HIPAA Audit Readiness Checklist for State Employee Health Benefits Programs

A state employee health benefits program may involve a group health plan, the state agency sponsoring it, insurers, third-party administrators, and other vendors. Before assembling audit records, identify which entity performs each function and which records contain protected health information (PHI), including electronic protected health information (ePHI). A group health plan may be a HIPAA covered entity, while an employer acting only as an employer generally is not; certain small plans administered solely by their employer are an exception. HHS’s Summary of the HIPAA Privacy Rule explains covered-entity status and the small-plan exception.

Use this checklist to organize evidence for the applicable HIPAA Privacy Rule, HIPAA Security Rule, and HIPAA Breach Notification Rule requirements. It is a preparation tool, not a guarantee of compliance: OCR’s audit protocol evaluates selected requirements and may vary with the type of entity and audit scope. HHS’s OCR Audit Protocol describes the rules and evidence areas an audit may address.

What does a HIPAA audit review for a state employee health benefits program?

Start by documenting the program’s HIPAA roles and boundaries. Identify the group health plan or plans, the plan sponsor, any state office performing plan-administration functions, and the vendors that create, receive, maintain, or transmit PHI for a covered entity. Distinguish plan administration from the state’s ordinary employment, personnel, and benefits-management activities.

Build an audit index that maps each applicable requirement to the policy, procedure, system, responsible official, and evidence that demonstrates implementation. Common evidence includes current policies, plan documents, risk-analysis records, workforce training records, vendor agreements, access logs, privacy-rights request files, and breach investigations. Keep the index focused: OCR’s protocol says an entity should provide the specified documents requested, rather than relying on an auditor to locate evidence inside a large policy compilation. HHS’s OCR Audit Protocol explains its document-review approach.

Confirm the scope for each health benefit and data flow rather than assuming every state program component is covered in the same way. Certain fully insured group health plans with only enrollment information and summary health information may have limited Privacy Rule obligations; other plan arrangements can have broader requirements. HHS guidance on fully insured group health plans describes this distinction.

How should group health plan documents restrict PHI use and disclosure?

Review the plan document and related governing materials to verify that they restrict the plan sponsor’s use and disclosure of PHI to permitted purposes. When the plan provides or permits disclosures of PHI to the sponsor for plan administration, the documents generally must specify permitted uses and disclosures, prohibit other uses and disclosures, and include required safeguards and administration procedures. HHS guidance on group health plan disclosures to sponsors and 45 CFR § 164.504 describe the requirements.

• Confirm the plan documents limit plan-sponsor access to the PHI needed for plan administration and describe the permitted functions.
• Identify the sponsor’s employees or classes of employees who may access PHI, and restrict access to those functions.
• Document procedures to prevent and address unauthorized uses or disclosures, including reporting, mitigation, and appropriate sanctions.
• Verify the plan sponsor will make relevant records available to the Secretary of HHS for compliance review and will return or destroy PHI when feasible after the plan-administration need ends.

Put group health plan sponsor separation into practice, not just into plan language. Keep claims, clinical, and other plan-administration PHI apart from employment records and decisions. Provide role-based access, confidentiality commitments, procedures for permitted sponsor disclosures, and a process for reporting improper access. The Privacy Rule permits limited disclosures such as summary health information for specified plan purposes and enrollment or disenrollment information; these limited permissions do not authorize general access to individual claims or clinical details. 45 CFR § 164.504(f) sets out the group health plan requirements.

Which governance policies and risk analysis records should be ready?

Keep an approved, current set of policies and procedures for privacy, security, and breach response. Identify the officials responsible for privacy and security, the individuals who receive complaints or incident reports, and the process for approving, communicating, and updating policies. Retain dated versions and evidence that the procedures are put into practice.

For the HIPAA risk analysis, prepare documentation that shows what ePHI the program creates, receives, maintains, or transmits; where it resides; which people and vendors can access it; and what threats and vulnerabilities could affect its confidentiality, integrity, or availability. Include the analysis method, findings, likelihood and impact considerations, existing safeguards, and decisions about reducing identified risks. The Security Rule requires an accurate and thorough assessment of risks and vulnerabilities to ePHI. 45 CFR § 164.308(a)(1)(ii)(A) states the risk-analysis requirement.

