HIPAA Audit Readiness Checklist for Hospital-Owned Physician Networks

A hospital-owned physician network should be able to show not only that it has HIPAA policies, but also that it applies them across the people, systems, clinics, and vendors handling protected health information. Use this checklist to assemble evidence and identify gaps before an audit or investigation.

Start by confirming which legal entity or entities operate the network and which workforce, locations, and systems fall within the audit scope. Hospital ownership alone does not establish that every affiliate has the same HIPAA status or responsibilities; document how the hospital and physician network divide them.

How should a network document its ePHI risk analysis and remediation plan?

Maintain a current ePHI system and asset inventory that covers the network’s clinical and administrative environments. Include applications, endpoints, servers, cloud services, interfaces, medical devices that store or transmit ePHI, and relevant third-party systems. Record system owners, business purpose, ePHI handled, connections, locations, and the safeguards in place.

The HIPAA Security Rule risk analysis must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. The Security Rule does not prescribe a specific template, but the record should show the analysis’s scope and method, identified threats and vulnerabilities, likelihood and impact judgments, and resulting risk ratings. HHS explains that an inventory of systems and applications may be part of the assessment and that risk analysis informs risk management. See the HHS guidance on risk analysis and the HHS explanation of risk analysis and risk management.

Connect each material finding to a documented decision: remediation, risk reduction through other safeguards, or an approved decision to accept residual risk. For corrective actions, capture the responsible owner, priority, target date, interim controls, approval, and evidence of completion or follow-up. Record why a proposed safeguard was selected or why an alternative was reasonable for the network’s circumstances.

• Keep dated versions of the inventory, assessment, findings, and remediation plan.
• Link remediation tickets, configuration changes, test results, and management approvals to the relevant findings.
• Reassess when material changes or new information affect risk, and document periodic evaluations of whether safeguards remain appropriate.

HIPAA requires the risk analysis to be documented but does not prescribe a single format or a universal calendar interval. The network should be able to explain how its review process identifies when an update is needed. See HHS risk analysis guidance.

Which HIPAA policies and audit records must the network maintain?

Keep current, approved policies and procedures that address the HIPAA Privacy, Security, and Breach Notification Rules as applicable to the network. Include version history, approval and effective dates, the roles responsible for implementation, and records showing how the policies are communicated and applied.

For Security Rule documentation, retain written policies and procedures and records of required actions, activities, or assessments for six years from the date of creation or the date the document was last in effect, whichever is later. This is a HIPAA documentation period—not a universal retention schedule for medical records. Other federal or state requirements, contracts, litigation holds, or hospital policies may require longer retention. See the HHS Summary of the HIPAA Security Rule.

Organize audit materials so a reviewer can trace the requirement to the evidence. Depending on the applicable safeguards and the network’s processes, records may include:

• Risk analyses, remediation plans, periodic evaluations, and approvals.
• Security and privacy policies, procedures, and revision histories.
• Workforce security, training, access authorization, and sanction records.
• Audit control log review records, access reports, incident tracking, and follow-up actions.
• Facility, workstation, device, and media-control records.
• Business associate agreements, vendor reviews, and subcontractor records.
• Incident investigations, breach decisions, notifications, and contingency-plan exercises.

Maintain a secure evidence index that identifies each record’s owner, date, covered system or location, and retention or disposition rules. HHS’s HIPAA audit protocol describes the kinds of policies, procedures, and implementation evidence auditors may review.

How can the network verify workforce training and role-based access?

Keep evidence that the network provides a security awareness and training program to all workforce members, including management. Useful records include training materials, assigned courses, completion dates, attendance, acknowledgments, and make-up training. Retain evidence of security reminders and training updates when systems, threats, or workforce responsibilities change.

The Security Rule requires a training program, but it does not establish a universal annual certificate-renewal requirement. Set training frequency and content in the network’s own policies based on its risk, workforce roles, and applicable obligations. A completion certificate documents training; it does not by itself establish that the organization is HIPAA-compliant. See the HIPAA Security Rule text.

For role-based access, preserve records showing how access is requested, approved, provisioned, changed, and removed. Evidence should connect each user to an authorized role and the systems and data that role needs. Include onboarding, transfers, leave, termination, emergency access, and changes in clinical duties.

Keep role-based access review evidence such as dated user and privilege reports, reviewer sign-offs, identified exceptions, and tickets showing that unnecessary access was corrected. The Security Rule calls for policies and procedures to establish, document, review, and modify access rights. Set a review cadence appropriate to your risk and document how the network handles exceptions and urgent changes. See the HIPAA Security Rule text.

What evidence demonstrates effective technical and physical safeguards?

Map the safeguards relevant to each ePHI system to supporting evidence. Technical evidence may include access-control settings, unique user identification, authentication configurations, audit-control settings, transmission protections, and security-monitoring records. Document how the safeguards operate and which systems or environments they cover.

