HIPAA Audit Readiness Checklist for Online Vision Test Companies

How to document a current security risk analysis and remediation plan

Start by confirming whether your company is a HIPAA covered entity or business associate. An online vision test service is not automatically covered just because it collects health-related information: the Security Rule applies to covered entities and their business associates. A health care provider is a covered entity when it conducts certain standard transactions electronically. Review the HHS Summary of the HIPAA Security Rule and get legal guidance if your role is unclear.

If HIPAA applies, keep a dated HIPAA Security Rule risk analysis that evaluates risks to the confidentiality, integrity, and availability of all ePHI your company creates, receives, maintains, or transmits. The Security Rule requires an accurate and thorough assessment, but does not prescribe a single template or method. See 45 CFR § 164.308 and HHS guidance on risk analysis.

• Build an electronic protected health information inventory: Record the types of ePHI involved, where they are stored, how they move, who can access them, and which systems or vendors handle them. For an online vision test service, assess relevant patient intake, test results, images, accounts, support tools, cloud storage, backups, and connected systems.
• Assess risks and vulnerabilities: Document plausible threats, weaknesses, likelihood, potential impact, and existing safeguards. Include the systems and workflows used by staff, contractors, and vendors.
• Track corrective action: For each identified risk, record the chosen safeguard or other response, accountable owner, priority, target date, status, and evidence that the action was completed or the remaining risk was accepted by an authorized decision-maker.
• Keep the analysis current: Review it when changes in technology, services, vendors, operations, or security incidents may affect ePHI. HHS says the Security Rule does not set one universal risk-analysis schedule; it expects an ongoing process and updates as circumstances warrant.

Keep the analysis and remediation decisions together so an auditor can trace how identified risks led to action. The Security Rule also requires regulated entities to review and update documentation in response to environmental or operational changes, as explained in 45 CFR § 164.316.

Which HIPAA policies and records should be audit-ready

Maintain a controlled, searchable set of current policies and records, with version dates, approval information, and assigned owners. The precise documents depend on your organization and which HIPAA requirements apply, but an audit-ready set commonly includes:

• Security and privacy policies, including risk management, access authorization, workforce security, security awareness, incident response, and sanctions.
• The current risk analysis, risk register, remediation plan, and records of periodic evaluations.
• System and data inventories, relevant data-flow documentation, and records of material technology or workflow changes.
• Access approval, modification, termination, and periodic review records, together with audit log review evidence.
• Business associate agreements and records showing how applicable subcontractor relationships are addressed.
• Training materials and completion records, incident files, breach notification documentation, and contingency plan testing results.
• Backup, recovery, emergency operations, device and media handling, and secure disposal procedures and records.

The Security Rule requires written policies and procedures and documentation of actions, activities, or assessments that the Rule requires to be documented. Retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later; this is not a blanket HIPAA retention period for every patient record. See 45 CFR § 164.316. Apply any longer retention period required by other applicable laws, contracts, or company policy.

How to review user access and audit logs for ePHI

Use documented access rules that connect permissions to job responsibilities. Role-based access control is a practical way to support appropriate access, but your records should show how access is authorized, reviewed, changed, and removed—not just that roles exist. The Security Rule requires policies for authorizing access and procedures to establish, document, review, and modify users’ access rights. See 45 CFR § 164.308.

• Maintain unique user accounts and a current list of staff, contractors, and administrators with access to systems containing ePHI.
• Keep approval and change records for new access, role changes, elevated privileges, and prompt access removal when a person leaves or no longer needs access.
• Confirm that systems record relevant activity and that access controls, authentication, and transmission safeguards are in place as appropriate to the risks.
• Document audit log review: identify the system and period reviewed, reviewer, review date, scope, exceptions found, investigation or escalation, and resolution.

The Security Rule requires both mechanisms to record and examine activity in systems containing ePHI and procedures to regularly review information-system activity records, such as audit logs and access reports. It does not set one universal review interval; define a risk-based schedule in policy and show that reviews occur. See 45 CFR § 164.312 and 45 CFR § 164.308.

How to assess vendors and maintain business associate agreements

Classify vendors by what they do with PHI and whether they perform a covered function or service on behalf of a covered entity or business associate. A business associate agreement is generally required when a business associate handles PHI for a covered entity, and downstream subcontractors that handle PHI on behalf of a business associate may also be business associates. Some arrangements are exceptions, so do not assume every vendor needs a BAA—or that a vendor needs none—without evaluating its role. See the HHS Business Associates guidance.

• Keep an inventory of vendors and subcontractors that may create, receive, maintain, or transmit ePHI, including cloud, hosting, support, messaging, and analytics providers where applicable.
• Store signed agreements, effective dates, renewal or review dates, and the services and data covered by each agreement.
• Check that the agreement addresses permitted uses and disclosures, safeguards, subcontractors, incident reporting, and return or destruction of information as applicable.
• As a readiness practice, document vendor security reviews, follow-up on identified issues, and changes in services or subcontractors. These checks help demonstrate oversight but do not replace the required agreement.

