HIPAA Audit Readiness Checklist for Intermediate Care Facilities for Individuals with Intellectual Disabilities

Use this checklist to organize evidence that your intermediate care facility for individuals with intellectual disabilities (ICF/IID) protects residents’ protected health information (PHI). HIPAA applicability depends on the organization’s role and activities, so first confirm whether your facility is a covered entity, business associate, or both.

Which HIPAA rules apply to ICF/IID facilities?

An ICF/IID is not automatically a HIPAA covered entity just because it provides residential or health-related services. A health care provider is generally covered if it conducts specified electronic transactions, such as electronic claims, itself or through another organization. A facility may also be a business associate when it handles PHI on behalf of a covered entity. Check the facility’s operations and contracts against HHS guidance on covered entities and business associates.

If your facility is a covered entity, the HIPAA Privacy Rule governs permitted uses and disclosures of PHI and individuals’ privacy rights. The HIPAA Security Rule applies to electronic protected health information (ePHI), requiring administrative, physical, and technical safeguards. The HIPAA Breach Notification Rule addresses notifications after a breach of unsecured PHI. Review the applicable rules and assign responsibility for each area.

• HIPAA Privacy Rule: Confirm written privacy procedures, workforce training, a designated privacy official, and processes for residents’ rights and complaints. The rule’s minimum necessary standard generally requires reasonable limits on PHI use and disclosure, with exceptions such as disclosures for treatment. See HHS’s Privacy Rule summary.
• HIPAA Security Rule: Identify where the facility creates, receives, maintains, or transmits ePHI, then assess and manage risks to its confidentiality, integrity, and availability. See HHS Security Risk Analysis guidance.
• HIPAA Breach Notification Rule: Maintain procedures to assess incidents involving PHI and determine whether notifications are required. See HHS Breach Notification Rule guidance.

Keep HIPAA obligations distinct from state privacy and record-retention laws, Medicaid or other program requirements, and facility licensing rules. Those requirements may apply independently or require additional protections.

How should the facility assess privacy and security risks?

Start with an accurate inventory of PHI and ePHI: where it is stored, who can access it, how it moves between staff and providers, and which vendors handle it. Include resident records, medication and care systems, email, mobile devices, backups, paper files, and information managed by service providers.

Conduct and document a Security Risk Analysis that assesses potential threats and vulnerabilities affecting the confidentiality, integrity, and availability of all ePHI. HHS does not prescribe a single method or a fixed schedule; its guidance says the analysis should be ongoing and updated as circumstances change. A new system, security incident, ownership change, or significant staffing or operational change may warrant reassessment. See HHS guidance on risk analysis and periodic review.

For each identified risk, document its potential impact, likelihood, existing safeguards, and the decision about whether more controls are needed. Maintain a risk management plan that identifies corrective actions, responsible owners, deadlines, and how the facility will verify completion. The risk analysis identifies risks; risk management implements measures to reduce them, as explained in HHS’s explanation of risk analysis and risk management.

What documentation should be ready for an audit?

Organize records so the facility can show both its written procedures and how it puts them into practice. Prepare a secure, current set of documents that may include:

• Current privacy and security policies, procedures, and any applicable notice of privacy practices.
• The ePHI inventory, Security Risk Analysis, risk management plan, and evidence that identified actions were completed or tracked.
• Workforce training records, privacy and security official designations, and documentation of sanctions or incident responses where applicable.
• Access-control policies, user access lists, account-change records, and relevant system or incident records.
• Business associate agreements and relevant vendor or subcontractor records.
• Incident and breach notification documentation, including investigation findings, notification decisions, mitigation, and any notices sent.
• Records showing that required policies and safeguards were reviewed and updated after relevant changes.

HIPAA requires covered entities and business associates to retain specified Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later. The Privacy Rule also has documentation retention requirements. That does not mean HIPAA sets a universal six-year retention period for every resident’s medical record; other laws or program rules may govern clinical-record retention. See HHS’s Security Rule documentation requirements.

How can staff training and access controls be verified?

Keep records showing that workforce members received training appropriate to their duties and the facility’s policies. Include employees and other workforce members whose conduct is under the facility’s direct control, such as volunteers or trainees where applicable. Training should explain how staff handle resident information, report suspected incidents, and follow facility-specific procedures. HIPAA requires training as necessary and appropriate; it does not establish a universal annual certificate-renewal requirement. See HHS’s Privacy Rule summary.

