HIPAA Audit Readiness Checklist for Self-Funded Health Plans and TPAs

A HIPAA review is easier to manage when you can show who is responsible for each function, where protected health information (PHI) flows, and how the plan protects it. Use this checklist to organize evidence for a self-funded group health plan, its plan sponsor, and its third-party administrator (TPA).

HIPAA audit readiness is not the same as a certification. Reviewers may examine different requirements depending on whether an organization is a covered entity, a business associate, or both. The HHS OCR audit protocol explains that reviews address selected requirements and may vary by entity type.

Which HIPAA rules and audit requirements apply to self-funded health plans and TPAs?

A self-funded arrangement is not automatically outside HIPAA. A group health plan that meets HIPAA’s definition is generally a covered entity, whether it is self-funded or fully insured. One important exception is an employee welfare benefit plan with fewer than 50 participants that is self-administered. Check the plan’s facts and applicable definition rather than relying on its funding arrangement alone. HHS explains these distinctions in its covered entity guidance.

A TPA does not become a covered entity simply by administering a health plan. It generally acts as the plan’s business associate when it handles PHI to perform services for the plan. A TPA may separately be a covered entity if its other activities meet HIPAA’s definition. Confirm the TPA’s role for each service and its data flows; the HHS TPA guidance explains this distinction.

For audit preparation, identify which requirements apply to each party under the Privacy Rule, Security Rule, and Breach Notification Rule. A useful starting point is an inventory of covered functions, PHI and electronic PHI (ePHI), systems, service providers, and applicable contracts. OCR’s protocol can help you organize evidence, but it does not replace a review of the plan’s specific obligations.

How should plan sponsor and TPA responsibilities be documented?

Start with the plan documents, administrative services agreement, business associate agreement (BAA), and any related operating procedures. Together, these records should make clear who performs plan administration, who handles PHI, which tasks are delegated, and how the plan sponsor, plan, and TPA communicate about privacy, security, and incidents.

If the group health plan permits its plan sponsor to receive PHI for plan administration, the plan documents must address permitted uses and disclosures and the required separation between plan administration and employment functions. Identify the employees or roles authorized to access PHI, limit their access to plan duties, and document how the plan sponsor prevents employment-related use or disclosure. See HHS guidance on plan sponsors and group health plans.

Make responsibility assignments specific. For example, document who approves access, handles individual privacy requests, investigates incidents, determines whether a breach notification is required, maintains records, and tracks corrective actions. A responsibility matrix can supplement formal agreements, but it should not conflict with the plan documents or BAA.

Which HIPAA policies and procedures should be available for review?

Prepare the current, approved policies and procedures that apply to the plan and its workforce. Depending on the organization’s role and activities, reviewers may ask for privacy, security, access management, workforce, incident response, breach notification, contingency planning, and records-management procedures.

For the Security Rule, organize documentation showing how the organization implements its administrative, physical, and technical safeguards. Include approval and revision dates, responsible roles, and evidence that relevant procedures are communicated and used. HHS’s Security Rule overview describes requirements for policies, procedures, documentation, and updates.

Include plan documents and privacy materials where applicable, such as the group health plan’s Notice of Privacy Practices and procedures for responding to individual rights requests. Applicability can vary—for example, some fully insured group health plans have limited Privacy Rule administrative responsibilities—so document the basis for any exception rather than assuming it applies to a self-funded plan.

HIPAA-required Security Rule documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. Confirm retention practices against the applicable requirements and any other legal or contractual obligations.

What evidence demonstrates compliance with the Security Rule safeguards?

Organize evidence around the safeguards the plan or business associate actually uses to protect ePHI. A reviewer should be able to connect identified risks to selected safeguards and see that those safeguards are operating, not just described in policy.

• Risk analysis: Keep the documented HIPAA Security Rule risk analysis, its scope, systems and data covered, identified threats and vulnerabilities, risk ratings, and the date of review.
• Access controls: Maintain role and access lists, authorization approvals, termination records, and access control audit logs showing relevant system activity. Keep documentation of how access is reviewed and inappropriate access is addressed.
• Technical safeguards: Organize evidence for authentication, audit controls, integrity protections, and transmission security, as applicable to the environment.
• Physical safeguards: Gather procedures and records related to facility access, workstations, and devices or media that store or transmit ePHI.
• Contingency planning: Prepare backup, disaster recovery, and emergency-mode procedures, along with records of tests or other evaluations.
• Evaluation and monitoring: Keep periodic technical and nontechnical evaluations, security updates, and documentation of changes made in response to findings.