HIPAA requires applicable business associate contracts to address safeguards and reporting of security incidents, including breaches of unsecured PHI. A business associate must also obtain appropriate agreements with its qualifying subcontractors. See 45 CFR § 164.314 and the HHS Business Associates guidance.

What workforce training and oversight records should you keep

Keep records that show training was relevant to each person’s work and covered your company’s actual policies and procedures. Useful evidence includes assigned materials, training dates, attendee or completion records, policy acknowledgments, follow-up coaching, and records of how the company handled policy violations.

The Security Rule requires a security awareness and training program for all workforce members, including management. For covered entities, the Privacy Rule requires training on relevant privacy policies and procedures as necessary and appropriate for each person’s functions, and requires documentation that training was provided. See 45 CFR § 164.308 and the HHS Summary of the HIPAA Privacy Rule.

Do not treat an annual training certificate as a universal federal renewal requirement or as proof that the organization is HIPAA compliant. Set refresher schedules through employer-specific policies and respond to material policy, technology, or job changes. A completion certificate may evidence an individual’s course completion; it does not establish that the company has completed its risk analysis, implemented safeguards, or met other applicable requirements.

How to document incident response and breach investigations

Keep a case file for suspected and confirmed security incidents, including events that do not ultimately qualify as a reportable breach. Record when and how the issue was discovered, affected systems and information, the response team, containment steps, evidence reviewed, decisions made, mitigation, communications, and follow-up actions. HIPAA requires regulated entities to respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes. See 45 CFR § 164.308.

For a possible impermissible use or disclosure of PHI, document the assessment and decision on notification. A breach is generally presumed unless an exception applies or the covered entity or business associate demonstrates a low probability that the PHI was compromised based on the required risk assessment factors. Keep the facts and reasoning for each factor, including the type of information, recipient, whether it was viewed or acquired, and mitigation. See the HHS Breach Notification Rule guidance.

Maintain breach notification documentation, such as drafts and final notices, affected-person counts, submission records, and the rationale for concluding notification was or was not required. Covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach of unsecured PHI; business associates must notify the covered entity without unreasonable delay and no later than 60 days, though an agreement may set a shorter reporting deadline. Verify applicable responsibilities and deadlines against the HHS Breach Notification Rule and your agreements.

How to verify data protection, contingency plans, and patient privacy workflows

Compare safeguards to the risks in your analysis, then retain evidence that they operate in practice. Review systems that store, display, or transmit ePHI for appropriate access control, unique user identification, authentication, audit controls, integrity protections, and transmission security. Encryption is an addressable implementation specification under the Security Rule: assess whether it is reasonable and appropriate for your environment, and document an appropriate alternative if it is not. See 45 CFR § 164.312 and the HHS Security Rule summary.

For contingency plan testing, maintain plans and results for data backup, disaster recovery, emergency operations, and restoration. Record the test date, systems and data involved, recovery outcome, issues found, owners, and corrective actions. HHS advises periodically testing restorations and contingency plans so the organization can assess whether backups and recovery procedures work. See the HHS Fact Sheet on Ransomware and HIPAA.

Review patient-facing workflows from online intake through test delivery, support, and disclosure. Check that staff verify identity before providing results, use appropriately secure channels, limit access and disclosure to what is permitted, and follow the company’s applicable privacy notice and complaint procedures. For covered entities, the Privacy Rule requires written privacy policies and procedures and reasonable safeguards; the specific workflow depends on the service and applicable rules. See the HHS Summary of the HIPAA Privacy Rule.

An effective audit-ready program ties the ePHI inventory to current risk analysis, documented safeguards, vendor agreements, workforce oversight, incident records, and tested recovery and privacy workflows. Keep evidence current and easy to retrieve so you can explain not only what your policies say, but how your company follows them.

FAQs

How often should an online vision test company update its HIPAA risk analysis?

HIPAA does not prescribe one universal schedule. Keep the analysis current as an ongoing process and revisit it when changes to systems, vendors, services, operations, or incidents could affect ePHI risks. HHS notes that the appropriate frequency varies by environment and circumstances. See HHS guidance on risk analysis.

Which vendors need a business associate agreement?

A BAA is generally needed when a vendor is a business associate that performs a covered function or service on behalf of a covered entity involving PHI. A qualifying subcontractor handling PHI on behalf of a business associate generally needs an agreement with that business associate. Evaluate the vendor’s actual role and applicable exceptions rather than relying only on its product category. See the HHS Business Associates guidance.

What records should be available for a HIPAA audit?

Be prepared to provide applicable policies and procedures, the current risk analysis and remediation records, access approvals and audit log review evidence, training records, business associate agreements, incident and breach files, contingency plans and testing results, and documentation of required evaluations. The exact set depends on your organization’s role and the requirements that apply. Required Security Rule documentation is generally retained for six years from creation or the date it was last in effect, whichever is later. See 45 CFR § 164.316.

How should a company document a suspected ePHI breach?

Open an incident record promptly and preserve the timeline, systems and information involved, containment and mitigation steps, investigation evidence, affected-person assessment, and decisions about notification. Document the risk assessment factors and the basis for determining whether notification is required. If the company is a business associate, follow the BAA’s reporting terms and applicable HIPAA deadlines. See the HHS Breach Notification Rule guidance.