HIPAA Audit Readiness Checklist for Rural Critical Access Hospitals

Use this checklist to organize evidence that your hospital’s privacy and security practices are in place and working across its locations, systems, and vendor relationships. It is a practical guide—not an HHS certification or a guarantee of compliance. HIPAA compliance is an ongoing process, and safeguards should reflect your organization’s environment and risks, as explained in HHS guidance on Security Rule compliance.

How to assess and document ePHI security risks across hospital systems and locations

Start with a documented HIPAA Security Rule risk analysis covering the confidentiality, integrity, and availability of all electronic protected health information (ePHI) your hospital creates, receives, maintains, or transmits. The analysis should cover more than the electronic health record: include relevant systems, devices, storage, connections, and locations, including those operated by vendors. HHS explains the scope and core objectives in its Guidance on Risk Analysis.

• Build an electronic protected health information inventory. Record where ePHI resides and how it moves—for example, through EHR, laboratory, pharmacy, imaging, billing, patient portal, telehealth, backup, and email systems. Include relevant workstations, mobile devices, network equipment, interfaces, and vendor-hosted services.
• Map locations and access pathways. Include the main hospital, clinics, remote work, mobile or field workflows, and connections to external systems. Identify which workforce roles and vendors can access each system.
• Assess threats and vulnerabilities. Consider unauthorized access, phishing, ransomware, lost devices, misdirected communications, system failures, power or network disruptions, and physical or environmental events that could affect ePHI.
• Document risk decisions. For each significant risk, record the affected ePHI and systems, likelihood and potential impact, existing safeguards, chosen response, responsible owner, target date, and evidence that the decision was reviewed.
• Maintain a risk management plan. Prioritize corrective actions, assign accountability, and track unresolved risks through completion or a documented decision to accept residual risk.

HIPAA does not prescribe a single risk-analysis method. HHS describes risk analysis as an assessment of risks and vulnerabilities, and risk management as implementing measures to reduce identified risks. See HHS’s explanation of risk analysis and risk management.

Keep the analysis current as your environment changes. The Security Rule does not set one fixed interval for reassessment; HHS says the process should be ongoing and updates should reflect circumstances such as new technology, organizational changes, or security incidents. See HHS guidance on periodic review and updates.

Which privacy policies and patient-rights procedures should be audit-ready

Keep current, approved privacy policies and procedures that describe how staff may use and disclose protected health information (PHI), when authorization is needed, and how the hospital handles requests, complaints, and suspected violations. Make sure staff can locate the current versions and that the documents reflect actual hospital workflows.

• Notice of Privacy Practices: Keep the current notice, evidence of how it is provided or made available, and records of patient acknowledgments or refusals where applicable. The notice explains permitted uses and disclosures, privacy duties, patient rights, and how to make a complaint. See HHS guidance on the Notice of Privacy Practices.
• Individual-rights procedures: Document how staff route and respond to requests for access, amendment, and accounting of disclosures, including requests involving records maintained by a business associate. Keep request logs and evidence of responses or permitted denials. See HHS guidance on covered entities’ responsibilities for individual rights.
• Use-and-disclosure controls: Maintain procedures for authorizations, routine disclosures, minimum-necessary decisions where applicable, and any agreed restrictions or confidential communications. Give staff clear direction on when to involve the privacy officer.
• Complaints and workforce consequences: Retain the process for receiving and investigating complaints, documenting outcomes, and applying appropriate sanctions when workforce members violate policies.

Keep evidence that policies were reviewed and updated when needed, and that staff followed the relevant procedure in actual cases. The HHS Summary of the HIPAA Privacy Rule describes the Privacy Rule’s notice and individual-rights requirements.

How to review workforce access controls and system activity

Be prepared to show that access to systems containing ePHI is limited to authorized users and appropriate to their job duties. Keep documented processes for requesting, approving, changing, and removing access, including for new hires, transfers, role changes, and departures.

• Maintain role-based access criteria, approval records, and a current inventory of accounts and assigned access.
• Check that users have unique identifiers and that shared or generic accounts are controlled and justified under your procedures.
• Document periodic reviews of user access, exceptions, and corrective actions. Pay particular attention to accounts that are no longer needed or have broader permissions than the user’s role requires.
• Keep procedures for emergency access to ePHI and records showing when emergency access was used and subsequently reviewed.
• Define how the hospital records and reviews system activity, including which systems are covered, who reviews alerts or logs, how often reviews occur under hospital policy, and how findings are escalated.

The Security Rule calls for technical mechanisms that record and examine activity in systems containing or using ePHI. HHS’s HIPAA Audit Protocol identifies evidence auditors may examine, including user-access authorization and audit controls. Keep review records that show what was examined, what was found, and how concerns were resolved.

What safeguards and contingency plans should the checklist cover

Organize evidence of administrative, physical, and technical safeguards that protect ePHI. The specific measures should be reasonable and appropriate for your hospital’s systems and risks; do not treat a single safeguard as a substitute for a documented risk-based decision.

• Administrative: Security responsibilities, workforce procedures, incident handling, periodic evaluations, and documented decisions about safeguards.
• Physical: Facility and equipment access procedures, visitor controls, workstation security, and protection of devices or media that contain ePHI.
• Technical: Access controls, audit controls, integrity protections, and safeguards for electronic transmissions, supported by procedures and records showing how they are applied.
• Contingency plan and disaster recovery: Keep documented plans for data backup, restoring lost data, and continuing critical operations in emergency mode. Identify the systems and data needed for patient care and other essential functions, responsible staff, and how the hospital will operate if usual systems are unavailable.
• Testing and improvement: Retain test plans, results, identified gaps, and corrective actions. Periodically test whether backed-up data can be restored and whether staff understand emergency workflows.

