HIPAA Audit Readiness Checklist for Women and Infants Hospitals

A HIPAA audit can examine whether your hospital’s policies, safeguards, and day-to-day practices protect patient information. For a women and infants hospital, readiness also means accounting for the distinct workflows and records involved in labor and delivery, newborn care, the NICU, lactation services, and family access to information.

Use this checklist to organize evidence and identify gaps. It supports audit preparation; it does not certify that an organization is HIPAA compliant.

How to conduct and document an enterprise-wide security risk analysis

Start with an enterprise-wide Security Rule risk analysis covering all ePHI the hospital creates, receives, maintains, or transmits. Include systems and workflows in clinical and administrative areas, as well as relevant third-party services. HHS explains that the analysis must be accurate and thorough, but the Security Rule does not prescribe a particular format. See HHS guidance on risk analysis.

Build an ePHI inventory that identifies where information resides and how it moves. Consider the EHR, laboratory and imaging systems, fetal monitoring, pharmacy systems, patient portals, mobile devices, backups, interfaces, and vendor-hosted platforms. Map how maternal and newborn records are created, linked, accessed, and shared, including in labor and delivery and the NICU.

For each system and workflow, document relevant threats and vulnerabilities, existing safeguards, the likelihood and potential impact of harm, and the resulting risk. Record who performed the analysis, when it was completed, what was in scope, and how findings were prioritized. Link each significant risk to an owner, mitigation action, target date, and status.

Keep the analysis current when circumstances change—for example, after a security incident, a major technology or workflow change, or a change in the hospital’s operating environment. HHS states that there is no single federally prescribed frequency; the appropriate timing depends on the organization and its circumstances. The risk-analysis process should be ongoing, not treated as a one-time exercise.

Which HIPAA policies and records should be ready for review

Organize current, approved policies and the records showing how staff follow them. A reviewer may need to see both the written procedure and evidence of its implementation. Keep an indexed audit file so responsible staff can retrieve records without searching across departments.

• Security and privacy policies, including risk management, workforce access, sanctions, and security incident response.
• Privacy practices covering permitted uses and disclosures, patient requests, identity verification, and minimum necessary standard procedures where applicable.
• Risk analyses, risk-management plans, security evaluations, remediation records, and documented approvals.
• Access authorization records, workforce role assignments, account changes, termination records, and access review evidence.
• Training records, business associate agreements, incident and breach files, and contingency-plan test records.
• Records showing that policies and procedures were reviewed and updated when needed.

The Security Rule requires covered entities to maintain written or electronic security policies and required documentation. Security Rule documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later. Check other applicable requirements before disposing of records, since they may call for a longer period. See the HHS HIPAA Audit Protocol.

How to manage patient privacy rights and disclosures

Be ready to explain how the hospital receives, routes, tracks, and responds to patient requests involving access, amendment, confidential communications, restrictions, and accounting of disclosures. Keep procedures clear about which office owns each step and how requests are referred when records are held by a business associate.

For a hospital serving mothers and infants, check that staff can distinguish maternal records from newborn records and verify the identity and authority of anyone requesting information. Document how staff handle requests involving parents, guardians, personal representatives, and other family members under applicable law and hospital policy. Do not assume that a family relationship alone establishes authority to receive every record.

Review disclosure workflows for common settings such as the bedside, nursery, NICU, telephone calls, patient portals, and care coordination. Train staff to verify recipients, use approved communication channels, and apply the minimum necessary standard when it applies. HIPAA’s minimum necessary rule generally calls for reasonable efforts to limit access and disclosures to what is needed for the purpose, with exceptions such as disclosures for treatment. See HHS guidance on the minimum necessary requirement.

Retain request logs, response records, disclosure documentation where required, and evidence of how exceptions or denials were handled. HHS explains that covered entities remain responsible for fulfilling individual rights even when relevant information is maintained by a business associate. See HHS guidance on business associates and individual rights.

How to verify role-based ePHI access and audit-log reviews

Compare current system permissions with job responsibilities and document the rationale for access. Role-based access control can help align permissions with duties, but HIPAA does not require one specific access-control model. Check that access is approved, changed when duties change, and promptly removed when no longer needed.

Include roles across clinical and support services—such as obstetrics, midwifery, pediatrics, neonatology, nursing, laboratory, registration, billing, and IT. Review any elevated or emergency access and verify that procedures define when it may be used and how it is reviewed afterward. Confirm that accounts are individually assigned where appropriate and that shared or service accounts have documented controls.

The Security Rule requires mechanisms to record and examine activity in systems containing ePHI, as well as procedures to regularly review information-system activity. Establish a risk-based schedule for audit log review and document the systems reviewed, time period, reviewer, alerts or unusual activity identified, follow-up, and resolution. HHS’s HIPAA Audit Protocol identifies audit logs, access reports, and security incident tracking reports as examples of records to review.

Test the process using appropriate scenarios, such as unusual access to a patient record or access by a workforce member without a current care or business need. Keep evidence that identified concerns were investigated and escalated under hospital policy.