Retain samples or reports demonstrating that the network regularly reviews records of information-system activity, such as audit logs, access reports, and security-incident tracking. A useful audit control log review record identifies the system and period reviewed, reviewer, review method, anomalies found, escalation, and resolution. Logs alone do not demonstrate that the required review process is operating. See the HIPAA Security Rule text.

Document physical protections for facilities, workstations, and devices that can access ePHI. Evidence may include facility-access procedures and logs, workstation-use and security rules, device and media controls, secure disposal or reuse records, and procedures for equipment removal or repair. Tailor evidence to the network’s clinics, shared hospital spaces, remote-work arrangements, and device workflows.

Where a Security Rule implementation specification is addressable, document the network’s assessment and the decision to implement it, use an equivalent measure where appropriate, or explain why neither is reasonable and appropriate in its circumstances. “Addressable” does not mean optional without assessment. See the HHS Summary of the HIPAA Security Rule.

How should the network manage business associates and vendor risk?

Maintain a business associate agreement inventory that identifies vendors and subcontractors that create, receive, maintain, or transmit ePHI on the network’s behalf, the services they provide, the systems or data involved, agreement status, responsible business owner, and review dates. Confirm which organization is responsible for each relationship when the hospital and physician network share vendors.

When a vendor meets HIPAA’s definition of a business associate, a written business associate agreement is generally required before the vendor performs the relevant service involving PHI. The agreement should address permitted uses and disclosures, safeguards, incident and breach reporting, subcontractors, access to records, and return or destruction of PHI where applicable. HIPAA also recognizes circumstances in which a business associate agreement is not required, so assess the actual relationship rather than relying only on a vendor’s label. See the HHS guidance on business associates.

Keep due-diligence and oversight records that support the network’s vendor risk decisions, such as security assessments, identified gaps, mitigation plans, contract reviews, and follow-up. Revisit the relationship when services, data flows, subcontractors, or risks change. A signed agreement is important evidence, but it does not replace the network’s own risk analysis and oversight.

How should incidents, breach decisions, and recovery plans be documented?

For each suspected or confirmed security incident, retain a clear timeline and investigation record: how the event was detected, systems and accounts involved, ePHI potentially affected, containment steps, evidence preserved, people notified internally, and corrective actions. The Security Rule requires covered entities to identify and respond to security incidents, mitigate harmful effects where practicable, and document incidents and outcomes. See the HIPAA Security Rule text.

For a potential breach of unsecured PHI, document the assessment and the basis for the decision, including whether an exception applies or whether the assessment supports a low probability that PHI was compromised. If notification is required, retain copies and dates of notices, affected-person counts, evidence of submission to HHS and any required media notices, and records of delivery or other notification steps. HHS states that covered entities must document that required notifications were made or why notification was not required. Individual notice is generally due without unreasonable delay and no later than 60 days after discovery; reporting requirements also depend on the number of affected individuals. See the HHS Breach Notification Rule guidance.

Include business associate communications in the incident file. A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; the agreement may set a shorter reporting deadline. Record when the network was notified, what information was received, and how the parties coordinated investigation and notifications. See HHS business associate guidance and the HHS Breach Notification Rule guidance.

Maintain a contingency plan covering data backup, disaster recovery, and emergency operations for systems containing ePHI. Preserve evidence of backup and restoration tests, results, issues, corrective actions, and plan updates. Contingency plan restoration testing should show whether critical data and services can be restored as intended, not merely that a test was scheduled. See the HIPAA Security Rule text.

A strong audit file brings these records together: current risk analysis and remediation, approved policies, workforce and access evidence, safeguard reviews, vendor oversight, incident decisions, and tested recovery plans. Keep the evidence organized, attributable, and consistent with how the network actually operates.

FAQs

How long must a hospital-owned physician network retain HIPAA audit documentation?

For documentation required by the HIPAA Security Rule, retain it for six years from its creation date or the date it was last in effect, whichever is later. This period is not a general HIPAA medical-record retention rule. Other laws, contracts, litigation holds, or organizational policies may require longer retention. See the HHS Summary of the HIPAA Security Rule.

What evidence should support an ePHI risk analysis and remediation decisions?

Keep the system and asset inventory, assessment scope and method, identified threats and vulnerabilities, likelihood and impact analysis, risk ratings, and dated findings. For each decision, retain the remediation owner and deadline, interim controls, approvals, rationale for accepted residual risk, and evidence that completed actions were tested or otherwise verified. See HHS risk analysis guidance.

When does a physician network need a business associate agreement with a vendor?

Generally, the network needs a written agreement when the vendor qualifies as a business associate and creates, receives, maintains, or transmits PHI on the network’s behalf. Determine the vendor’s actual function and data access, and assess any applicable exceptions; not every vendor relationship requires an agreement. See HHS business associate guidance.

What records should document a HIPAA incident investigation and breach notification decision?

Keep the event timeline, investigation findings, systems and PHI involved, containment and mitigation, evidence preserved, and communications with relevant parties. For the breach decision, retain the assessment and its rationale, including why notification was required or why it was not. If notices are required, keep copies, recipient and submission records, and dates. See the HHS Breach Notification Rule guidance.