HIPAA Audit Readiness Checklist for Hereditary Angioedema Centers

A hereditary angioedema (HAE) center may handle clinical records, family histories, treatment details, and registry data across multiple systems and organizations. Use this checklist to organize evidence of how your center determines its HIPAA obligations, protects electronic protected health information (ePHI), manages vendors, and responds to privacy or security incidents.

This is a practical readiness guide, not a certification or legal opinion. Confirm how the rules apply to your center’s legal structure, services, and data flows.

How does HIPAA apply to a hereditary angioedema center?

Being an HAE center does not, by itself, make an organization a HIPAA covered entity. A health care provider is generally a covered entity if it electronically conducts a transaction for which HHS has adopted a standard, such as certain billing or eligibility transactions. Health plans and health care clearinghouses are also covered entities. Check your organization’s structure and transactions, including those conducted through a billing service. HHS guidance on covered entities

A center may also act as a business associate when it handles protected health information (PHI) on behalf of a covered entity—for example, under an arrangement to perform certain services or health care operations. A research relationship alone does not automatically make a researcher a business associate; the permitted basis for sharing PHI depends on the specific activity and applicable HIPAA requirements. HHS guidance on research disclosures and business associate contracts

For audit readiness, document the center’s role and the reasoning behind it. Identify the covered entity, business associate, or other status of each participating organization, and note whether the HAE program is part of a larger health system or operates under separate arrangements. If HIPAA applies, map where identifiable information is created, received, maintained, or transmitted, including in the EHR, prescribing systems, shared drives, telehealth tools, and registries.

How to document an electronic protected health information risk analysis and remediation plan

The Security Rule requires an accurate and thorough electronic protected health information risk analysis to identify potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Risk management then requires implementing measures to reduce identified risks to a reasonable and appropriate level. 45 CFR § 164.308, Administrative Safeguards and HHS guidance on risk analysis

Keep the analysis specific to your center’s environment rather than relying on a generic form. A useful evidence file should show the systems and data considered, the method used to assess risks, the findings, and how the organization decided what to address. Include relevant HAE workflows, such as registry transfers, remote access, research coordination, and clinical communications.

• Inventory ePHI systems, applications, devices, storage locations, interfaces, and data flows, including vendor-hosted services and registry platforms.
• Record threats, vulnerabilities, existing safeguards, and potential effects on confidentiality, integrity, and availability.
• Document risk ratings and the basis for them, including who completed or reviewed the analysis and when.
• Maintain a remediation plan with an assigned owner, proposed action, target date, status, and reason for any delay or accepted risk.
• Keep evidence that completed actions were implemented and that remaining risks were reviewed.

Review and update the documentation when changes to systems, operations, vendors, or threats affect ePHI security. Retain Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later. 45 CFR § 164.316, Policies and Procedures and Documentation Requirements

Which administrative safeguards and workforce records should be ready?

Organize records that show how the center puts the HIPAA Security Rule administrative safeguards into practice. These include security management, assigned security responsibility, workforce security, security awareness and training, security incident procedures, contingency planning, and periodic evaluation. 45 CFR § 164.308, Administrative Safeguards

• Current security policies and procedures, with version history and evidence of review or updates.
• The designation of the security official and records showing relevant responsibilities.
• Role-based access approvals, access changes, and timely termination of access when a workforce member leaves or changes roles.
• Security training records, such as training dates, topics, and participation, alongside employer-specific policies and procedures staff are expected to follow.
• Sanction policy and records of how reported policy violations were handled, maintained with appropriate confidentiality.
• Incident response procedures, contingency plans, and evidence of relevant testing, evaluation, or corrective work.

Training records can help show that workforce members received applicable instruction, but a completion certificate does not establish that the organization is HIPAA compliant. HIPAA requires a security awareness and training program for workforce members; it does not establish a universal annual certificate-renewal requirement. Centers should document training that reflects their own policies, roles, systems, and applicable requirements.

How to verify physical and technical safeguards for clinical and registry systems

Check safeguards across the full environment, not just the main EHR. Include devices and applications used for HAE care, registry entry, research coordination, remote work, and communications with patients or families. The Security Rule addresses physical safeguards such as facility access, workstation use and security, and device and media controls. 45 CFR § 164.310, Physical Safeguards

For technical safeguards, prepare evidence of access controls, unique user identification, emergency access procedures, audit mechanisms, person or entity authentication, and transmission security. The HIPAA Security Rule audit controls require mechanisms that record and examine activity in systems containing or using ePHI. 45 CFR § 164.312, Technical Safeguards

• Review access lists for clinical and registry systems; confirm access aligns with staff roles and is removed when no longer needed.
• Show that unique user accounts are used and that the center reviews relevant access logs, reports, and security incident records.
• Check how the center protects workstations, mobile devices, paper records, and media during use, storage, transport, reuse, and disposal.
• Review backup and recovery procedures and how essential HAE workflows would continue during an emergency.
• Document the assessment and rationale for safeguards selected, including encryption. Encryption is an addressable implementation specification under the Security Rule, so the organization should assess whether it is reasonable and appropriate and document its decision and any alternative measure.

