HIPAA Audit Readiness Guide for Biobanks and Tissue Repositories

A HIPAA audit readiness plan helps you show how your biobank or tissue repository determines its legal role, protects health information, and follows documented procedures. Start by separating HIPAA requirements from repository quality practices: some records support both, but HIPAA does not prescribe every specimen-handling form or operational record.

How to determine whether a biobank or tissue repository is subject to HIPAA

A tissue repository is not automatically a HIPAA covered entity. Covered entities are health plans, health care clearinghouses, and health care providers that conduct certain standard electronic transactions. HHS specifically explains that a repository is covered only if it conducts another activity that makes it a covered entity—for example, certain testing services conducted electronically on behalf of transplant recipients. See the HHS guidance on whether tissue repositories are covered entities and the covered entity definitions.

For a sound HIPAA covered entity determination, assess the legal entity and its activities—not just the repository’s name, mission, or possession of specimens. Document whether the organization operates a covered health care function, conducts standard electronic transactions, or is part of a larger organization that has designated a health care component.

A repository that is not a covered entity may still be a business associate if it creates, receives, maintains, or transmits protected health information (PHI) for a covered entity as part of a service. If so, review the applicable business associate agreement, the information and services it covers, and the repository’s responsibilities. HHS explains that a covered entity engaging a business associate must have a written contract or other arrangement addressing protection of PHI.

Which HIPAA Privacy Security and Breach Notification requirements may be audited

First confirm whether the repository is a covered entity, a business associate, or neither; the HIPAA obligations depend on that status and the work being performed. For regulated repositories, an audit may examine how the organization permits and limits uses and disclosures of PHI under the Privacy Rule, safeguards electronic PHI under the Security Rule, and responds to breaches under the Breach Notification Rule. The rules work together to protect PHI, as summarized by HHS’s overview of the HIPAA Security Rule.

Prepare to show current policies and evidence that they are followed. Relevant materials may include workforce privacy and security procedures, business associate agreements, access permissions, security risk analyses, log-review records, incident investigations, and breach notification documentation. For a potential breach, keep the investigation, risk assessment, decision about whether notification was required, and evidence of any notices sent. HHS describes the documentation a covered entity or business associate should maintain in its Breach Notification Rule guidance.

HIPAA’s six-year documentation period applies to documentation the rules require: generally, retain it for six years from creation or from the date it was last in effect, whichever is later. Do not assume that every specimen, equipment, or operational record automatically has the same HIPAA retention period; other laws, contracts, institutional policies, or repository requirements may set different periods. See HHS’s Security Rule documentation guidance.

How to document security risk analysis and remediation

For a regulated repository, the HIPAA Security Rule security risk analysis must cover the potential risks and vulnerabilities to the confidentiality, integrity, and availability of all electronic PHI the organization creates, receives, maintains, or transmits. Include systems that hold or connect PHI, such as a laboratory information management system (LIMS), specimen inventory tools, linked clinical databases, file shares, researcher portals, and vendor-hosted services.

Keep a dated record that makes the analysis understandable and reproducible. It should describe the scope and data flows, relevant systems and users, identified threats and vulnerabilities, safeguards already in place, and how the organization evaluated risks. HHS’s HIPAA Security Rule risk analysis guidance emphasizes identifying and documenting threats and vulnerabilities and assessing current security measures.

Connect the findings to a remediation plan. For each significant risk, record its priority, planned safeguard, responsible owner, target date, progress, and evidence of completion or a documented decision to accept remaining risk. Revisit the analysis when systems, vendors, workflows, or threats change, and maintain records showing that risk management decisions were acted on. The Security Rule requires risk management measures to reduce risks and vulnerabilities to a reasonable and appropriate level; see the HHS HIPAA Audit Protocol for examples of risk analysis and remediation evidence auditors may review.

How to manage PHI access and review audit logs

Use protected health information access controls that match each person’s job responsibilities. Maintain a current list of authorized users, role-based permissions, approval records, and procedures for changing or ending access when a person’s role changes or they leave. Apply the Privacy Rule’s minimum necessary standard where it applies, and document the rationale for any broader access needed for a defined function.

The Security Rule requires procedures to regularly review information system activity, including audit logs, access reports, and security incident tracking reports. It does not set one universal review schedule for every repository. Set a documented cadence based on your systems and risks, and explain how the review process identifies unusual activity. HHS identifies these requirements in its Security Rule text and guidance.

For each system audit log review, retain the review date, systems and period covered, reviewer, method or query used, exceptions identified, and follow-up actions. Keep evidence that suspicious access was investigated and resolved under your incident procedures. A written review procedure paired with dated examples helps show both that a process exists and that it is being carried out.

