HIPAA Audit Readiness Checklist for Volunteer and Charitable Free Clinics

A clinic’s charitable status, volunteer staffing, and ability to provide free care do not by themselves determine whether HIPAA applies. If your clinic is a covered entity or business associate, this checklist can help you organize evidence that your policies and safeguards are in place and working.

How to determine whether HIPAA applies to your clinic

Start by identifying the legal organization that operates the clinic and how it handles health information. A health care provider—including a clinic—is generally a HIPAA covered entity if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as an eligible billing transaction. This can apply when a billing service or another third party conducts the transaction on the provider’s behalf. Ordinary email use alone does not establish covered entity status. Review HHS guidance on covered entities and its explanation of who must comply.

Document the facts behind your HIPAA covered entity status assessment: services provided, transactions conducted, how those transactions are conducted, and any billing or technology intermediaries involved. If the clinic does not meet the covered entity definition, check whether it handles protected health information on behalf of a covered entity as a business associate. HIPAA status is a legal question based on the organization’s activities and relationships—not on whether the clinic charges patients.

Keep in mind that state privacy laws, grant or funding conditions, contracts, professional obligations, and clinic policies may impose requirements even when HIPAA does not apply. Record who reviewed the clinic’s status, when the review occurred, and what facts or changes would trigger a reassessment.

What to include in a documented security risk analysis

If the clinic is subject to the Security Rule, maintain a written Security Rule risk analysis that reflects the clinic’s actual environment. HHS calls for an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information (ePHI). See HHS guidance on risk analysis.

As a practical checklist, document:

• Where ePHI is created, received, maintained, or transmitted, including systems, devices, backups, paper-to-electronic workflows, and remote access.
• Who can access the information and how volunteers, staff, clinicians, interpreters, contractors, and vendors use it.
• Potential threats and vulnerabilities, existing safeguards, and the likelihood and potential impact of each risk.
• Risks that need action, the planned measures to address them, responsible people, target dates, and any remaining risk accepted by clinic leadership.
• The date of the analysis, the people involved, and the material changes or new information considered.

Pair the analysis with a risk-management plan and track corrective actions to completion. HIPAA does not set a single fixed annual interval for repeating the risk analysis; the clinic should reassess when relevant environmental or organizational changes affect ePHI risks and regularly reevaluate its safeguards. HHS summarizes these Security Rule duties in its Security Rule overview.

How to assign privacy and security responsibilities

Write down who is accountable for privacy and security, including who makes decisions when the clinic has limited staff or relies on volunteers. Covered entities must designate a privacy official and a contact for privacy-related questions or complaints; Security Rule entities must designate a security official. One person may hold multiple roles when appropriate, but the responsibilities should be clear. See HHS’s Privacy Rule summary and Security Rule overview.

Keep current records of role assignments, reporting lines, delegated tasks, and escalation contacts. Define who approves access, reviews incidents, oversees vendors and business associate agreements, updates policies, handles patient privacy concerns, and coordinates breach notification procedures. Document backup coverage so that essential duties do not lapse when a volunteer or staff member is unavailable.

Which workforce training and oversight records to maintain

HIPAA’s definition of workforce includes volunteers, trainees, employees, and certain other people whose work is under the covered entity’s direct control, whether or not they are paid. A volunteer’s access and training should match their actual duties. HHS notes that Privacy Rule training should be appropriate to the functions each workforce member performs; the Security Rule also requires training workforce members on security policies and procedures. See HHS’s explanation of the workforce definition and its Security Rule overview.

Maintain records that show what training was provided and who completed it. Useful evidence includes training dates, topics, attendance or completion confirmations, relevant policy acknowledgments, and role-specific instructions on handling patient information, reporting concerns, and using clinic systems. Also retain supervision and access-approval records, policy violations, sanctions when applicable, and corrective actions.

Do not treat a training certificate as proof that the organization is HIPAA compliant. Nor is annual certificate renewal a universal federal requirement. Set refresher training and oversight according to clinic policy, changes in duties or technology, and identified risks; document the clinic’s approach.

How to verify access controls and audit logs

Compare each person’s system access with their job or volunteer duties. A role-based access control approach can help ensure that a volunteer sees only the information needed for assigned tasks. Keep an access roster that records approved systems and permissions, who authorized them, changes made, and when access was removed. Periodically review access, especially after a role change or departure.

