HIPAA Audit Readiness Checklist for PACE Programs

For a Program of All-Inclusive Care for the Elderly (PACE), audit readiness means being able to show how your organization protects participant information in day-to-day operations—not just having policies on file. Use this checklist to organize your safeguards, evidence, and follow-up actions across your workforce, systems, vendors, and physical records.

Which administrative safeguards should PACE programs document?

Start with written policies and procedures that explain who is responsible for protecting electronic protected health information (ePHI), how staff receive appropriate access, and how the program identifies and responds to security risks. The HIPAA Security Rule requires administrative, physical, and technical safeguards; the specific measures should be reasonable and appropriate to the organization’s circumstances. See the HHS summary of the HIPAA Security Rule.

For an audit, organize evidence that shows how safeguards are implemented, not only policy statements. Depending on your operations, that may include:

• Designation of the security official and documentation of security responsibilities.
• Workforce clearance, access authorization, supervision, and termination procedures.
• Security awareness and training materials, completion records, and procedures for addressing security incidents.
• Contingency planning, such as data backup, disaster recovery, and emergency-mode operation procedures.
• Periodic evaluations of security measures and records of policy updates made in response to organizational or environmental changes.
• Business associate agreements and records of relevant security incidents and corrective actions.

PACE organizations also have program-specific obligations to safeguard data, books, and records against loss, destruction, unauthorized use, and inappropriate alteration, and to protect the privacy of information identifying participants. Review 42 CFR § 460.200 alongside HIPAA requirements.

What audit controls should monitor access to participant records?

HIPAA requires technical policies and procedures that allow a covered entity to record and examine activity in information systems containing or using ePHI. It does not prescribe one universal log format or a fixed list of log fields. Your HIPAA audit controls should be suited to the PACE health information system and help you review access, detect suspicious activity, and investigate security incidents. See 45 CFR § 164.312(b) and the HHS Security Rule summary.

As a practical audit-readiness measure, check whether your system logs can show the user account, date and time, type of activity, and affected record or system when available. Document how staff review logs, how they escalate unusual access, and how findings are investigated and resolved. Keep records of the review process and actions taken.

Use role-based access so workforce members can access information appropriate to their duties. Apply the HIPAA Privacy Rule’s minimum necessary standard when it applies; our guide to the minimum necessary standard provides additional context. It generally does not apply to disclosures to, or requests by, a health care provider for treatment. Regularly review user accounts, permissions, and access when staff change roles or leave the organization.

How should PACE programs conduct and remediate HIPAA risk analyses?

A HIPAA Security Rule risk analysis should cover all ePHI your organization creates, receives, maintains, or transmits, including information in electronic systems, portable media, and relevant vendor environments. An electronic protected health information inventory can help you identify where the information is stored or accessed, which systems and people use it, and how it moves between the PACE organization and its partners.

Assess reasonably anticipated threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI, along with the likelihood and potential impact of those risks. HIPAA does not mandate one specific risk-analysis method. HHS describes the required scope and elements in its Guidance on Risk Analysis.

Then turn findings into a documented risk-management plan. For each identified risk, record the safeguard or corrective action selected, the responsible person, target date, and progress or outcome. If an addressable implementation specification is not implemented, document why an alternative measure is reasonable and appropriate, or why the specification is not reasonable and appropriate in the circumstances. Revisit the analysis when systems, workflows, vendors, facilities, or threats change, and retain evidence of remediation and follow-up.

Which HIPAA records must PACE programs retain for six years?

HIPAA requires covered entities to retain Security Rule policies and procedures, along with written records of actions, activities, or assessments that the Security Rule requires them to document. The retention period is six years from the date the documentation was created or the date it was last in effect, whichever is later. Review 45 CFR § 164.316(b) and the HHS Security Rule summary.

