HIPAA Audit Readiness Checklist for Medical School Faculty Practice Plans

A faculty practice plan may operate within a university or academic health system, but its HIPAA responsibilities depend on the legal entity, covered functions, and organizational design—not simply its name or location. Use this checklist to assemble clear evidence of where patient information is handled, how risks are managed, and how safeguards are put into practice.

Which entities and components are covered by HIPAA?

Start by identifying the legal entity that provides care and bills or conducts other covered electronic transactions. A health care provider is a HIPAA covered entity when it transmits health information electronically in connection with a transaction for which HHS has adopted a standard. A faculty practice plan may be part of the university, a separate legal entity, or part of an affiliated health system; document which arrangement applies and who is accountable for compliance. See HHS’s Summary of the HIPAA Privacy Rule.

• Collect the organizational chart, legal-entity documents, provider and billing arrangements, and any agreements that describe services between the school, practice plan, medical center, and affiliates.
• Determine whether the covered entity has formally designated itself as a hybrid entity. If it has, retain the designation and the list of health care components. The designation must include all components that would be covered entities if they were separate legal entities.
• Check whether the designated health care component includes every relevant provider and support component. For academic institutions, research functions may require separate analysis; research components that provide care and conduct standard electronic transactions must be included in the health care component.
• Document how workforce members, shared services, and affiliated organizations are treated, including which entity directs their work and which policies apply.

A university’s hybrid-entity status does not automatically place every school, department, or research unit in the HIPAA health care component. HHS explains the rules for postsecondary institutions and component designation in its guidance on colleges and universities as hybrid entities.

How to map PHI and ePHI across systems, locations, and vendors

Build an inventory that shows where protected health information (PHI) and electronic protected health information (ePHI) enter, move, and reside. Include clinical and administrative workflows, not just the electronic health record. HHS notes that risk analysis may include an inventory of systems and applications used to access or house ePHI; see its explanation of risk analysis and risk management.

• List clinical, billing, scheduling, claims, imaging, laboratory, patient-communication, identity-management, backup, and analytics systems that handle practice-plan information.
• Map information flows between faculty clinics, hospitals, university departments, affiliated practices, remote-work locations, and external service providers.
• Record the information involved, the business purpose, system or physical location, responsible owner, users with access, and how information is transmitted, stored, archived, and disposed of.
• Include paper records, removable media, mobile devices, email, file-sharing tools, and paper or electronic information handled by vendors.
• Identify the practice plan’s designated record set: medical and billing records, and other records used in whole or in part to make decisions about individuals. Include records maintained on the plan’s behalf where applicable. HHS describes designated record sets in its guidance on individuals’ access to health information.

Use the inventory to check that every system or workflow containing ePHI is included in the ePHI risk analysis. Record any exclusions and the reason for them so reviewers can understand the scope.

How to document risk analysis findings and remediation

The Security Rule requires a documented risk analysis to identify risks and vulnerabilities affecting the confidentiality, integrity, and availability of ePHI. It does not prescribe a single template or a universal schedule. The analysis should reflect the practice plan’s actual systems, operations, and risks, and should be revisited when changes or new information make updates necessary. See HHS’s Guidance on Risk Analysis.

• Retain the assessment scope, date, methods, systems and locations reviewed, participants, assumptions, and any identified gaps in coverage.
• For each finding, record the relevant threat or vulnerability, affected ePHI or service, likelihood and potential impact, assigned risk level, and existing safeguards.
• Link each finding to a corrective action, accountable owner, target date, required resources, and status. Keep evidence of completed remediation, exceptions, and management decisions to accept or defer remaining risk.
• Document how changes—such as new technology, system integrations, incidents, vendor changes, or organizational restructuring—are considered in risk review and risk management.
• Keep risk analysis and remediation records consistent with the policies and procedures in force during the period under review.

HHS states that the Security Rule requires documentation but does not specify its format, and that risk analysis should feed into risk management. Its risk analysis guidance also explains that the Rule does not set a universal frequency for a comprehensive risk analysis.

Which policies, approvals, and audit evidence should be retained?

Organize evidence so you can quickly connect each policy requirement to the responsible role, approval, implementation, and review record. The Security Rule requires regulated entities to retain required documentation for six years from the date it was created or the date it was last in effect, whichever is later. That HIPAA documentation period does not necessarily replace longer retention periods required by other laws, contracts, or institutional policy. See HHS’s Summary of the HIPAA Security Rule.

• Retain current and superseded Privacy and Security Rule policies, procedures, approval records, effective dates, and evidence that relevant workforce members can access them.
• Maintain records of the designated privacy and security responsibilities, applicable hybrid-entity designations, and decisions about the scope of the health care component.
• Keep risk analyses, risk-management plans, periodic evaluations, security incident records, workforce training records, and documentation of corrective actions.
• Retain relevant notices, patient acknowledgments or documented efforts to obtain them, access-request procedures and records, and breach notification policies and evidence.
• Use a retention schedule that distinguishes HIPAA-required documentation from medical records and other records that may be subject to separate requirements.

HHS does not require covered entities to obtain a general HIPAA certification. A training completion certificate or an external assessment may support an evidence file, but neither by itself establishes that the organization is HIPAA compliant. See HHS’s guidance on Security Rule certification.

