HIPAA Audit Readiness Checklist for Independent Medical Billing Companies

A practical HIPAA audit readiness checklist helps an independent medical billing company show how it protects electronic protected health information (ePHI), manages vendors, trains its workforce, and responds to security incidents. The specific HIPAA duties that apply depend on the company’s role and the services it performs. A billing company handling protected health information (PHI) for a covered entity will commonly act as a business associate and must meet applicable HIPAA requirements.

Use the sections below to organize evidence and identify gaps. HIPAA compliance is an ongoing process—not a one-time audit exercise—so keep records current when your systems, workforce, vendors, or operations change. HHS guidance on ongoing Security Rule compliance.

How to inventory ePHI systems and assess security risks

Start with a current inventory of where your company creates, receives, maintains, or transmits ePHI. Include billing and practice-management platforms, clearinghouse connections, email, file-transfer tools, cloud storage, backups, workstations, mobile devices, and remote-access services. Record each system’s purpose, the types of information it handles, who can access it, and which vendors support it.

Use this inventory as the foundation for a documented Security risk analysis. Identify reasonably anticipated threats and vulnerabilities, assess the likelihood and impact of risks to ePHI, and record how you will address each risk. HHS says a risk analysis may include an inventory of systems and applications used to access or store ePHI; the analysis must be documented, but HIPAA does not prescribe a specific format. HHS guidance on risk analysis and system inventories and HHS risk analysis guidance.

• Document the systems, devices, locations, and workflows that handle ePHI.
• Identify threats and vulnerabilities, including misdirected claims, compromised credentials, ransomware, lost devices, and vendor outages.
• Record risk ratings, existing safeguards, planned corrective actions, responsible owners, and target dates.
• Revisit the analysis when significant changes occur, such as adopting a new billing platform, changing a vendor, or introducing remote work.

HIPAA does not set a universal annual schedule for conducting a risk analysis. HHS describes the process as ongoing and says the appropriate frequency depends on the organization’s environment and circumstances. HHS risk analysis guidance.

Which HIPAA policies and audit documents should billing companies maintain

Maintain written policies and procedures that reflect your actual operations and the HIPAA requirements applicable to your role. For a billing company acting as a business associate, organize documentation covering security risk analysis and risk management, workforce access, security incident response, contingency planning, training, vendor relationships, and the handling of PHI under client agreements. Keep approved versions, review dates, and records of material updates together.

Prepare a document index so you can locate evidence quickly. Depending on your operations and obligations, it may include:

• Current and prior risk analyses, risk-management plans, and corrective-action tracking.
• Security policies, procedures, and records showing reviews or updates.
• Business associate agreements (BAAs), subcontractor agreements, and vendor review records.
• User access approvals, access reviews, termination records, and relevant system logs.
• Workforce training materials and completion records.
• Security incident reports, investigations, mitigation steps, and breach determinations.
• Contingency plans and records of relevant backup, restoration, or continuity tests.

Keep the scope clear: HIPAA’s six-year documentation rule applies to required Security Rule policies and procedures and to required actions, activities, or assessments—not automatically to every business record or every patient record. HHS summary of Security Rule documentation requirements.

How to verify business associate agreements and vendor oversight

Keep an up-to-date list of clients and vendors that create, receive, maintain, or transmit PHI for your company. For each relationship, document what PHI is involved, what services are provided, and whether a written BAA or other required written arrangement is in place. Check that agreements are signed, current, and consistent with the actual services and data flows.

When a subcontractor handles PHI on your behalf, HIPAA generally requires you, as the business associate, to obtain written assurances that the subcontractor will apply the required restrictions and safeguards. This can include relevant cloud, IT-support, document-management, and claims-processing vendors. HHS guidance on business associates and subcontractors.

Check that agreements address permitted uses and disclosures, safeguards, incident and breach reporting, subcontractors, and what happens to PHI when the relationship ends. Keep evidence of practical vendor oversight—such as review dates, relevant security materials, issue tracking, and follow-up—alongside the agreements. HHS provides sample business associate agreement provisions; use them as a reference, not as a substitute for checking the needs of your specific relationship.

How to review user access and technical safeguards

Review who can access each system containing ePHI and whether each person’s permissions match their job duties. role-based access control is a useful way to organize permissions by work function, but the key is to grant only appropriate access and remove or change it promptly when someone changes roles or leaves.