For registry systems in particular, verify who can view, enter, export, or change data; whether access is logged; and how data moves between the registry, the clinical record, and outside parties.

What privacy and patient-rights records may auditors request?

Depending on the review, an auditor may request evidence of privacy policies and notices, individual-rights workflows, complaint handling, and required documentation. The Privacy Rule gives individuals, subject to limited exceptions, a right to access PHI about them in a designated record set maintained by or for a covered entity. A designated record set may include more than the main medical record. HHS guidance on the right of access

• Current Notice of Privacy Practices and, where applicable, acknowledgments or records of good-faith efforts to obtain them.
• Policies for receiving and responding to access and amendment requests, including the responsible person or office.
• Records of requests, responses, permitted denials, and any required follow-up.
• Complaint intake and disposition records, and documentation of required privacy decisions or activities.
• Applicable policies for disclosures, authorizations, and accounting requests.

Identify whether registry records are part of a designated record set—for example, because they are used by or for the covered entity to make decisions about individuals. Coordinate with any business associate that holds records needed to respond to an individual’s request. Retain Privacy Rule documentation for the applicable six-year period. HHS summary of the HIPAA Privacy Rule

How to assess business associates, vendors, and hereditary angioedema registry data

Make a current list of organizations that create, receive, maintain, or transmit ePHI for the center, and determine whether each is a business associate or has another role. For business associates, retain the applicable business associate agreement (BAA) and confirm that it addresses permitted uses and disclosures, safeguards, incident reporting, subcontractors, and return or destruction of PHI where required. HHS guidance on business associate contracts

For each registry or vendor relationship, document what information is shared, the purpose, who may access it, and which agreement or permission supports the disclosure. Check that the agreement reflects how the service actually operates, including any subcontractors and any vendor use of data for other purposes.

Distinguish a limited data set from de-identified information. A limited data set remains PHI, excludes specified direct identifiers, and may be used or disclosed only for research, public health, or health care operations under a data use agreement that sets limits on use and disclosure. HHS guidance on limited data sets

By contrast, information that meets the HIPAA de-identification standard is no longer PHI under the Privacy Rule. HIPAA provides two methods: Safe Harbor and Expert Determination. Because an HAE registry may include rare diagnoses, family relationships, or unusual treatment histories, consider whether remaining details could identify someone when combined with other information. If a business associate de-identifies PHI on the center’s behalf, verify that the BAA authorizes that activity. HHS guidance on the HIPAA de-identification standard

How to document incident response and breach notification decisions

Keep an incident log and preserve evidence showing how the center detected, assessed, contained, and resolved suspected or known security incidents. Document the date discovered, systems and information involved, response steps, mitigation, communications, and corrective actions. The Security Rule requires covered entities and business associates to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and outcomes. 45 CFR § 164.308, Administrative Safeguards

When an impermissible use or disclosure of PHI occurs, document the HIPAA breach assessment. A breach is generally presumed unless an exception applies or the organization documents a risk assessment demonstrating a low probability that the PHI was compromised. The assessment must consider the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and the steps taken to mitigate risk. HHS guidance on the Breach Notification Rule

For a reportable breach of unsecured PHI, affected individuals must generally be notified without unreasonable delay and no later than 60 calendar days after discovery. A business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery, although the BAA may set a shorter reporting period. Document the notification decision, required notices, timelines, and evidence that notifications were made—or why they were not required. 45 CFR § 164.404, Notification to Individuals and HHS guidance on breach notification

Audit readiness depends on clear, current evidence: know which organizations and systems are in scope, document the electronic protected health information risk analysis and remediation, verify safeguards, maintain privacy and workforce records, review vendor and registry arrangements, and record how incidents are assessed and handled.

FAQs

Is a hereditary angioedema center always a HIPAA covered entity?

No. An HAE center is not automatically a covered entity because of its specialty. A health care provider generally qualifies if it conducts certain standard electronic transactions; a center may also have another role, such as business associate, depending on the services it performs and how it handles PHI. HHS guidance on covered entities

What evidence should a center retain for an electronic protected health information risk analysis?

Retain the analysis method, inventory of ePHI systems and data flows, identified risks and vulnerabilities, risk ratings, existing safeguards, remediation plan, assigned owners and dates, and evidence of follow-up. The documentation should reflect the center’s actual environment and be updated when relevant operational or environmental changes occur. HHS guidance on risk analysis and 45 CFR § 164.316

Is identifiable hereditary angioedema registry data protected health information?

It may be. When individually identifiable health information is created or received by a covered entity or business associate and relates to a person’s health, care, or payment for care, it may be PHI. A limited data set is still PHI; data that meets HIPAA’s de-identification standard is not PHI under the Privacy Rule. HHS guidance on de-identification

When must affected individuals be notified after a reportable breach?

For a reportable breach of unsecured PHI, a covered entity must generally notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The applicable rule also requires notification to HHS, and in some cases the media. HHS guidance on the Breach Notification Rule