HIPAA Audit Readiness Checklist for Physician Practice Management Companies

A physician practice management company’s audit preparation should reflect the services it provides and the information it handles. If the company creates, receives, maintains, or transmits protected health information on behalf of a healthcare provider, it may be a business associate; its specific HIPAA duties depend on its role and applicable agreements. The HHS guidance on business associates explains when these relationships can arise.

Use this checklist to organize evidence, identify gaps, and show how your safeguards protect electronic protected health information (ePHI). An organized file set helps demonstrate your process, but it does not by itself establish compliance.

How should practice management companies document risk analysis and remediation?

Keep a written, organization-specific HIPAA Security Rule risk analysis that identifies where ePHI is created, received, maintained, or transmitted; the systems and workflows involved; relevant threats and vulnerabilities; and the likelihood and potential impact of risks. HHS says the analysis must be accurate and thorough, but does not prescribe a single format or methodology. See HHS guidance on risk analysis.

Connect findings to a HIPAA risk management plan. For each identified risk, record the planned safeguard or other response, accountable owner, target date, status, and any residual risk accepted by management. Keep evidence of remediation, such as configuration changes, updated procedures, access reviews, or vendor follow-up.

• Document the scope, systems, data flows, assumptions, and assessment date.
• Link each significant risk to a corrective action and its current status.
• Record why an addressable implementation specification is not reasonable and appropriate, when applicable, and any equivalent measure adopted.
• Revisit the analysis when business operations, technology, vendors, or threats change, and document updates.

HIPAA does not set one universal risk-analysis schedule. HHS describes risk analysis as an ongoing process and says review frequency depends on the organization’s circumstances. A fixed annual review may be useful as an internal practice, but it is not a universal federal cadence. See HHS’s explanation of risk analysis and risk management.

Which HIPAA policies and procedures should be current and available?

Maintain written policies and procedures that match the company’s actual systems, responsibilities, and HIPAA role. Make current versions accessible to the workforce members who need them, and retain superseded versions and required documentation according to applicable retention requirements. The HHS audit protocol identifies documentation and policy records auditors may review.

Depending on your functions and arrangements, organize policies covering:

• Security responsibility, risk analysis, risk management, and periodic evaluation.
• Workforce authorization, access establishment and modification, and termination of access.
• Security awareness and training, security reminders, and sanctions.
• Security incident identification, response, mitigation, and documentation.
• Facility access, workstation use and security, and device and media controls.
• Contingency planning, including data backup, disaster recovery, and emergency operations.
• Business associate agreements and breach notification procedures relevant to your role.

Assign an owner to each policy, record its approval and effective date, and review it when operations or risks change. Avoid relying on generic templates that do not describe your real workflows or the responsibilities set out in client agreements.

How can workforce training and sanctions be documented?

Keep evidence that workforce members received training relevant to their responsibilities and the policies they must follow. A practical training file may include the employee or contractor’s name, training topic, completion date, delivery method, and acknowledgment or completion record. Retain the materials and records needed to show what training covered.

The Security Rule requires a security awareness and training program for workforce members, including management, and appropriate sanctions for workforce members who fail to follow security policies. HIPAA does not require a universal annual training certificate or annual certificate renewal. Training and security reminders should respond to your organization’s policies, roles, and changing security needs. See the HHS summary of the Security Rule.

Keep a written sanction policy and records showing how reported violations were assessed and handled. Limit those records to appropriate reviewers, and document the decision consistently with your policy, without exposing unnecessary PHI.

How should business associates and vendors be assessed?

Keep an inventory of vendors and subcontractors that create, receive, maintain, or transmit ePHI for the company or its clients. Record the service provided, the information involved, the responsible business owner, and whether a business associate agreement (BAA) or other written agreement is required.

Where HIPAA requires an agreement, confirm that it is signed and covers the required protections, reporting duties, and subcontractor obligations. A business associate that engages a subcontractor to handle ePHI on its behalf must obtain satisfactory assurances through a written agreement. Review HHS’s business associate contract provisions and its business associate guidance.

• Keep current agreements, amendments, service descriptions, and contact details together.
• Record how you assessed vendor risks and what evidence or assurances you requested.
• Track vendor incidents, remediation requests, and follow-up actions.
• Review whether access or agreements should change when a service ends or its scope changes.