Examples of HIPAA documentation to include in your retention schedule are risk analyses and related risk-management records, security policies and procedures, documented evaluations, records of security incidents and their outcomes, and required business associate agreements. Keep these records accessible to personnel responsible for implementing the documented procedures, and update them when relevant conditions change.

The six-year HIPAA documentation rule does not mean every medical record, participant record, or audit log must automatically be retained for six years under HIPAA. Other laws, PACE requirements, contracts, or organizational policies may set different retention periods. Confirm applicable requirements before disposing of records.

How should PACE programs assess and oversee business associates?

Before a vendor creates, receives, maintains, or transmits PHI on your behalf in a business-associate capacity, put a business associate agreement (BAA) or other permitted written arrangement in place. A vendor’s label or contract title does not decide whether it is a business associate; assess what the vendor actually does and whether it handles PHI for the PACE organization. HHS explains these requirements in its Business Associates guidance.

Check that the agreement describes permitted and required uses and disclosures, requires appropriate safeguards, provides for reporting relevant security incidents and impermissible uses or disclosures, and addresses subcontractors that handle PHI. It should also address return or destruction of PHI at termination when feasible. See the HHS sample business associate agreement provisions.

Maintain a current vendor inventory and keep each agreement, review, and follow-up record together. As a practical oversight measure, assess whether vendors’ safeguards remain appropriate to the services and information involved, review reported incidents, track remediation, and revisit arrangements when services or data flows change. HIPAA requires appropriate assurances and contractual terms; it does not establish a single universal vendor-audit schedule.

How can PACE programs safeguard electronic and paper participant information?

For electronic information, apply safeguards that protect ePHI from unauthorized access, alteration, loss, or destruction. Depending on your risk analysis, measures may include unique user accounts, role-appropriate permissions, authentication controls, secure transmission, backups, and procedures for managing devices and media. Document how safeguards support the confidentiality, integrity, and availability of ePHI.

For paper records, control access to rooms and storage areas, keep files secured when not in use, and use secure procedures for transporting, copying, and disposing of records. Train staff to avoid leaving participant information visible to unauthorized people and to report misplaced files or suspected disclosures promptly.

PACE organizations must also establish written policies and implement procedures to safeguard program data, books, and records against loss, destruction, unauthorized use, and inappropriate alteration under 42 CFR § 460.200(d). Align those procedures with the HIPAA safeguards applicable to your organization and with any other applicable record-protection requirements.

In short, audit readiness depends on current documentation, risk-based safeguards, controlled access, and clear evidence that your PACE program follows through when it identifies a gap. Keep the supporting records organized, current, and available to the people responsible for implementing your policies.

FAQs

What documentation should a PACE program have ready for a HIPAA audit?

Organize current privacy and security policies, the ePHI inventory, risk analyses and remediation records, workforce access and training records, security incident documentation, evaluations, access-review procedures, and applicable business associate agreements. Also be prepared to show how PACE-specific procedures protect data and records against loss, destruction, unauthorized use, and inappropriate alteration.

How long must PACE programs retain HIPAA documentation?

HIPAA requires covered entities to retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later. This requirement applies to the documentation specified by the Rule; it does not automatically set a six-year retention period for every participant medical record or audit log. Check other applicable requirements for additional retention periods.

What should PACE audit logs record about access to participant information?

HIPAA requires mechanisms to record and examine activity in systems containing or using ePHI, but it does not mandate one universal log format or specific fields. As a practical measure, logs should provide useful information for reviewing who accessed information, when access occurred, what activity took place, and which record or system was involved when available. Your organization should document how logs are reviewed and how unusual activity is investigated.

When does a PACE vendor need a business associate agreement?

A vendor generally needs a business associate agreement when it creates, receives, maintains, or transmits PHI on behalf of the PACE organization in a business-associate capacity. Assess the vendor’s actual services and handling of PHI, rather than relying only on its title or contract label. Certain arrangements or disclosures may be exceptions, so confirm the facts against HHS guidance and applicable HIPAA requirements.