HHS identifies backup, disaster recovery, emergency-mode operations, and testing and revision procedures as components of contingency planning. Its Ransomware and HIPAA guidance also discusses testing restorations and preparing to recover ePHI after an emergency.

Which HIPAA training and compliance records must be retained

Keep records that show workforce members received training relevant to their security and privacy responsibilities, along with the materials, policies, and procedures used. Records may include completion dates, attendance, training topics, and follow-up for individuals who missed or did not complete assigned training.

The Security Rule requires a security awareness and training program for workforce members, but it does not establish a universal annual certificate-renewal schedule. Follow your employer’s training policies and any other requirements that apply to your organization; a training completion certificate is evidence of training, not proof that the hospital as a whole is HIPAA-compliant. See the HHS Summary of the HIPAA Security Rule.

Retain required HIPAA documentation—including applicable written policies and required records of actions, activities, and assessments—for six years from its creation or the date it was last in effect, whichever is later. This is a documentation-retention rule, not a general HIPAA requirement to keep patient medical records for six years. State law or other requirements may set different medical-record retention rules. See the HHS Audit Protocol’s documentation and retention criteria and HHS guidance on medical-record retention.

How to verify business associate agreements and vendor coverage

Compare your vendor inventory with the services that create, receive, maintain, or transmit PHI on the hospital’s behalf. A vendor may be a business associate because of the function it performs and its relationship to the hospital—not simply because it is labeled a “vendor.”

• Identify relevant vendors, such as service providers handling billing, cloud hosting, data storage, IT support, patient communications, or other PHI-related services.
• Determine whether each arrangement makes the vendor a business associate, and document the basis for the decision, including any applicable exception.
• Keep the executed business associate agreement (BAA), amendments, service descriptions, and a process for reviewing the agreement when the relationship or services change.
• Check that the agreement addresses permitted uses and disclosures, safeguards, reporting of impermissible uses or breaches, access to information needed for patient rights, and relevant subcontractors.
• Confirm that business associates have appropriate written arrangements with subcontractors that handle PHI on their behalf.

HHS explains that a covered entity must obtain satisfactory assurances through a written contract or other arrangement when it engages a business associate, and describes required BAA provisions in its Business Associates guidance. For cloud services involving ePHI, review HHS guidance on HIPAA and cloud computing.

How to document and respond to suspected breaches

Maintain a written process for reporting and responding to suspected security incidents and privacy violations. For each event, keep a secure case file that records the discovery date, report details, systems and information involved, investigation steps, containment and mitigation, decision-makers, findings, and actions taken to prevent recurrence.

• Preserve relevant system logs and other evidence, and document who collected or reviewed them and when.
• Identify the types of PHI involved, the people or groups affected, and the circumstances of the access, use, or disclosure.
• Document whether the event was an impermissible use or disclosure and, when applicable, the breach risk assessment and its reasoning.
• Record required notifications or the documented basis for determining that notification was not required.
• Track corrective actions, responsible owners, due dates, and evidence of completion.

For a breach risk assessment, HHS identifies factors including the nature and extent of PHI involved, who received or used it, whether it was actually acquired or viewed, and the extent to which risk was mitigated. Breach-notification deadlines and reporting obligations depend on the circumstances and number of affected individuals; HHS states that individual notification must be made without unreasonable delay and no later than 60 days after discovery. Review the HHS Breach Notification Rule guidance and retain documentation of notifications or the reason they were not required.

Across the checklist, keep evidence that connects each risk or obligation to a responsible owner, an action, and a documented outcome. Current risk analysis, patient-rights procedures, access reviews, tested contingency plans, training records, vendor agreements, and incident files give reviewers a clear picture of how the hospital protects ePHI and responds when something goes wrong.

FAQs.

How often should a critical access hospital update its security risk analysis?

HIPAA does not set a fixed schedule for completing a new risk analysis. The process should be ongoing, with updates as needed when the hospital’s environment changes—for example, after a security incident, a significant organizational change, or the introduction of new technology. Document the timing and reasons for updates, as described in HHS risk-analysis guidance.

What HIPAA documentation must be retained for six years?

Retain required HIPAA policies and procedures and other documentation required by the Privacy and Security Rules for six years from creation or the date the document was last in effect, whichever is later. This includes applicable records of required actions, activities, and assessments. The six-year rule does not, by itself, require hospitals to retain patient medical records for six years; see HHS guidance on medical-record retention.

Which vendors need a business associate agreement?

A BAA is generally required when a vendor meets HIPAA’s business associate definition by performing a service or function on the hospital’s behalf that involves creating, receiving, maintaining, or transmitting PHI, subject to applicable exceptions. Review the service and data flows rather than relying only on a vendor’s label. HHS provides details in its Business Associates guidance.

What records should be kept when investigating a suspected breach?

Keep a secure record of when and how the event was discovered, the investigation and evidence reviewed, the PHI and individuals involved, containment and mitigation, the risk assessment and its rationale when applicable, notification decisions, corrective actions, and the final outcome. Retain evidence of required notifications—or the documented basis for deciding they were not required—in line with the HHS Breach Notification Rule guidance.