Compare each user’s system access with current job responsibilities. Check that accounts are authorized, updated when duties change, and disabled when access is no longer needed. Document how the facility assigns access and handles access reviews. The Security Rule requires access controls and appropriate safeguards, while the facility’s particular methods should reflect its environment and documented risk analysis.

For resident-care workflows, distinguish access needed for treatment from other uses and disclosures. The Privacy Rule’s minimum necessary standard generally applies to many uses and disclosures, but it does not apply to disclosures to or requests by a health care provider for treatment. See HHS guidance on the minimum necessary requirement.

How should business associate agreements be reviewed?

List vendors and other organizations that create, receive, maintain, or transmit PHI on the facility’s behalf, then determine whether each relationship requires a business associate agreement (BAA). Depending on the facility’s coverage status and role, it may have obligations as a covered entity, a business associate, or both. A vendor’s general claim of being “HIPAA compliant” does not replace a required written agreement.

For each applicable BAA, confirm that it is signed, current, and consistent with the services actually provided. Check that it addresses permitted uses and disclosures, safeguards for PHI and ePHI, reporting of impermissible uses or disclosures and breaches, access to relevant records for HHS oversight, subcontractor protections, and return or destruction of PHI when the relationship ends where feasible. HHS outlines required agreement provisions in its business associate contract guidance.

Also verify that the facility has a process for responding to a known material breach or violation of an agreement. HHS says a covered entity must take reasonable steps to cure the problem or end the violation and, if unsuccessful, terminate the relationship when feasible; if termination is not feasible, it must report the problem to HHS. See HHS guidance on business associate violations.

What steps should the facility take after identifying a compliance gap?

Record the gap, the rule or policy involved, the evidence reviewed, and the residents or systems potentially affected. Assign an accountable owner and a target date, then prioritize fixes based on risk to PHI and the facility’s operations. Update the risk management plan and track corrective actions until the facility verifies that they are complete and effective.

If the gap involves a suspected incident, follow the facility’s response procedure promptly: contain the issue where possible, preserve relevant records, investigate what happened, and document the facts and decisions. Assess whether an impermissible use or disclosure of unsecured PHI occurred and whether an exception or a low-probability-of-compromise assessment applies.

If notification is required, the facility must generally notify affected individuals without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more individuals also require notice to HHS without unreasonable delay and no later than 60 days after discovery; for breaches affecting fewer than 500 individuals, HHS notice is generally due within 60 days after the end of the calendar year in which the breach was discovered. Keep breach notification documentation showing the assessment, notices, mitigation, and steps taken to prevent recurrence. See HHS breach notification requirements and HHS audit protocol.

Audit readiness depends on knowing which HIPAA rules apply, maintaining current risk and compliance records, verifying staff practices and vendor agreements, and documenting timely corrective action.

FAQs

Are all ICF/IID facilities covered entities under HIPAA?

No. An ICF/IID is a covered entity only if it meets a HIPAA covered-entity definition—for example, as a health care provider that conducts specified standard electronic transactions. A facility may instead, or additionally, be a business associate when it handles PHI on behalf of a covered entity. Confirm the facility’s status using HHS covered-entity guidance.

What records should an ICF/IID facility retain for a HIPAA audit?

Prepare applicable privacy and security policies, risk analysis and risk management records, training and access-control documentation, business associate agreements, and incident or breach notification documentation. HIPAA requires specified compliance documentation to be retained for six years under applicable rules, but that is not a universal HIPAA retention period for every medical record. Other laws may require different retention periods.

How often should a HIPAA Security Risk Analysis be conducted?

The Security Rule does not specify a fixed interval, such as annually. HHS describes risk analysis as an ongoing process; review it when changes in technology, operations, staffing, ownership, or security incidents could affect ePHI risks. Document the analysis and the facility’s decisions. See HHS risk analysis guidance.

What should an ICF/IID facility do after discovering a potential breach?

Follow the incident-response procedure, contain the issue where possible, preserve evidence, investigate, and document the assessment. Determine whether the event involved unsecured PHI and whether notification is required. If required, notify affected individuals without unreasonable delay and no later than 60 days after discovery, and meet applicable HHS reporting requirements. See HHS Breach Notification Rule guidance.