Check for unique user accounts, documented approvals, timely account deactivation, and regular reviews of active and privileged accounts. HIPAA’s Security Rule requires unique user identification for users of systems containing ePHI, enabling activity to be identified and tracked. HHS guidance on unique user identification.

Review technical safeguards such as audit logging, authentication, secure transmission, backups, and access controls. Multifactor authentication can help reduce risks, particularly for remote or sensitive access, but HIPAA does not prescribe MFA as the specific authentication method for every organization. Determine safeguards through your risk analysis and document your decisions. HHS guidance on authentication and multifactor authentication.

• Sample accounts and confirm access aligns with current job responsibilities.
• Review logs for suspicious access or unusual activity, and record how issues are investigated.
• Confirm procedures exist for emergency access and for reporting access problems.
• Check that remote access, backups, and data transfers are covered by documented safeguards.

How to document workforce HIPAA training

Maintain a training process suited to your workforce, including managers, employees, and other workforce members who handle ePHI. Keep the training materials, the topics covered, the date of completion, and records identifying who completed the training. For billing staff, content should address the PHI they handle, secure claims workflows, appropriate system use, privacy, security, and how to report suspected incidents.

HIPAA’s Security Rule requires a security awareness and training program for all members of the workforce, including management. Keep evidence that your program is delivered and updated as appropriate. HHS Security Rule overview.

Do not treat a training completion certificate as proof that the organization is HIPAA-compliant. Training should also reflect your employer’s procedures and client-specific requirements. HIPAA does not establish a universal annual certificate-renewal requirement; follow your organization’s training schedule and applicable policies, and document updates or refresher training when warranted.

How to prepare for incident and breach response reviews

Keep a written process for reporting, investigating, and documenting suspected or known security incidents. A review file should show when the issue was identified, who handled it, what ePHI may have been involved, what containment and mitigation steps were taken, and how the incident was resolved. Preserve relevant communications, system logs, and decisions.

If an incident may involve a breach of unsecured PHI, document the assessment and the notification decisions. A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovery; the BAA may require a shorter reporting deadline. HHS sample BAA provisions and breach-reporting terms and HHS Breach Notification Rule guidance.

Keep breach notification documentation showing either that required notifications were made or why notification was not required. HHS notes that documentation may include a risk assessment demonstrating a low probability that PHI was compromised or evidence that an exception to the definition of breach applied. HHS guidance on breach notification documentation.

How to organize audit evidence and meet HIPAA retention requirements

Store audit evidence in a controlled, searchable location with access limited to authorized personnel. Use a document index that identifies each record, its owner, its date, the systems or processes it covers, and its retention deadline. Keep related evidence together—for example, a risk analysis with its corrective-action records, or a vendor agreement with supporting review documentation.

Under the Security Rule, required documentation must generally be retained for six years from the date it was created or the date it was last in effect, whichever is later. Apply this HIPAA documentation retention rule to the required policies, procedures, actions, activities, and assessments it covers. Other legal, contractual, or business requirements may call for different retention periods for other records. HHS summary of the six-year documentation rule.

Before an audit or client review, check that records are complete, current, legible, and accessible to the people responsible for implementing the relevant procedures. A well-maintained inventory, documented risk decisions, signed agreements, access reviews, training records, and incident files make it easier to demonstrate how your company protects ePHI and responds to issues.

FAQs

How often should an independent medical billing company conduct a HIPAA risk analysis?

HIPAA does not specify a universal interval such as once a year. HHS describes risk analysis as an ongoing process; review and update it as needed based on your environment, risks, and operational changes. HHS risk analysis guidance.

What HIPAA records should a medical billing company have ready for an audit?

Organize the records that apply to your role and operations, including risk analyses and corrective actions, security policies and procedures, BAAs and subcontractor agreements, access reviews, training records, and incident and breach documentation. Keep an index so you can quickly identify the records relevant to a particular system or process.

How long must HIPAA audit documentation be retained?

Required Security Rule documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later. This rule does not automatically set the retention period for every business record or patient record. HHS Security Rule documentation guidance.

Do medical billing companies need business associate agreements with subcontractors?

When a subcontractor creates, receives, maintains, or transmits PHI on behalf of a medical billing company acting as a business associate, the billing company generally must obtain written assurances through a subcontractor agreement that satisfies HIPAA’s requirements. HHS business associate guidance.