HIPAA Audit Readiness Guide for Biochemical Genetics Labs

Biochemical genetics labs handle sensitive information, including identifiable test results and family health histories. A practical HIPAA audit readiness program connects the lab’s records, systems, workforce practices, and corrective actions so you can show how protected health information (PHI) and electronic protected health information (ePHI) are safeguarded.

What does a HIPAA audit cover for biochemical genetics labs?

First, establish whether the lab is a HIPAA covered entity, a business associate, or neither. A laboratory that provides health care is generally a covered entity if it conducts certain standard transactions electronically, such as submitting claims or checking eligibility. A lab may also be a business associate when it handles PHI on behalf of a covered entity. HHS guidance on covered entities explains these roles.

When a HIPAA review applies, its scope depends on the lab’s role and the requirements selected for review. HHS’s audit protocol addresses selected requirements under the Privacy, Security, and Breach Notification Rules; it does not mean every audit examines every requirement. HHS’s HIPAA audit protocol describes the rules and types of evidence reviewers may examine.

For a biochemical genetics lab, prepare to show how the organization protects identifiable genetic test information across the testing workflow. That may include ordering and authorization, specimen tracking, the laboratory information system (LIS), instruments and middleware, bioinformatics tools, result delivery, backups, and systems operated by vendors. Reviewers may also examine privacy policies, workforce access, security evaluations, incident and breach response, and agreements with business associates.

How should labs organize HIPAA audit documentation?

Keep a controlled, searchable record set that links each policy or required activity to evidence that it is current and being followed. HIPAA permits electronic documentation, but required Security Rule policies, procedures, actions, activities, and assessments must be maintained in written or electronic form. 45 C.F.R. § 164.316 also requires the organization to make applicable documentation available to the people responsible for carrying out the procedures.

Organize records by topic and assign an owner to keep each set current. A useful audit file can include:

• Current privacy and security policies, procedures, and revision history.
• The ePHI inventory, data-flow diagrams, risk analysis, and risk-management action tracker.
• Access authorization records, role assignments, access reviews, and information system activity review records.
• Security evaluation findings, remediation evidence, incident records, and breach-response documentation.
• Business associate agreements and relevant vendor security documentation.
• Workforce training records, including when training occurred and which policies or procedures were covered.

Retain HIPAA-required Security Rule documentation for six years from the date it was created or the date it was last in effect, whichever is later. This is a documentation retention rule; it is not a blanket six-year retention period for every clinical record. The regulation’s documentation and retention requirements provide the specific rule.

How to conduct and document an ePHI risk analysis

The HIPAA Security Rule risk analysis is a required, accurate, and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Risk analysis identifies and evaluates risk; HIPAA Security Rule risk management is the separate process of implementing measures to reduce identified risks to a reasonable and appropriate level. 45 C.F.R. § 164.308 requires both.

Start by identifying where ePHI is created, received, maintained, or transmitted. For a biochemical genetics lab, include patient identifiers and results in the LIS, instrument and middleware systems, sequencing or analytical platforms, variant interpretation and bioinformatics environments, portals, email or file-transfer tools, workstations, mobile devices, backups, and vendor-hosted services. Include paper workflows where they connect to the handling of ePHI.

Then assess relevant threats and vulnerabilities, existing safeguards, and the likelihood and potential impact of unauthorized access, alteration, loss, or unavailability. Document the method, systems and data covered, findings, risk ratings, and planned safeguards. For each corrective action, record its owner, target date, status, and any rationale for accepting or deferring residual risk. HHS explains that the risk analysis must be documented but does not prescribe a single format. HHS risk analysis guidance provides further direction.

Which security evaluations should labs perform and when?

The Security Rule requires a periodic technical and nontechnical security evaluation to assess how well the organization’s security policies and procedures meet the Rule’s requirements. It also requires updates when environmental or operational changes affect ePHI security. The rule does not set one universal evaluation schedule, so the lab should determine and document a frequency appropriate to its environment and risks. 45 C.F.R. § 164.308(a)(8) sets out the evaluation standard.

A technical evaluation may review system configurations, user permissions, audit logging, authentication, backup and recovery, and protections for ePHI in storage and transmission. A nontechnical evaluation may examine policies, training practices, vendor oversight, incident response, physical safeguards, and whether staff follow established procedures. These are practical examples to consider, not a prescribed federal checklist.

