HIPAA Audit Readiness Checklist for Multi-Site Skilled Nursing Facility Operators

A strong HIPAA audit readiness checklist helps you show how your organization protects electronic protected health information (ePHI) across every skilled nursing facility—not just at the corporate level. Use a shared framework for policies and oversight, then keep evidence that reflects the systems, workflows, and safeguards at each site.

This checklist focuses on practical evidence gathering. HIPAA requires regulated entities to meet applicable Security Rule standards, but it does not prescribe one audit binder format or a single way to organize multi-site records. Tailor your documentation to your organization’s structure and risks.

How should operators organize HIPAA policies and site-level governance?

Start with a controlled, organization-wide policy set that identifies who is responsible for HIPAA oversight and how each facility puts the policies into practice. Assign named owners for privacy, security, incident response, access approvals, and business associate oversight. Document who can make decisions centrally and what each facility’s administrator or designated contact must do locally.

Use a site register that identifies every facility, its address, responsible local contacts, and the systems and services used there. Link each site to relevant policies, risk findings, training evidence, vendor relationships, and open corrective actions. A shared policy can establish the baseline, while site-specific procedures explain local workflows such as access to medication carts, nurses’ stations, records rooms, and emergency workstations.

• Maintain a current policy inventory with version, approval date, owner, and review history.
• Record which facilities, departments, and systems each policy covers.
• Keep evidence that current procedures were distributed and made available to the people responsible for following them.
• Document site-level exceptions or alternative safeguards, including why they were selected and how the relevant HIPAA standard is still met.

The Security Rule requires written policies and procedures and requires updates as needed in response to environmental or operational changes. Review 45 CFR § 164.316 for documentation requirements and HHS’s Security Rule summary for an overview of administrative, physical, and technical safeguards.

How can facilities document risk analysis and remediation?

Build a documented HIPAA Security Rule risk analysis that covers the ePHI your organization creates, receives, maintains, or transmits. For a multi-site operator, keep an organization-wide view of shared platforms and services, then capture facility-level differences that affect risk—for example, local network equipment, staffing patterns, paper-to-electronic workflows, or emergency procedures.

Maintain an ePHI asset inventory that identifies relevant applications, servers, devices, storage locations, interfaces, and vendors. Include systems used for clinical records, billing, pharmacy, therapy, staffing, email, backup, remote access, and support. Record where ePHI moves and who can access it, including through business associates and subcontractors.

For each identified risk, document the affected site or system, potential threat or vulnerability, likelihood and impact assessment, current safeguards, and planned response. Assign an owner and target date to each remediation item. Track whether the issue is open, in progress, mitigated, accepted with documented rationale, or verified as closed.

Risk analysis is a required implementation specification, and risk management must reduce identified risks and vulnerabilities to a reasonable and appropriate level. HHS explains that HIPAA does not set one universal risk-analysis schedule; organizations should conduct ongoing analysis and update it when changes or new risks make that necessary. See HHS guidance on risk analysis and 45 CFR § 164.308.

Keep remediation evidence with the finding: approvals, configuration records, updated procedures, training, test results, or other proof that the corrective action was completed and effective. If an addressable implementation specification is not implemented, document the decision and rationale, and identify any appropriate alternative measure. HHS explains how addressable specifications work in its guidance on required and addressable specifications.

What site-by-site safeguards should the checklist verify?

Use a consistent checklist at every facility, but record actual results for each location rather than treating a corporate policy as proof that a safeguard works everywhere. Include the local environment, equipment, workflows, and people responsible for maintaining each control.

• Facility access: Check how staff, contractors, and visitors enter areas where systems or records are located. Review visitor procedures, access controls, and how lost keys or badges are handled.
• Workstations: Verify that workstations used to access ePHI are positioned and protected to limit access to authorized users. Check screen locking, shared work areas, and workstation use procedures.
• Devices and media: Review how devices and electronic media containing ePHI are received, moved, reused, and disposed of. Keep relevant movement, sanitization, and disposal records.
• Contingency planning: Confirm that site procedures support emergency operations and restoration of access to ePHI. Record test results, issues, and follow-up actions.
• Local implementation: Confirm that staff know how to report a suspected privacy or security concern and can locate the applicable procedures.

HIPAA’s physical safeguards include facility access controls, workstation use and security, and device and media controls. Some related implementation specifications are addressable, which means the organization assesses whether they are reasonable and appropriate and documents its decisions. See 45 CFR § 164.310 and HHS guidance on facility access controls.

Which workforce training records should operators retain?

Keep evidence that your workforce receives training relevant to its responsibilities. The Security Rule requires a security awareness and training program for all workforce members, including management. HIPAA Privacy Rule training must also reflect the organization’s policies and procedures and be provided to workforce members as necessary and appropriate for their functions.

For audit readiness, organize records by facility, department, role, and training topic where practical. Retain completion dates, the training material or version used, attendance or completion evidence, and records of make-up training or follow-up when someone misses a required session. Keep new-hire and role-specific training evidence alongside records of relevant policy updates or security awareness activities.

Use training that reflects actual skilled nursing workflows, such as protecting resident information during shift handoffs, handling records in shared spaces, using approved messaging and devices, and reporting suspected incidents. Maintain evidence of employer-specific policy training; a generic completion certificate alone does not establish that the organization or a facility is HIPAA compliant.

HIPAA documentation requirements generally require covered entities and business associates to retain required Security Rule documentation for six years from creation or the date it was last in effect, whichever is later. The Privacy Rule also has documentation-retention requirements. Apply the rules to the records that fall within them and account for any other applicable retention obligations; do not assume that every record, including every raw system log or medical record, has the same HIPAA retention period. See 45 CFR § 164.308, 45 CFR § 164.316, and the HHS audit protocol.

