HIPAA Audit Readiness Checklist for Insurance Navigator and Assister Organizations

Before preparing for a HIPAA audit, confirm whether your organization is actually subject to HIPAA. Insurance navigators and assisters may also have privacy and security duties under Marketplace agreements, federal rules, state law, or grant terms—even when HIPAA does not apply to them.

Determine whether HIPAA applies to your organization

Being an insurance navigator or assister does not automatically make your organization a HIPAA covered entity or HIPAA business associate. HIPAA covered entities are health plans, health care clearinghouses, and certain health care providers. A business associate generally performs specified services for a covered entity that involve protected health information (PHI). Review HHS guidance on covered entities and business associates and the applicable agreements before deciding which HIPAA requirements apply.

• Identify each legal entity involved in your work, its role, and the organization or program it serves.
• Determine whether the entity is a covered entity, performs a business associate function, or is neither. Handle each role separately if your organization performs multiple functions.
• Review contracts, grant terms, Exchange agreements, and state requirements. For example, Exchange privacy and security standards can apply to certain non-Exchange entities that access Exchange-submitted personally identifiable information or handle it while performing agreed Exchange functions. See 45 CFR § 155.260.
• Document the basis for your determination, the person who approved it, and the date it was reviewed. Revisit it when services, contracts, data flows, or organizational relationships change.

Marketplace consumer information may be subject to privacy and security requirements even if it is not PHI governed by HIPAA. CMS’s Marketplace privacy and security guidelines explain how applicable agreement terms govern assister handling of consumer information.

Assign privacy and security responsibilities and maintain policies

If HIPAA applies, assign and document responsibility for privacy and security compliance. Maintain written policies that reflect your organization’s actual services, systems, workforce, and applicable obligations. HHS describes Security Rule requirements for policies, documentation, and business associate arrangements in its Summary of the HIPAA Security Rule.

• Name the people responsible for privacy, security, compliance, incident escalation, and vendor oversight. One person may hold multiple roles if that fits your organization, but responsibilities should be clear.
• Maintain current procedures for handling PHI and electronic protected health information (ePHI), granting access, safeguarding paper and electronic records, responding to incidents, and addressing complaints.
• Document who approves policy changes and how staff are told about changes that affect their work.
• Keep separate or clearly cross-referenced procedures for non-HIPAA duties, such as Marketplace agreement requirements, state privacy rules, grant conditions, and consumer notices.
• Retain documentation that HIPAA requires for at least six years from its creation or the date it was last in effect, whichever is later. Other laws or agreements may require different or longer retention periods.

Inventory PHI and ePHI and document risk assessments

Create a current inventory of the information your organization collects, receives, creates, maintains, or shares. Follow each data flow from the consumer interaction through storage, access, disclosure, retention, and disposal. Include both electronic and paper records, as well as information handled by vendors or subcontractors.

• Record the types of information involved, its source, purpose, location, authorized users, recipients, retention period, and disposal method.
• Identify devices, applications, email accounts, file-sharing tools, paper files, removable media, and systems used by staff working remotely or at temporary assistance sites.
• If HIPAA applies, complete and document a Security Risk Analysis that identifies risks to the confidentiality, integrity, and availability of ePHI, evaluates their likelihood and impact, and links identified risks to corrective actions.
• Track each corrective action with an owner, priority, target date, status, and evidence of completion. HHS explains that the risk analysis must be documented and should be an ongoing process, but the Security Rule does not set one universal review frequency. See HHS guidance on risk analysis.
• Reassess risks when significant changes occur, such as a new system or vendor, a security incident, a change in services, or staff turnover affecting key responsibilities.

Verify workforce training and role-based access

Provide workforce training for staff and volunteers on the rules that apply to their roles, including your organization’s own policies and the privacy or security terms in applicable agreements. If HIPAA applies, covered entities must train workforce members as necessary and appropriate for their functions; training should be documented. HHS’s HIPAA audit protocol identifies training records as evidence reviewers may examine.

• Keep a roster of staff, volunteers, contractors, and other workforce members who handle sensitive information, along with their roles and training dates.
• Provide onboarding and role-specific training, and document additional training when relevant policies or job duties change.
• Do not treat an annual certificate renewal as a universal federal HIPAA requirement. Set refresher intervals according to applicable rules, agreements, organizational policy, and identified risks.
• Use role-based access so each person can access only the information and systems needed for assigned duties. Where the HIPAA minimum necessary standard applies, covered entities generally must make reasonable efforts to limit access and certain uses or disclosures to what is needed for the purpose; exceptions apply. See HHS guidance on the minimum necessary standard.
• Retain access approvals and periodic review records. Remove or change access promptly when someone changes roles or leaves.

Review privacy practices and consumer data protections

Check that your real-world practices match your written policies and the rules governing each data set. Consumer-facing processes should make it clear what information you collect, why you need it, how it will be used or shared, and how it will be protected. Applicable Marketplace standards include limits on collection, use, and disclosure, safeguards, and accountability; see 45 CFR § 155.260 and CMS’s Marketplace privacy and security guidelines.

