HIPAA Audit Readiness Checklist for Non-Medical Home Care Agencies

A HIPAA audit readiness checklist starts with determining which rules apply to your agency, then organizing evidence that shows how you protect information. Non-medical home care agencies are not automatically subject to HIPAA simply because they handle information about a client’s health; applicability depends on the agency’s role and activities. HHS guidance on covered entities explains the basic tests.

Determine Whether HIPAA Applies to Your Agency

Document a covered entity determination based on what your agency actually does—not only its name, services, or payer mix. A health care provider is generally a covered entity when it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as certain electronic billing transactions. A non-medical agency may not meet that test merely by providing personal care or receiving client information.

Separately assess whether your agency performs services on behalf of a covered entity or business associate that involve creating, receiving, maintaining, or transmitting protected health information (PHI). If so, the agency may be a business associate. Keep a written description of the agency’s services, electronic transactions, client and partner relationships, and the reasoning behind its determination. HHS’s business associate guidance describes the relevant functions and relationships.

If the facts are unclear, document the questions you need answered and consult qualified privacy counsel. Even when HIPAA does not apply, other privacy, contract, licensing, or state-law duties may still govern client information.

Maintain Written Privacy and Security Policies

If your agency is a covered entity or business associate, keep current written privacy and security policies that fit your services, workforce, systems, and actual information flows. Assign a responsible privacy or security lead, define how staff may access and disclose PHI, and establish procedures for complaints, sanctions, information disposal, and responding to individual requests when applicable.

Keep dated versions of policies, approval records, revision histories, and evidence that relevant staff can access the procedures they need. Check that written procedures match what staff do in the field—for example, how caregivers handle printed care instructions, messages, and agency devices while working in clients’ homes.

The Security Rule requires regulated entities to maintain written policies and procedures and required documentation. HHS explains these requirements in its summary of the HIPAA Security Rule.

Document Risk Analysis and Risk Management

Maintain a documented protected health information risk analysis covering the electronic protected health information (ePHI) your agency creates, receives, maintains, or transmits. Inventory relevant systems and devices, such as scheduling and care-management platforms, email, mobile phones, laptops, cloud storage, backups, and vendor connections. Record threats and vulnerabilities, existing safeguards, potential impact and likelihood, and the resulting risk ratings.

A risk management plan should turn the analysis into specific actions. For each risk, record the selected safeguard or documented rationale for another approach, the person responsible, the target date, and evidence that the action was completed. Review the analysis periodically and when significant changes—such as a new system, vendor, incident, or workflow—could affect ePHI risk. The Security Rule requires an accurate and thorough assessment and risk management; HHS distinguishes risk analysis from risk management.

For an audit, be ready to show both the assessment and what the agency did in response. HHS’s audit protocol identifies evidence reviewers may examine, including system scope, identified risks, ratings, and periodic updates.

Verify Workforce Training and Access Controls

Keep records showing who received privacy and security training, when it occurred, what material was covered, and how completion was documented. Train staff on agency-specific procedures, including safe conversations, handling client information in the home, reporting misdirected messages or lost devices, and escalating suspected incidents. HIPAA requires applicable regulated entities to train workforce members on security policies and procedures, but it does not establish a universal annual certificate-renewal requirement. Set refresher training according to your policies, risks, and operational changes.

Use role-based access control so each worker can access only the information needed for assigned duties. Keep access approvals, role descriptions, periodic access reviews, and records showing that accounts are promptly changed or disabled when staff leave or change roles. HHS describes role-appropriate access and workforce training in its Security Rule summary.

Review Business Associate Agreements and Vendor Records

List vendors and partners that may create, receive, maintain, or transmit PHI for your agency. Where a business associate agreement is required, keep the signed agreement, amendments, renewal or review records, and documentation of the services covered. Check that the agreement addresses permitted uses and disclosures, safeguards, incident reporting, and any required downstream subcontractor agreements.