Schedule evaluations periodically and reassess when significant changes could affect ePHI, such as adding a sequencing platform, changing the LIS, moving systems to a cloud provider, changing vendors, or responding to a new security threat or incident. Record the scope, findings, decisions, and follow-up work so you can demonstrate how the evaluation informed risk management.

How to manage workforce access and audit controls

Define workforce access authorization around job responsibilities: staff should receive access appropriate to the tasks they perform, and access should be changed when their role changes or ends. Document who approved access, what systems and data were authorized, and when permissions were reviewed or removed. The Security Rule requires workforce security policies and procedures to ensure appropriate access and prevent inappropriate access. 45 C.F.R. § 164.308(a)(3)–(4) describes these safeguards.

Use unique user identities so activity can be attributed to individuals. The Security Rule also requires technical access controls and audit controls that record and examine activity in systems containing or using ePHI. 45 C.F.R. § 164.312 describes these technical safeguards.

Establish an information system activity review process for audit logs, access reports, and security incident tracking reports. Set a documented review cadence that reflects your risks, identify who investigates unusual activity, and retain records of findings and actions taken. The Rule requires regular review but does not specify a universal review interval. 45 C.F.R. § 164.308(a)(1)(ii)(D) states the activity-review requirement.

How HIPAA protects genetic information from health plan underwriting

HIPAA treats genetic information as health information. When it is individually identifiable and maintained by a covered entity or business associate, it can be PHI and receive HIPAA Privacy Rule protections. Genetic information includes an individual’s genetic test results, genetic tests of family members, certain family disease histories, and requests for or receipt of genetic services. The federal definition also addresses information about a fetus or certain embryos. 45 C.F.R. § 160.103 defines genetic information and genetic tests; HHS explains how HIPAA protects genetic information.

Under the HIPAA Privacy Rule, a health plan generally may not use or disclose PHI that is genetic information for underwriting purposes. The prohibition covers specified decisions such as eligibility, premiums, and certain contract-related activities; it does not treat a determination of medical appropriateness when a person seeks a benefit as underwriting. The regulation excludes issuers of long-term-care policies from this particular prohibition. 45 C.F.R. § 164.502(a)(5)(i) states the prohibition and its scope.

How long should molecular genetic test reports be retained?

HIPAA does not set a general retention period for clinical test reports. For laboratories subject to CLIA, the federal CLIA regulation generally requires a laboratory to retain or be able to retrieve original test reports—including final, preliminary, and corrected reports—for at least two years after the reporting date. CLIA specifies at least ten years for pathology test reports. 42 C.F.R. § 493.1105 lists these retention periods.

Do not assume that every molecular genetic report is classified as a pathology test report. Confirm how the applicable CLIA requirements classify the lab’s reports, then check state law, accreditation requirements, contracts, and organizational policy for any longer period. Keep the clinical-report retention schedule distinct from HIPAA’s six-year retention rule for required compliance documentation.

In summary, audit readiness depends on knowing which HIPAA requirements apply to your lab, maintaining accessible evidence, and connecting risk findings to documented safeguards and follow-up. Pair that process with clear workforce access controls and a retention schedule that accounts for both HIPAA documentation and applicable laboratory record rules.

FAQs

How long must HIPAA compliance documentation be retained?

Required Security Rule documentation must be retained for six years from its creation date or the date it was last in effect, whichever is later. This applies to the documentation specified by the Rule, not automatically to every patient report. See 45 C.F.R. § 164.316(b)(2)(i).

When should a laboratory reassess its ePHI security risks?

Risk analysis should be ongoing, with reassessment when environmental or operational changes affect ePHI security and when new risks become apparent. HIPAA does not prescribe one fixed risk-analysis interval for every lab; set and document a schedule that fits your environment and risks. HHS risk analysis guidance explains the ongoing process.

What genetic information is protected under HIPAA?

Genetic information can be protected as PHI when it is individually identifiable and held by a HIPAA covered entity or business associate. It includes an individual’s genetic tests, genetic tests of family members, certain family disease histories, and information about genetic services or related clinical research, as described in 45 C.F.R. § 160.103.

Can a health plan use genetic information for underwriting?

Generally, a HIPAA health plan may not use or disclose PHI that is genetic information for underwriting purposes, such as specified eligibility or premium decisions. The HIPAA provision excludes issuers of long-term-care policies, and it does not treat medical-appropriateness determinations for requested benefits as underwriting. See 45 C.F.R. § 164.502(a)(5)(i).