• Review intake forms, privacy notices, consent or authorization processes, websites, messaging practices, and scripts used during consumer assistance.
• Collect only information needed for the stated assistance purpose, and share it only with authorized recipients through approved channels.
• Verify identity and authority before discussing or disclosing sensitive information. Avoid leaving sensitive details in voicemail, email subject lines, or messages visible to others.
• Secure paper records during appointments and transport, prevent unauthorized viewing of screens, and use appropriate procedures for secure disposal.
• Check that practices for access, correction, complaints, retention, and destruction are consistent with the laws and agreements that apply to your organization.

Test technical safeguards vendor controls and incident response

Where HIPAA applies, assess administrative, physical, and technical safeguards for ePHI, including access controls, authentication, audit controls, transmission security, device security, backups, and contingency procedures. The Security Rule allows safeguards to be tailored to the organization’s circumstances, but they should address reasonably anticipated risks.

• Test whether access is restricted to authorized users, activity can be reviewed, backups can be restored, and lost or compromised devices can be addressed promptly.
• Inventory vendors that create, receive, maintain, or transmit PHI for a covered entity or business associate. Determine the vendor’s role before deciding whether a Business Associate Agreement is required; not every supplier is a business associate. HHS explains these relationships and written contract requirements in its business associate guidance.
• Review relevant contract terms, including permitted uses, safeguards, incident reporting, subcontractors, return or destruction of information, and cooperation with investigations.
• Maintain an incident-response procedure that identifies who receives reports, who investigates, how access is contained, how evidence is preserved, and who makes notification decisions.
• For a suspected impermissible use or disclosure of unsecured PHI, document the breach notification assessment. If relying on a low probability of compromise, assess at least the nature and extent of the PHI, the unauthorized recipient, whether the information was actually acquired or viewed, and the steps taken to mitigate risk. HHS summarizes these factors in its Breach Notification Rule guidance.
• Test the response process through a tabletop exercise or other practical review, and record gaps and follow-up actions. HIPAA security incident procedures require regulated entities to respond, mitigate harmful effects where practicable, and document incidents and outcomes; see HHS guidance on security incident procedures.

Organize audit evidence and corrective actions

Keep evidence organized so you can show not only that a policy exists, but also that it is implemented, reviewed, and updated when needed. Organize records by requirement or process, limit access to the audit files, and avoid placing unnecessary consumer information in evidence packets.

• Prepare your HIPAA applicability analysis, contracts, policies, role assignments, data inventory, Security Risk Analysis, risk-management plan, training records, access approvals, vendor agreements, and incident records, as applicable.
• Keep examples of privacy notices, intake forms, consent or authorization records, disposal records, system access reviews, backup tests, and incident-response exercises.
• For every identified gap, document the risk, planned action, accountable owner, due date, progress, and evidence that the action was completed or the risk was otherwise addressed.
• Track which requirements arise from HIPAA and which arise from Marketplace agreements, state law, or other program terms, so you can respond accurately to the scope of a review.

A well-organized readiness file connects each applicable obligation to the policy, practice, and evidence that support it. Confirm the organization’s legal role first, then keep risk reviews, safeguards, training, vendor oversight, and corrective actions current.

FAQs.

Are insurance navigator organizations automatically subject to HIPAA?

No. Navigator or assister status alone does not make an organization a HIPAA covered entity or business associate. HIPAA applicability depends on whether the organization meets a covered-entity definition or performs a business associate function involving PHI. Separate Marketplace privacy and security requirements may still apply through federal rules or an Exchange agreement. See HHS’s covered entity and business associate guidance and 45 CFR § 155.260.

What evidence should an assister organization have ready for a HIPAA audit?

If HIPAA applies, prepare records that show your organization’s role determination, current policies, assigned privacy and security responsibilities, Security Risk Analysis and corrective actions, workforce training, access controls, vendor agreements, incident procedures, and relevant audit or access reviews. If HIPAA does not apply, prepare evidence required by the applicable Exchange agreement, grant terms, state law, or other review scope rather than describing those requirements as HIPAA obligations.

How often should an organization review its HIPAA risk assessment?

The HIPAA Security Rule does not specify a single review interval. HHS says risk analysis should be ongoing and updated as needed, including when changes such as new technology, a security incident, or organizational changes could affect ePHI. Choose a review cadence suited to your environment and reassess when material changes occur. See HHS guidance on risk analysis.

What should an organization document after a suspected data breach?

Record when and how the incident was discovered, what information and individuals may be affected, who may have accessed or received the information, whether it was acquired or viewed, containment and mitigation steps, investigation findings, and the basis for notification decisions. If HIPAA applies, document the breach notification assessment and any required notifications—or the reason notification was not required. Follow applicable Exchange, state, contractual, or grant reporting requirements as well. See HHS breach notification guidance.