’s HIPAA Audit Protocol describes the kinds of policies, procedures, implementation records, and evaluations auditors may review.

Apply the HIPAA documentation retention rule to documentation the HIPAA Rules require: generally, retain it for six years from its creation or the date it was last in effect, whichever is later. This is not a blanket HIPAA retention period for every research or medical record; other legal, contractual, and institutional schedules may apply. Consult the documentation requirements in the HHS Audit Protocol and applicable record-retention rules.

What workforce training, access, and sanction evidence is required?

Retain records showing that workforce members received training appropriate to their roles and the institute’s privacy and security policies. Useful evidence includes training materials and version dates, assigned modules, completion records, onboarding records, and documentation of training or communications after relevant policy changes.

Do not assume federal HIPAA rules impose a universal annual certificate-renewal requirement. The Security Rule requires a security-awareness and training program, including periodic security reminders, and Privacy Rule training applies to workforce members as required by the rule. Training schedules should reflect applicable requirements, role risks, institutional policy, and material changes. HHS’s Security Rule summary describes the workforce training obligation.

Keep the sanction policy and evidence of how it is applied when workforce members fail to follow applicable policies. Where an issue occurred, retain the relevant review, decision, action, and closure documentation in accordance with internal policy and privacy safeguards.

For access, preserve approvals and role assignments, changes to access, and evidence that access is removed or adjusted when a person’s role changes or ends. These records help show that permissions match job responsibilities and that the institute follows its own access-management procedures.

How should business associate agreements and subcontractor safeguards be documented?

Keep an inventory of vendors and other organizations that may create, receive, maintain, or transmit PHI for the institute, and document the basis for each relationship. Where an organization is acting as a business associate, maintain the executed HIPAA business associate agreement (BAA), amendments, effective dates, and relevant termination records.

BAAs must address permitted uses and disclosures, safeguards, incident and breach reporting, and applicable subcontractor obligations, among other requirements. Keep evidence that subcontractors handling PHI are subject to the required protections. HHS summarizes required terms in its sample BAA provisions.

Do not assume every researcher receiving PHI needs a BAA. HHS says research disclosures do not automatically require one; the permitted pathway may instead involve an individual authorization, an IRB or Privacy Board waiver, or a limited data set with a data use agreement. Document the applicable pathway and agreement for each data flow. See HHS’s guidance on researchers and business associate contracts.

Which access controls and audit-log records should be available?

Be prepared to show how access to ePHI is authorized and limited to appropriate users. Maintain current user and role listings, access approvals, privileged-access records, and evidence of timely access changes or removals. Unique user identification is required so that user activity can be tracked; HHS explains this requirement in its guidance on user IDs.

Keep records showing that systems containing ePHI can generate audit records and that the institute regularly reviews relevant system activity. The Security Rule calls for audit controls and regular review of information-system activity, including audit logs, access reports, and security-incident tracking reports. See the HHS Audit Protocol.

For audit-control review evidence, retain the system and review period, reviewer and review date, process used, issues identified, escalation or investigation records, and the outcome or corrective action. The review schedule should be documented and appropriate to the institute’s systems and risks; do not imply HIPAA sets one universal review frequency.

How should incident response, contingency planning, and audit evidence be prepared?

Maintain incident-response procedures and records for suspected or confirmed security incidents. Keep the incident timeline, investigation steps, systems and information involved, containment and mitigation actions, and documented outcome. For an impermissible use or disclosure, preserve breach determination records that show whether notification was required, including the risk assessment or the basis for an applicable exception. HHS explains the documentation burden in its Breach Notification Rule guidance.

Keep contingency-plan documentation for emergency response, data backup, disaster recovery, and continued operation when systems containing ePHI are unavailable. Retain relevant plans, assigned responsibilities, test or exercise results, restoration evidence, and updates made after a test or event. The HHS Security Rule summary describes the contingency-planning requirements.

For audit preparation, create an organized index of the requested records, identify an owner for each request, preserve relevant versions and logs, and record what was supplied and when. Confirm the scope and submission method with the appropriate privacy, security, research, and legal contacts. Do not alter historical records or create backdated evidence; clearly label any index or explanation prepared after the request.

In short, audit readiness depends on being able to connect each research data flow to its HIPAA permission, each identified security risk to documented action, and each policy to evidence that it was followed. Keep the records organized, dated, and traceable so the institute can respond accurately and securely.

FAQs.

Which HIPAA research records should be provided during an audit?

Provide records responsive to the auditor’s request and applicable to the audit scope. Depending on the request, these may include authorizations, waiver documentation, IRB or Privacy Board records, research data use agreements, risk analyses, policies, training evidence, access records, audit-log reviews, vendor agreements, and incident or breach determination records. Coordinate the response with the institute’s privacy and security leads, and use the requested secure submission process.

What should an institute do if a requested record is unavailable?

Make and document a reasonable search, then promptly tell the audit contact which record is unavailable and why. Identify any related evidence that can be provided, explain the applicable retention or system limitation if known, and document the steps being taken to address the gap. Do not fabricate, backdate, or present a newly created explanation as a contemporaneous record.

Should the institute provide policy versions that were in effect on the audit-notification date?

Generally, yes, if the auditor requests them. The HHS Audit Protocol says that, unless otherwise specified, document requests concern versions in use as of the audit-notification date and the document request. Also preserve and provide relevant earlier versions when they apply to the audit period or are specifically requested.

What evidence shows that audit logs and access controls are reviewed?

Provide the applicable review procedures, system and user-access listings, and dated records showing who reviewed which logs or access records and for what period. Include findings, investigations, approvals, follow-up actions, and closure evidence. HHS’s Audit Protocol identifies review procedures, audit logs, access reports, and evidence of access reviews as records that may be examined.