HIPAA does not expressly require every business associate to provide its customer with security documentation or permit a customer audit. Contract terms may establish additional assurances, documentation, or review rights based on the parties’ needs and risk management. See HHS guidance on business associate security documentation and audits.

What access controls and audit logs should be reviewed?

Review whether each workforce member’s access is appropriate for their role and job duties. Role-based access control (RBAC) can help implement that approach, but HIPAA does not mandate one particular access-control technology. Maintain access approval records and periodically check that access remains appropriate, especially after a hire, transfer, termination, or change in responsibilities.

Confirm that users have unique identifiers and that access can be traced to individual users. Shared accounts can undermine accountability. Review administrative, clinical, billing, and support access as applicable, including privileged access and emergency access processes. HHS describes access-control and audit-control safeguards in its Security Rule summary.

Audit controls and system activity review should be part of the organization’s routine security process. Keep records showing that appropriate personnel reviewed logs, access reports, and security incident tracking reports, and document investigated anomalies and their outcomes. The HHS cybersecurity newsletter on audit logs explains the role of recording and reviewing system activity.

How can physical and technical safeguards protect ePHI?

Show how safeguards address the risks identified in your analysis. Physical safeguards may include controlled facility access, visitor procedures, secure workstation placement, screen protections, and procedures for handling, moving, reusing, and disposing of devices or media containing ePHI. The specific measures should fit the organization’s environment and the systems it uses.

Technical safeguards may include access controls, unique user identification, authentication, audit controls, integrity protections, and transmission security. Document how your systems are configured and how responsibilities are divided between your company, your clients, and vendors. For cloud or hosted services, do not assume that the provider handles every safeguard; responsibilities may be shared. See HHS guidance on HIPAA and cloud computing.

Keep evidence appropriate to your environment, such as facility and device procedures, access settings, backup and recovery records, security evaluations, and follow-up actions. HHS outlines the relevant safeguard categories in its physical safeguards guidance.

What incident and audit records should be ready for review?

Maintain a consistent process for recording suspected or known security incidents, investigating them, limiting harm, and documenting outcomes. Preserve incident reports, investigation notes, relevant system evidence, mitigation steps, communications with affected clients or business associates, and corrective actions. Keep records in a controlled location and limit access to people with a business need.

For a suspected impermissible use or disclosure of PHI, retain the facts gathered, the assessment of whether the event meets the breach definition, and the basis for any decision that notification was or was not required. If notifications are required, keep copies or other evidence showing what was sent and when. HHS explains that covered entities and business associates must be able to demonstrate that required notifications were provided or that notification was not required in its Breach Notification Rule guidance.

Keep a central audit file that can point reviewers to the current risk analysis, remediation tracker, policies, training and sanction records, BAAs, access reviews, system activity reviews, safeguard evidence, incident records, and prior evaluations. HIPAA-required documentation generally must be retained for six years from its creation or from the date it was last in effect, whichever is later; check the HHS audit protocol and applicable requirements for the records at issue.

In short, audit readiness means being able to connect identified risks to policies, safeguards, responsible people, and documented follow-through. Keep evidence accurate, current, and consistent with your company’s role and agreements.

FAQs

What documents should a physician practice management company provide during a HIPAA audit?

Provide the documents relevant to the audit scope and your role, such as the risk analysis and remediation records, current policies and procedures, training and sanction documentation, BAAs, access reviews, audit-log review records, safeguard evaluations, and incident or breach records. An auditor may also request evidence that controls operate as described. The HHS audit protocol lists examples of documentation OCR may review.

How often should a HIPAA risk analysis be reviewed and updated?

HIPAA does not set a single review interval for every organization. Risk analysis is an ongoing process, so review it when operational or environmental changes could affect ePHI and update the documentation as needed. Your organization may also set a regular review schedule based on its circumstances. See HHS risk analysis guidance.

Do business associates need agreements with their subcontractors?

Yes, when a subcontractor creates, receives, maintains, or transmits ePHI on behalf of a business associate, the business associate must obtain satisfactory assurances through a written agreement that the subcontractor will safeguard the information as required. See HHS business associate guidance.

What records should be retained after a suspected PHI breach?

Retain the incident report, investigation findings, relevant evidence, risk assessment, mitigation and corrective actions, communications, and documentation of required notifications—or the reasons notification was not required. Keep the records securely and follow applicable HIPAA documentation-retention requirements. HHS’s Breach Notification Rule guidance describes the documentation needed to support notification decisions.