Which physical and technical safeguards should the checklist cover

Check that safeguards reflect the hospital’s environment and protect the confidentiality, integrity, and availability of ePHI. The Security Rule allows flexibility in how covered entities implement safeguards, taking their size, capabilities, infrastructure, costs, and risks into account. Document the safeguards selected and how they address identified risks.

• Physical safeguards: Review facility access procedures, visitor controls, secure records areas, workstation placement, screen privacy, and controls over devices and media. Consider public-facing areas such as registration desks, corridors, family rooms, and shared clinical workspaces.
• Technical safeguards: Review user access controls, authentication, unique user identification, emergency access procedures, automatic logoff where appropriate, audit controls, and protections for data in transit and at rest.
• Device and media handling: Check processes for inventory, secure storage, movement, reuse, and disposal of devices or media that contain ePHI.
• Operational checks: Confirm that security settings and procedures are in place, tested where appropriate, and consistent with current policies and documented risk decisions.

HIPAA’s implementation specifications are designated as required or addressable. Addressable does not mean optional without review: assess whether the specification is reasonable and appropriate in the hospital’s circumstances, and document the decision and any alternative measure. See the HHS summary of the HIPAA Security Rule.

How to document workforce training and business associate oversight

Maintain records showing that workforce members received training relevant to their responsibilities and the hospital’s policies. Include employees, volunteers, trainees, and other workforce members as applicable. Keep training dates, topics, completion records, and follow-up for people who missed or need additional instruction. Provide role-specific reminders for staff handling maternal and newborn records, privacy requests, disclosures, and suspected security incidents.

HIPAA requires security awareness and training for workforce members, but it does not establish a universal annual certificate-renewal requirement. A completion certificate documents participation in training; it does not, by itself, establish that the hospital is compliant. Maintain employer-specific policy training and document how staff can access current procedures.

Keep a current inventory of business associates and the services they provide, then match each relationship to a signed business associate agreement where HIPAA requires one. Review whether the agreement describes permitted and required uses and disclosures, requires appropriate safeguards, addresses incident and breach reporting, supports the hospital’s obligations for patient rights, and flows applicable requirements to subcontractors. See HHS guidance on business associate agreements.

Track agreement status, responsible contract owners, renewal or review dates under hospital policy, and any reported incidents or unresolved issues. HIPAA does not generally require a covered entity to monitor every operational detail of a business associate, but if the hospital learns of a material breach or violation of the agreement, it must take reasonable steps to address it. See HHS guidance on responding to business associate violations.

How to prepare incident response and contingency plans

Keep a written process for receiving, triaging, investigating, documenting, and escalating suspected security incidents. Make reporting channels accessible to staff on every shift and define responsibilities for privacy, security, clinical operations, legal, and communications teams. Document incident timelines, systems and information involved, containment actions, findings, corrective steps, and approval of closure.

For a potential breach involving unsecured PHI, preserve relevant evidence and document the assessment, including the nature and extent of the information, who received or used it, whether it was actually acquired or viewed, and what mitigation occurred. If the hospital concludes that notification is not required, retain the risk assessment or documentation supporting an applicable exception. HHS explains the breach presumption, assessment factors, and notification requirements in its Breach Notification Rule guidance.

Prepare and maintain a disaster recovery plan as part of the broader contingency plan. The HIPAA Security Rule contingency-planning provisions include data backup, disaster recovery, and emergency-mode operation. Identify critical systems and dependencies needed to support patient care, including access to essential clinical information during downtime. Keep evidence of testing, revisions, and staff responsibilities. See HHS guidance on Security Rule contingency planning.

As a final readiness check, assign owners to each checklist area, organize the supporting records, and track unresolved issues through documented remediation. A clear inventory, current risk analysis, evidence of routine controls, and tested response and recovery procedures help the hospital explain how it protects ePHI in both routine operations and emergencies.

FAQs

How often should a women and infants hospital update its security risk analysis?

HIPAA does not set a single required calendar interval. HHS says the risk-analysis process should be ongoing, with updates as needed based on the hospital’s environment and operations—for example, after a significant system change, a security incident, or a newly identified risk. Document the hospital’s review schedule and the reasons for updates.

What evidence should a hospital organize for a HIPAA audit?

Organize the current policies and procedures, ePHI inventory, security risk analysis and remediation records, access approvals and reviews, audit-log review records, training documentation, business associate agreements, privacy-rights and disclosure procedures, incident files, and contingency-plan and test records. Keep required Security Rule documentation for at least six years from creation or the date it was last in effect, whichever is later, and check for longer applicable retention requirements.

How should a hospital document a potential breach involving ePHI?

Record when and how the incident was discovered, what information and systems may be involved, who may have accessed or received the information, containment and mitigation steps, investigation findings, and the decision about whether notification is required. If relying on a breach risk assessment, document the required factors and the conclusion. Preserve evidence and document any notifications made or the basis for determining that notification was not required.

What should a hospital review in its business associate agreements?

Confirm that the agreement identifies permitted and required uses and disclosures, requires appropriate safeguards, provides for reporting of impermissible uses or disclosures and breaches, addresses applicable patient-rights support, and requires relevant protections for subcontractors. Also check that the agreement is signed and corresponds to the vendor’s current services and the ePHI involved.