How to verify workforce training and role-based access

Show that workforce members receive training appropriate to their functions and that access to patient information follows approved job responsibilities. The Privacy Rule requires workforce training on the entity’s privacy policies and procedures as necessary and appropriate for each person’s functions. The Security Rule also addresses security awareness and training. Do not treat an annual training certificate as a universal federal renewal requirement; verify applicable institutional policies and any employer-specific training schedule. HHS’s HIPAA Audit Protocol identifies training documentation as audit evidence.

• Keep training content, completion records, dates, and evidence that relevant personnel received updated instruction when policies or job duties changed.
• Compare access roles with job duties for faculty, clinicians, residents, students, administrative staff, billing personnel, researchers, and temporary or contract workers.
• Retain approval records for granting, changing, and ending access, along with evidence of periodic access review and timely removal of access no longer needed.
• Check how emergency or temporary access is authorized and documented, and whether access to especially sensitive information is appropriately limited.
• Keep records of workforce sanctions or corrective actions where applicable under the organization’s policies.

How to review safeguards, system activity, and incident records

Gather evidence that administrative, physical, and technical safeguards are implemented in the systems and locations where ePHI is handled. HIPAA calls for audit controls that record and examine activity in systems containing or using ePHI. An access control audit trail can help demonstrate review of system activity, but the organization should also show how it responds to concerning activity and corrects identified issues.

• Review system activity and access logs for the systems in scope, including how reviews are assigned, performed, documented, and escalated.
• Retain records of periodic technical and nontechnical evaluations, safeguard testing, identified weaknesses, and corrective actions.
• Document relevant facility access controls, workstation practices, device and media handling, user authentication, and protections for information in transit.
• Maintain security incident procedures and records showing how incidents were reported, assessed, contained, investigated, and resolved.
• For a potential breach, document the facts gathered, the decision process, and the breach risk assessment. HHS explains that the assessment considers the nature and extent of the PHI, the unauthorized person, whether PHI was actually acquired or viewed, and the extent to which risk was mitigated.
• Keep copies of required notifications or the analysis supporting a decision that notification was not required. For individual notifications, the general deadline is without unreasonable delay and no later than 60 calendar days after discovery of a breach, subject to the Rule’s provisions.

HHS sets out breach assessment factors, notification responsibilities, and the documentation needed to show that required notice was provided or was not required in its Breach Notification Rule guidance.

How to assess business associates and contingency plans

Identify vendors and other service providers that create, receive, maintain, or transmit PHI on the practice plan’s behalf, and determine whether they are business associates. Before permitting a business associate to handle ePHI, the covered entity generally must have a compliant written arrangement, such as a business associate agreement (BAA). Confirm that agreements are signed, current, and consistent with actual services and data flows.

• Maintain a current business associate inventory, the services provided, PHI involved, responsible relationship owner, and executed BAA or other applicable written arrangement.
• Review subcontractor arrangements where relevant, incident-reporting obligations, and how the vendor’s services are reflected in the practice plan’s own risk analysis.
• Track contract renewals, service changes, termination, and return or destruction of PHI as required by the agreement.
• Keep contingency plans for backup, disaster recovery, and emergency-mode operations, with assigned roles and procedures for restoring access to ePHI.
• Retain evidence of contingency plan testing and revision, including test scope, participants, results, identified gaps, and follow-up actions. HIPAA requires periodic testing and revision procedures; it does not prescribe one universal testing interval.

HHS describes the required written arrangements with business associates in its Security Rule summary. Its Audit Protocol identifies contingency plan tests, results, and corrective actions as relevant evidence.

In summary, audit readiness depends on a defensible scope, a complete map of PHI and ePHI, documented risk analysis and remediation, accessible policies and records, and evidence that safeguards, vendors, workforce practices, and contingency plans are reviewed and maintained.

FAQs.

How can a faculty practice plan determine which components are covered by HIPAA?

Start with the legal entity providing care and determine whether it meets the covered-entity definition, including whether it conducts covered electronic transactions. Then review any hybrid-entity designation and identify the health care components it includes. For a university hybrid entity, all components that would independently meet the covered-entity definition must be included in the health care component. Keep the designation, organizational chart, and supporting analysis available for review. HHS provides guidance on postsecondary institutions and hybrid-entity components.

What evidence should be available for a HIPAA audit?

Be prepared to provide the applicable entity and component designations, current policies and procedures, risk analysis and remediation records, training and access records, system activity and incident reviews, business associate agreements, breach documentation, evaluation results, and contingency plan test records. The exact evidence depends on the entity’s operations and the audit scope. HHS’s HIPAA Audit Protocol lists examples of records auditors may review.

How long must HIPAA documentation be retained?

Required Security Rule documentation must generally be retained for six years from its creation or from the date it was last in effect, whichever is later. Other laws, contracts, or institutional rules may require longer retention for particular records. See the documentation requirements in HHS’s Summary of the HIPAA Security Rule.

What records should document a breach assessment and notification decision?

Keep the incident facts, the PHI involved, the individuals or entities that received or may have accessed it, evidence about whether it was acquired or viewed, mitigation steps, and the reasoning and conclusion of the breach risk assessment. Also retain copies and dates of any required notifications—or documentation supporting the conclusion that notice was not required. HHS describes the assessment factors and documentation expectations in its Breach Notification Rule guidance.