How to maintain specimen traceability and corrective action records

Maintain a specimen chain of custody under your repository’s approved procedures so you can trace a specimen from receipt through processing, storage, transfer, use, and final disposition. Records may include a unique specimen identifier, receipt and transfer dates, locations, authorized handlers, processing or aliquoting events, storage changes, and documented discrepancies. Keep the linkage key and any associated PHI protected, with access restricted to authorized roles.

HIPAA does not prescribe a universal specimen chain-of-custody form. Treat traceability records as repository operational or quality evidence, while identifying any PHI within them and protecting it under applicable HIPAA safeguards. Your institutional policies, contracts, or other requirements may call for additional traceability details.

When a discrepancy, access violation, or security incident occurs, document what happened, when it was detected, the information or specimens involved, the investigation, containment or mitigation, corrective action, responsible owner, and closure evidence. Keep breach notification documentation when a PHI incident requires assessment under the Breach Notification Rule. HHS’s audit protocol describes review of security violations and remediation actions.

What facility equipment and workforce training records to retain

Retain facility security procedures and evidence that authorized access to areas housing electronic information systems is controlled. Depending on your risk analysis and implementation, useful evidence may include current access lists, visitor procedures or logs, facility security plans, and records of relevant repairs or modifications. HHS identifies facility access controls, workstation and device protections, and related documentation of HIPAA physical safeguards in its physical safeguards guidance.

Keep equipment records that help demonstrate how systems and media containing ePHI are protected—for example, equipment inventory, authorized removal or relocation records, maintenance documentation, and secure disposal records where applicable. Cold-storage temperature logs and freezer maintenance records may be important repository or quality evidence, but they are not automatically HIPAA-required records simply because they relate to specimens. The HIPAA connection is strongest when equipment or its records affect the security, integrity, or availability of ePHI.

Document workforce training on the privacy and security policies relevant to each person’s duties. HIPAA requires training that is necessary and appropriate for workforce members to carry out their functions, including training new workforce members within a reasonable period and training affected staff after material policy changes. Keep completion records and the policy or training version covered. HIPAA does not establish a universal annual certificate-renewal requirement; an employer may set annual training as its own policy. See HHS audit criteria for workforce training.

How research involving repository specimens may trigger privacy and institutional review requirements

Research involving repository specimens does not automatically require HIPAA authorization. The key question is whether a covered entity or business associate uses or discloses PHI for the activity. If a covered entity uses or discloses PHI for research, it generally needs a valid individual authorization or another permission allowed by the Privacy Rule, such as a documented waiver of authorization approved by an IRB or Privacy Board when the waiver criteria are met. HHS explains these options in its HIPAA and Research guidance.

Other HIPAA permissions may apply in limited circumstances, including certain preparatory-to-research activities or research using a limited data set under a data use agreement. Properly de-identified information is not PHI under the Privacy Rule’s de-identification standard. Assess the actual information and arrangement rather than assuming that coded information is automatically de-identified for HIPAA purposes.

HIPAA authorization and institutional review are separate questions. The Common Rule may apply to HHS-conducted or -supported research, and FDA human-subject protections may apply to FDA-regulated research. Whether research using coded biospecimens involves human subjects under the Common Rule depends on the circumstances, including whether investigators can readily ascertain identities. Review the applicable institutional process and OHRP guidance on coded private information or biospecimens.

For audit readiness, keep the research protocol or determination, authorization or waiver documentation when applicable, data use agreements, relevant approvals, and records of what information or specimens were released and to whom. Together, these records help show that the repository assessed its HIPAA status, controlled PHI access, documented security decisions, and followed applicable research permissions.

FAQs

Is a tissue repository automatically a HIPAA covered entity?

No. A repository is not automatically a covered entity because it stores tissue or related information. Its status depends on whether the organization performs a covered activity, such as acting as a health care provider that conducts specified standard electronic transactions. It may have other HIPAA obligations if it acts as a business associate for a covered entity.

What records should a biobank retain for a HIPAA audit?

Retain records relevant to your HIPAA role and activities, such as the covered entity or business associate determination, applicable agreements, privacy and security policies, security risk analysis and remediation records, access approvals, audit log reviews, incident and breach assessments, and required workforce training documentation. HIPAA documentation generally has a six-year retention period when required by the rules; other repository or legal records may have different retention requirements.

How should repositories document access to PHI and audit log reviews?

Keep current user-role and permission records, access approvals and changes, and procedures for terminating access. Document regular system activity reviews with the date, systems or logs examined, reviewer, method, findings, and any investigation or corrective action. The Security Rule requires regular review but does not prescribe one universal review frequency for all repositories.

Does research using repository specimens require HIPAA authorization?

Not in every case. If a covered entity uses or discloses PHI for research, it generally needs individual authorization or another permitted basis, such as an applicable documented waiver. Properly de-identified information is not PHI under HIPAA, and limited data sets or certain preparatory-to-research activities have separate rules. Institutional review and other human-subject requirements may apply independently of HIPAA.