Show how the analysis is kept relevant: document significant changes in systems, vendors, benefits operations, facilities, or threats, and record follow-up reviews and risk-management decisions. HIPAA does not set one universal calendar interval for repeating a risk analysis. HHS explains that entities should review and update it as needed in light of changes to their environments and risks. HHS Guidance on Risk Analysis discusses periodic review and updates.

Also organize required HIPAA documentation by record type and retention period. The Privacy and Security Rules generally require covered entities to retain specified policies, procedures, and compliance documentation for six years from creation or the date it was last in effect, whichever is later. 45 CFR § 164.530(j) and 45 CFR § 164.316(b)(2) address documentation and retention.

How can programs document workforce training and incident response?

Maintain training evidence that identifies the workforce members covered, the training date, the topics addressed, and the policy or course version used. Include contractors and other workforce members who may access PHI, as appropriate to their roles. Keep records of onboarding and role-specific instruction, as well as additional training when relevant policies or procedures materially change.

Training should explain how to handle PHI, recognize and report suspected incidents, use approved systems, and follow sponsor-separation and access-control procedures. HIPAA requires workforce training in applicable policies and procedures, but it does not impose a universal annual certificate-renewal requirement. Apply employer-specific training schedules and document the program’s own requirements. 45 CFR § 164.530(b) addresses Privacy Rule training, while 45 CFR § 164.308(a)(5) addresses Security Rule security-awareness and training.

Prepare incident-response records that show how reports are received, triaged, investigated, escalated, and resolved. For each suspected improper use or disclosure, record the known facts, dates, systems and information involved, individuals or entities affected, containment and mitigation steps, and the rationale for the outcome. Include follow-up actions, such as access changes, corrective training, sanctions where appropriate, or system improvements.

For a possible breach of unsecured PHI, retain the breach analysis and notification decision. An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or the covered entity or business associate demonstrates a low probability that the PHI was compromised through a risk assessment that considers the information involved, the recipient, whether it was actually acquired or viewed, and mitigation. Document required notifications or the basis for concluding they were not required. HHS’s Breach Notification Rule guidance describes the assessment and documentation duties.

What technical and physical safeguards should the checklist cover?

Map safeguards to the systems and locations that handle ePHI, including plan-administration platforms, employer portals, email, file transfers, paper-to-digital workflows, backups, and vendor-hosted environments. The HIPAA Security Rule requires administrative, physical, and technical safeguards; the evidence should show both the written control and how the program implements and reviews it. 45 CFR § 164.306 states the general Security Rule requirements.

• Administrative safeguards: Prepare workforce authorization and supervision procedures, access-management processes, security-awareness records, incident-response procedures, contingency planning, and periodic evaluations.
• Physical safeguards: Document facility and room access controls, workstation-use rules, device and media handling, secure storage, disposal, and procedures for equipment containing ePHI.
• Technical safeguards: Show how unique user access, emergency access, audit controls, integrity protections, person or entity authentication, and transmission security are addressed.

Gather samples that demonstrate operation: access approvals and removals, periodic access reviews, relevant audit logs, backup and recovery test results, incident tickets, device inventory, and facility-access records. HIPAA’s Security Rule includes standards for access control, audit controls, integrity, authentication, and transmission security; tailor the evidence to the systems and risks identified in the program’s risk analysis. 45 CFR § 164.312 lists the technical safeguard standards.

How should business associates and vendors be assessed?

Maintain a current inventory of vendors and other business associates, recording their services, PHI access, system connections, business owner, agreement status, and relevant subcontractors. Assess each relationship based on what the vendor does and whether it creates, receives, maintains, or transmits PHI on behalf of the covered entity; do not assume every vendor or insurer automatically has the same HIPAA role. HHS’s covered entities and business associates guidance explains the HIPAA role definitions.