The Security Rule is designed to be flexible: safeguards should be reasonable and appropriate for the organization’s size, capabilities, infrastructure, and risks. HHS explains that a risk analysis is foundational and should cover ePHI the organization creates, receives, maintains, or transmits in its risk analysis guidance.

How can teams document workforce training and incident response?

Keep a training record that identifies the workforce member, training date, topics or materials covered, and completion evidence. Training should fit each person’s role and the organization’s policies. HIPAA requires appropriate workforce training, but it does not establish a universal annual certificate-renewal requirement for every workforce member. Maintain records that show how training is provided and updated when relevant policies, technology, or practices change. See HHS’s Privacy Rule training guidance and Security Rule overview.

For incident response, preserve procedures and case records showing when an event was reported, how it was assessed, who made decisions, what steps were taken to contain or mitigate it, and how the outcome was documented. Distinguish a security incident from a breach of unsecured PHI: not every security incident is a reportable breach, but the response and assessment should be documented.

When an impermissible use or disclosure may involve unsecured PHI, retain the breach notification documentation: the required notices and evidence of when they were sent, or the assessment and records supporting a determination that notification was not required. HHS describes the notification rules and documentation burden in its Breach Notification guidance.

Which business associate agreements and vendor records should be prepared?

Prepare a current inventory of vendors and service providers that create, receive, maintain, or transmit PHI for the plan or a business associate. For each relationship, record the service provided, PHI involved, responsible owner, contract status, and whether a BAA is required. A BAA is generally required when a covered entity engages a business associate to handle PHI on its behalf; HHS explains the requirement in its Business Associates guidance.

Review each applicable BAA for the required terms, including permitted uses and disclosures, safeguards, incident reporting, breach notification, and return or destruction of PHI when feasible at contract termination. Keep signed agreements, amendments, and records showing which services and data flows they cover.

Also organize relevant subcontractor records. A business associate generally must obtain written assurances from subcontractors that handle PHI on its behalf. Vendor security assessments, independent reports, incident records, or other evidence may support oversight, but do not describe a particular assessment or certification as a universal HIPAA requirement unless a contract or another applicable rule requires it.

How should the organization track risk assessments and corrective actions?

Maintain a risk register that ties each identified threat or vulnerability to its likelihood, potential impact, current safeguards, and planned response. For every corrective action, identify an accountable owner, target date, priority, approval or risk-acceptance decision, and evidence used to verify completion. This turns the risk analysis into a working risk management plan rather than a standalone report.

There is no fixed HIPAA schedule requiring every organization to complete a risk analysis annually. HHS says the process should be ongoing, with frequency based on the organization’s circumstances. Review and update the HIPAA Security Rule risk analysis when changes in systems, operations, vendors, threats, or security incidents may affect ePHI. The HHS risk analysis guidance explains that updates should help identify when security measures need to change.

Keep earlier assessments and corrective-action records so you can show how risks were addressed over time. Periodically evaluate whether completed controls remain effective, document delays or accepted risks with appropriate approval, and revise the risk management plan when new findings require further work.

In short, audit readiness depends on clear role assignments, current policies and agreements, evidence that safeguards operate, and documented follow-through on risks and incidents. Keep those records organized across the plan, plan sponsor, TPA, and relevant vendors.

FAQs

Is a self-funded health plan a HIPAA covered entity?

Often, yes. A group health plan that meets HIPAA’s definition is generally a covered entity regardless of whether it is self-funded. An exception applies to an employee welfare benefit plan with fewer than 50 participants that is self-administered. Confirm the plan’s status using the applicable definition and facts; see HHS covered entity guidance.

What HIPAA responsibilities belong to the plan sponsor versus the TPA?

The group health plan is generally the covered entity. A plan sponsor may perform plan administration functions and receive PHI only under applicable Privacy Rule conditions, including required plan-document provisions and separation from employment functions. A TPA generally acts as a business associate when it handles PHI on the plan’s behalf and must meet applicable business associate obligations. The agreements and plan documents should define the parties’ specific duties. See HHS plan sponsor guidance and HHS TPA guidance.

Which documents should be ready for a HIPAA audit?

Prepare the applicable plan documents, policies and procedures, risk analysis, risk management plan, safeguard evidence, access records, training records, incident and breach notification documentation, BAAs, vendor inventory, and corrective-action records. The exact items depend on the entity’s role and the requirements being reviewed; the HHS OCR audit protocol can help you organize documentation.

How often should a HIPAA risk analysis be updated?

HIPAA does not set one fixed interval for every organization. Treat the analysis as an ongoing process and review it when changes or incidents may affect ePHI risks; set a periodic review schedule suited to your environment. HHS explains this approach in its risk analysis guidance.