Verify that the clinic uses individual user accounts where appropriate, has procedures for approving and changing access, and can promptly disable access that is no longer needed. Check that audit controls record and allow review of activity in systems containing or using ePHI. Retain evidence of log reviews, unusual activity investigated, and follow-up actions. The Security Rule requires appropriate access authorization and mechanisms to record and examine system activity; see HHS’s description of Security Rule safeguards.

Keep a record of how the clinic tests these controls—for example, a sample review of active accounts, access levels, or system logs—and how it resolves findings. Select safeguards in light of the clinic’s risks and circumstances rather than assuming that a particular product or configuration automatically establishes compliance.

How to document physical safeguards and secure device disposal

Document how the clinic limits physical access to areas and equipment that can expose ePHI. Evidence may include room or cabinet access procedures, visitor practices, workstation placement, screen-lock expectations, rules for shared workstations, and steps for protecting devices used off-site. The Security Rule’s physical safeguards include facility access controls, workstation use and security, and device and media controls. See HHS’s explanation of physical safeguards.

Maintain an inventory or other reliable record of devices and media that may contain ePHI, who is responsible for them, and how they are tracked when moved, repaired, reused, or retired. Document the process for securely removing ePHI before reuse and for final disposition of equipment or media, including who performed or verified the action. Apply privacy protections to paper records as well; the Security Rule’s physical safeguards concern electronic information systems, while other applicable HIPAA Privacy Rule duties cover protected health information in other forms.

How to organize audit evidence and test incident response

Organize evidence so the clinic can quickly show what policy applies, who is responsible, and how the clinic follows the policy in practice. A secure, access-restricted evidence repository can contain current policies, risk analysis and risk-management records, role assignments, workforce training records, access approvals and reviews, audit-log review records, device-disposal documentation, and relevant vendor agreements. Keep an index with document owners, dates, and review status.

HIPAA Security Rule documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. This is a documentation requirement, not a universal six-year retention period for every medical record. Other laws or agreements may set different or longer retention periods. See HHS’s Security Rule documentation requirements.

Maintain written security incident procedures that tell workforce members how to report suspected problems, who investigates, how the clinic limits harm, and how findings and outcomes are documented. Test the process with a tabletop exercise or other practical review, then record lessons and corrective actions. Maintain breach notification procedures as well: an impermissible use or disclosure of unsecured PHI generally must be assessed under the Breach Notification Rule, and required notifications may apply. See HHS’s Breach Notification Rule guidance.

Review vendor relationships and identify whether a vendor creates, receives, maintains, or transmits PHI on the clinic’s behalf. When the vendor is a business associate, keep the applicable written business associate agreement (BAA) and evidence that the agreement and service arrangement are current. HHS explains the relevant responsibilities in its business associate guidance.

In summary, audit readiness comes from knowing whether HIPAA applies, assigning clear responsibility, maintaining a risk-based set of safeguards, and keeping organized evidence that the clinic follows and tests its procedures.

FAQs

Are volunteer and charitable free clinics subject to HIPAA?

They may be. A clinic’s nonprofit or charitable status and use of volunteers do not determine HIPAA coverage. A clinic may be a covered entity if it conducts certain standard electronic health care transactions, directly or through another party, or it may have business associate obligations because it handles PHI on behalf of a covered entity. Review the clinic’s actual activities and relationships using HHS’s covered entity guidance.

What records should a clinic prepare for a HIPAA audit?

Prepare the records relevant to the clinic’s HIPAA role and the safeguards being reviewed: policies and procedures, risk analysis and risk-management records, privacy and security role assignments, workforce training and oversight evidence, access approvals and reviews, audit-log review records, physical safeguard and device-disposal documentation, incident and breach records, and applicable BAAs. HIPAA Security Rule documentation is generally retained for six years from creation or the date it was last in effect, whichever is later.

How often should a clinic review its security risk analysis?

HIPAA does not prescribe one fixed annual interval for every clinic. The clinic should regularly reevaluate risks and review the analysis when changes—such as new systems, devices, workflows, locations, or recognized threats—may affect ePHI security. Record the review and any resulting risk-management actions.

Do clinics need business associate agreements with vendors?

A covered entity generally needs a BAA when a vendor qualifies as a business associate by performing certain services for the clinic that involve PHI. The agreement should address permitted uses and disclosures, safeguards, and required reporting, among other terms. Not every vendor is a business associate; assess the service and the vendor’s relationship to PHI, and consult HHS’s business associate guidance.