Do not assume every organization that receives PHI needs a business associate agreement: HIPAA includes exceptions, including certain disclosures to health care providers for treatment. Determine the relationship and purpose before deciding. HHS describes when agreements are required and what they must cover in its business associate guidance.

Keep an up-to-date vendor inventory, copies of relevant security or privacy documentation, and records of how your agency evaluates vendor changes or problems. If your agency is itself a business associate, retain the agreements and subcontractor records applicable to your role.

Check Device, Physical, and Audit Log Safeguards

Review safeguards for agency offices, workstations, paper files, mobile devices, removable media, and information used by field staff. Document procedures for securing unattended screens, controlling physical access, reporting lost equipment, and securely disposing of records and media. Confirm that staff know how to protect printed schedules or care notes from being viewed or left behind by unauthorized people.

Assess electronic protected health information encryption for devices and data transmissions. Under the current Security Rule, encryption is an addressable implementation specification: evaluate whether it is reasonable and appropriate for your risks, implement it when indicated, or document the decision and any appropriate alternative. HHS explains the encryption requirement.

Confirm that systems have audit controls capable of recording and examining activity in systems containing or using ePHI. Establish a documented HIPAA audit log review process appropriate to your environment, including who reviews activity, how often, what suspicious patterns are escalated, and how follow-up is recorded. Keep review evidence and investigate unusual access rather than treating logs as a set-and-forget feature. HHS’s Security Rule summary discusses audit controls and regular reviews.

Prepare Incident Response and Documentation Retention

Maintain a written incident-response process that tells staff how to report suspected improper access, disclosure, loss, or alteration of PHI. The response team should promptly contain the issue, preserve relevant records and logs, investigate what happened, identify the information and people affected, document the assessment, and take steps to reduce harm. Keep an incident file with the timeline, decisions, communications, corrective actions, and any determination about whether breach notification is required.

If the agency is a business associate, its agreement and applicable rules govern notification to the covered entity; HIPAA’s outside deadline for a business associate to notify a covered entity of a breach of unsecured PHI is 60 days after discovery, though the agreement may require faster reporting. Covered entities have notification duties when a reportable breach occurs, generally without unreasonable delay and no later than 60 days after discovery. See the HHS Breach Notification Rule guidance.

Retain required HIPAA documentation—including applicable policies and records of required actions or assessments—for six years from creation or the date it was last in effect, whichever is later. Do not confuse this rule with medical-record retention: HIPAA’s Privacy Rule does not set a general retention period for medical records; state and other applicable laws may. HHS explains the distinction.

In short, audit readiness means being able to show why HIPAA applies, which safeguards your agency selected, how staff and vendors follow them, and how risks and incidents are documented and addressed.

FAQs

Are non-medical home care agencies always subject to HIPAA?

No. A non-medical home care agency is not automatically subject to HIPAA. Applicability depends on whether it meets the definition of a covered entity or business associate based on its activities and relationships. An agency’s name or the fact that it handles health-related information does not, by itself, determine its status.

What records should an agency have ready for a HIPAA audit?

If HIPAA applies, organize the agency’s applicability determination, current policies and procedures, risk analysis and risk management records, workforce training and access records, applicable business associate agreements, vendor inventory, device and physical safeguard records, audit-log review documentation, incident records, and required retention documentation. The exact records depend on the agency’s role and systems.

How often should a home care agency review its HIPAA risk analysis?

The Security Rule requires periodic risk evaluation and reassessment as appropriate, including when changes in the environment or operations could affect ePHI risks. It does not set one universal annual review interval. Document your review schedule and update the analysis when significant changes, incidents, or newly identified risks warrant it.

What should an agency do after discovering a potential breach?

Promptly contain the incident, preserve relevant evidence, notify the responsible privacy or security lead, and investigate what information may have been affected and who may have accessed it. Document the assessment and mitigation steps, then follow the applicable breach-notification rules and contract terms. If the agency is a business associate, notify the covered entity as required by the agreement and applicable HIPAA rules.