For each business associate, verify a current business associate agreement (BAA) or other permitted written arrangement. Check that it addresses permitted uses and disclosures, safeguards, reporting of impermissible uses and security incidents, breach reporting, support for individual rights where relevant, and return or destruction of PHI when feasible at termination. If a business associate uses a subcontractor to handle ePHI, verify that required assurances flow down through the subcontractor arrangement. 45 CFR § 164.504(e) and 45 CFR § 164.308(b) set out the Privacy and Security Rule contract requirements.

Organize evidence of follow-up on vendor incidents, reported security events, contract changes, and identified risks. HIPAA requires appropriate written assurances and contracts; the program should retain records showing how it handles reports and addresses identified issues. HHS notes that covered entities are not generally required to monitor every means by which a business associate implements safeguards, but they must take action if they know of a material breach or violation of the agreement. HHS guidance on covered entities and business associates explains this distinction.

Are privacy notices, access requests, and breach records complete?

Keep the health plan’s current Notice of Privacy Practices and prior versions, along with records showing how the notice is made available and distributed as required. Confirm that the notice explains permitted uses and disclosures, individual rights, and how to submit questions or complaints. A health plan’s notice obligations are distinct from the acknowledgement-of-receipt procedures that apply to health care providers. HHS’s Notice of Privacy Practices guidance summarizes what notices communicate.

Maintain a log of access, amendment, and accounting requests with the received date, request scope, assigned owner, response and completion dates, any permitted extension and notice to the individual, and the final response. Include records of denials and required supporting documentation. A covered entity generally must act on an access request within 30 calendar days; it may use one additional 30-day period if it gives the individual a written explanation and completion date within the initial period. HHS guidance on access-request timing describes the deadline and extension.

For suspected breaches, keep a complete case file that connects the initial report to the investigation, risk assessment, mitigation, notification decision, and any follow-up. If notification is required, individual notices must be provided without unreasonable delay and no later than 60 calendar days after discovery. If the program concludes notice is not required, retain the assessment or other documented basis for that decision. HHS’s Breach Notification Rule guidance describes notification timing and documentation.

An audit-ready program can quickly produce records that match its actual operations: clear plan-sponsor boundaries, a documented and updated HIPAA risk analysis, trained personnel, safeguards tied to ePHI risks, current vendor agreements, and complete rights-request and incident files. Review the evidence periodically and correct gaps before an audit request arrives.

FAQs

What HIPAA audit records should a state employee health benefits program prepare?

Prepare records for the applicable covered entity or business associate, organized by requirement: governing plan documents, privacy and security policies, risk-analysis and risk-management records, workforce training, safeguards, BAAs, individual-rights request files, and breach and incident documentation. Keep an index that identifies the responsible office and points to evidence showing how each process operates. OCR’s document requests depend on the entity and audit scope, so confirm the specific request rather than sending an undifferentiated collection of policies. HHS’s OCR Audit Protocol describes the audit approach.

How must a group health plan separate plan administration from employment functions?

When the plan shares PHI with its sponsor for plan administration, the plan documents must restrict sponsor use and disclosure and identify the permitted plan-administration functions. Operationally, limit PHI access to authorized sponsor personnel performing those functions, safeguard the information, and keep plan administration separate from employment decisions and ordinary personnel functions. Limited disclosures, such as enrollment information or specified summary health information, have their own rules and do not create general access to individual PHI. 45 CFR § 164.504(f) sets out the requirements.

What evidence demonstrates that a HIPAA risk analysis is current?

Keep the analysis date, scope, ePHI inventory and data flows, systems and vendors assessed, methodology, findings, risk decisions, and remediation status. Also retain records showing that the program reviewed whether material changes—such as a new system, vendor, workflow, or threat—required an update. HIPAA does not prescribe one universal annual interval; the analysis should be reviewed and updated as needed. HHS Guidance on Risk Analysis explains ongoing review and updates.

How should the program document a suspected breach and its notification decisions?

Create a case file recording when and how the event was reported, the PHI and individuals involved, the investigation, containment and mitigation, and the decision about whether the event is a breach requiring notification. For an impermissible use or disclosure, document any applicable exception or the risk assessment supporting a conclusion that there was a low probability the PHI was compromised. If notice is required, retain copies and dates of notifications; if it is not, retain the supporting rationale. HHS’s Breach Notification Rule guidance describes the risk assessment and documentation requirements.