How should operators review access controls and audit logs?

Maintain current access records that connect each workforce member to their role, facility, approved systems, and access rights. A role-based access control approach can make permissions easier to administer, but verify that assigned roles reflect actual job duties and that individual access is limited to what is appropriate.

Check that onboarding, transfers, leave, and termination trigger timely access changes. Retain evidence of access approvals and periodic reviews, including how exceptions, shared accounts, or elevated privileges are addressed. Confirm that authentication procedures verify the identity of people or entities seeking access to ePHI. Consider multifactor authentication for remote or higher-risk access when supported by your risk analysis; the Security Rule requires authentication but does not prescribe one authentication technology for every system.

Confirm that systems containing or using ePHI record and examine relevant activity, and establish a documented audit log review process. Define which systems and events are reviewed, who performs the review, how often it occurs based on risk, how suspicious activity is escalated, and how findings are tracked. Preserve review evidence such as reports, review dates, reviewer identity, escalations, and documented follow-up.

The Security Rule requires technical access controls and audit controls, as well as procedures to review information-system activity. See 45 CFR § 164.312 and the HHS Security Rule summary. HIPAA does not prescribe one universal audit log review interval, so document a cadence appropriate to your systems and risk.

What physical and technical safeguards should facilities test?

Test whether safeguards work in practice, not only whether a policy exists. Keep a record of the test scope, date, location, systems involved, responsible person, outcome, identified gaps, and any follow-up action.

• Backups and recovery: Verify that retrievable copies of ePHI are created and that restoration procedures work for systems needed to support care and operations.
• Emergency operations: Walk through how staff would access necessary information during a system outage or facility emergency, while protecting ePHI.
• Physical access: Check doors, locks, visitor controls, equipment areas, and procedures for maintaining authorized access during an emergency.
• Workstation security: Observe whether screens, devices, and work areas are protected in actual resident-care and administrative settings.
• Technical controls: Review access rights, authentication, audit controls, transmission safeguards, and protections against improper alteration or destruction of ePHI.
• Device and media handling: Confirm that procedures cover movement, reuse, and final disposal of devices and media containing ePHI.

HIPAA requires contingency planning, facility access safeguards, workstation protections, and technical safeguards. The Security Rule allows flexibility in how standards are met, but addressable implementation specifications require an assessment and documented decisions. Refer to 45 CFR § 164.310, 45 CFR § 164.312, and HHS’s Security Rule overview.

How can operators prepare business associate and incident response records?

Keep a current vendor inventory that identifies which organizations create, receive, maintain, or transmit PHI on your behalf. For each business associate, retain the executed business associate agreement, the services covered, relevant subcontractor information when available, agreement updates, and the process for reporting and escalating concerns.

Review each business associate agreement for required provisions, including permitted uses and disclosures of PHI, appropriate safeguards, reporting of incidents and breaches, and terms addressing subcontractors. Track agreement status and renewal or review actions so facility teams know which vendors are approved for services involving PHI. HHS describes required contract elements in its business associate contract guidance.

Maintain written incident and breach notification procedures that explain how workforce members report concerns, who investigates, how evidence is preserved, how risks are assessed, and who makes notification decisions. Keep an incident register that records the event, affected site and systems, investigation steps, mitigation, outcome, and corrective actions. Preserve the rationale and supporting documentation when an event is determined not to require breach notification.

The Breach Notification Rule requires notifications following a breach of unsecured PHI, subject to the rule’s requirements and exceptions. Retain records demonstrating that required notifications were made or documenting why notification was not required. See HHS’s Breach Notification Rule guidance and 45 CFR § 164.308.

In summary, multi-site audit readiness depends on a reliable organization-wide framework, site-specific evidence, documented risk analysis, tested safeguards, and retrievable records of training, access reviews, vendors, and incident response. Assign owners to gaps and keep proof of corrective action through verification.

FAQs

How often should a multi-site skilled nursing operator reassess HIPAA risks?

HIPAA does not set a single fixed interval for repeating a comprehensive risk analysis. HHS describes risk analysis as an ongoing process and recommends updating it as needed, including when new technology, operational changes, security incidents, or newly recognized risks could affect ePHI. Set a review cadence appropriate to your environment and document what changes trigger an earlier reassessment. See HHS guidance on risk analysis.

What evidence should each facility prepare for a HIPAA audit?

Prepare the facility’s applicable policies and procedures, local governance contacts, risk findings, ePHI asset and system information, training evidence, access approvals and reviews, audit log review records, safeguard test results, remediation tracking, business associate agreements, and incident records. Be ready to explain how local practices align with organization-wide policies and how site-specific gaps are managed.

How should operators document corrective actions after identifying a safeguard gap?

Record the gap, affected site or system, related risk, interim protections, assigned owner, target date, approved action, and closure evidence. Document why the selected action is appropriate, retain test or validation results, and record any residual risk or remaining work. If you choose not to implement an addressable specification, document the rationale and how the applicable standard is met.

Which HIPAA records should be readily retrievable during an audit?

Keep current policies and procedures, risk analysis and risk-management documentation, training evidence, access-control and audit review records, safeguard assessments, business associate agreements, security incident and breach records, and corrective-action evidence organized for retrieval. HIPAA’s Security Rule generally requires required documentation to be retained for six years from creation or the date it was last in effect, whichever is later; apply that rule to required documentation rather than assuming every operational record has the same retention period. See 45 CFR § 164.316.