HIPAA Audit Readiness Guide for Concierge Medicine Practices

Concierge medicine may change how your practice charges patients and delivers care, but it does not automatically exempt the practice from HIPAA. Audit readiness means being able to explain which rules apply, show how you protect patient information, and produce records that support your decisions.

Use this guide to organize your compliance work. It is practical information, not legal advice; your obligations can depend on your transactions, services, technology, and applicable state laws.

Which HIPAA rules apply to concierge medicine practices?

A health care provider is a HIPAA covered entity if it transmits health information electronically in connection with a transaction for which HHS has adopted standards. Examples of standard transactions include certain claims, eligibility, and payment transactions. A concierge membership model alone does not determine whether HIPAA applies: examine how the practice handles these transactions. See HHS’s explanation of covered entities and business associates.

If the practice is a covered entity, the Privacy Rule governs uses and disclosures of protected health information (PHI), the Security Rule requires safeguards for electronic protected health information (ePHI), and the Breach Notification Rule applies to breaches of unsecured PHI. The Security Rule calls for reasonable and appropriate administrative, physical, and technical safeguards to protect ePHI’s confidentiality, integrity, and availability. Review HHS’s Summary of the HIPAA Security Rule.

Your practice should also identify which vendors qualify as business associates because they perform services involving PHI on the practice’s behalf. When HIPAA requires a business associate agreement (BAA), the relationship must be documented in a compliant written agreement. Do not assume that the practice’s size, cash-pay model, or concierge label settles whether HIPAA applies.

How to conduct and document an ePHI risk analysis

The Security Rule requires a Security Risk Analysis that accurately and thoroughly assesses potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. There is no single federally prescribed template or methodology. HHS explains the requirement in its Guidance on Risk Analysis.

Start by mapping where the practice creates, receives, maintains, or transmits ePHI. Include the EHR, patient portal, email and messaging systems, scheduling and billing tools, devices, backups, paper-to-digital workflows, and systems managed by vendors. Record who uses each system, where the information is stored, and how it moves between the practice and outside parties.

Then assess reasonably anticipated threats and vulnerabilities, the likelihood and potential impact of harm, and the safeguards already in place. Consider risks such as a lost device, inappropriate staff access, phishing, system outages, insecure transmission, or an unavailable backup. Record identified risks, existing controls, gaps, decisions, assigned owners, and target dates for corrective actions. A risk analysis identifies risks; risk management documents and implements steps to address them.

Review and update the analysis as needed when technology, workflows, vendors, staffing, or other conditions affecting ePHI change. HHS does not set a universal annual schedule; its guidance says frequency depends on the organization and its circumstances. Keep the analysis and follow-up decisions documented, and make sure the people responsible for implementing safeguards can access the relevant documentation.

What policies and audit records should your practice maintain?

Maintain written policies and procedures that reflect how your practice actually handles PHI and ePHI. Organize them so you can locate current versions, prior versions where relevant, approvals, and evidence that staff follow them. The Security Rule requires documentation of its policies, procedures, and specified actions, activities, and assessments. It generally requires retaining that documentation for six years from its creation or the date it was last in effect, whichever is later. This is not a blanket HIPAA retention period for every medical record; other federal and state rules may set different requirements. See HHS’s Security Rule summary.

For audit readiness, keep a well-organized set of records that may include:

• Your current and prior Security Risk Analyses, risk-management plans, and documentation of remediation.
• Privacy and security policies, including procedures for access, disclosures, incident reporting, contingency planning, and sanctions.
• Workforce training records, policy acknowledgments, and records of actions taken when policies are violated.
• Current vendor inventory, BAAs where required, and records of vendor reviews or follow-up.
• Access approvals, role assignments, account changes, termination checklists, and relevant audit-log reviews.
• Security incident and breach investigation files, including decisions about notifications and evidence that required steps were completed.
• Your Notice of Privacy Practices (NPP), evidence of distribution or posting as applicable, and records of patient acknowledgments or refusals.

Covered providers generally must make their NPP available and follow applicable distribution and posting requirements. The notice describes permitted uses and disclosures, the practice’s privacy duties, and individuals’ rights. Review HHS’s guidance on Notices of Privacy Practices and confirm that your notice matches the practice’s current operations.

Apply the minimum necessary standard where it applies: generally, make reasonable efforts to limit uses, disclosures, and requests for PHI to what is needed for the purpose. The standard does not apply to certain situations, including disclosures to or requests by a health care provider for treatment. See HHS’s Minimum Necessary Requirement guidance.

How to review business associates and business associate agreements

Maintain a list of vendors and other external parties that may create, receive, maintain, or transmit PHI for the practice. Assess each relationship based on the services performed and the information involved; a vendor’s access to PHI does not, by itself, answer every question about its HIPAA role. HHS explains the covered-entity and business-associate framework in its Business Associates guidance.

Where a BAA is required, verify that it is signed and covers the relevant service and PHI. The agreement must address permitted uses and disclosures, appropriate safeguards, reporting of impermissible uses or disclosures and security incidents, applicable subcontractor obligations, and what happens to PHI when the relationship ends. HHS describes key elements in its sample business associate agreement provisions.

Keep the executed agreement, amendments, vendor contact information, and records of follow-up together. Check whether the vendor’s services or information access have changed, whether subcontractors are involved, and how the vendor will notify your practice of incidents. HIPAA does not expressly require every business associate to provide security documentation or allow a customer audit; HHS notes that a practice may seek additional assurances through contract terms based on its risk analysis and risk-management needs. See HHS’s guidance on business associate security documentation and audits.

How to verify user access and audit controls

Compare system accounts and permissions against current job duties. Confirm that each person has an individual account where appropriate, access is limited to what is needed for assigned work, and permissions are changed when duties change. Document approvals, periodic access checks, and the removal or adjustment of access when a workforce member leaves or no longer needs it.

The Security Rule requires access controls and audit controls for systems containing or using ePHI. Audit controls are mechanisms that record and examine system activity; they can help the practice identify inappropriate access or investigate a security incident. HIPAA does not prescribe one universal log format or review schedule, so determine and document appropriate controls based on your systems and risks. See HHS’s Security Rule technical safeguards guidance.

Decide which events your systems can log, who reviews the logs, how unusual activity is escalated, and how the practice records reviews and findings. Check that logging is enabled where appropriate and that the practice can retrieve records when investigating a concern. Test the process rather than relying only on a vendor’s general assurance.

How to prepare staff for HIPAA audits

Train workforce members on the privacy and security policies relevant to their roles. HIPAA requires Privacy Rule training as necessary and appropriate for workforce functions and a security awareness and training program for the workforce. It does not establish a universal federal requirement for every worker to renew a certificate annually. Document the training provided, the date, the topics covered, and the participants; follow employer-specific policies and update training when procedures or risks change. See HHS’s Privacy Rule training guidance and Security Rule summary.

Use practical scenarios to help staff recognize misdirected messages, suspicious requests, exposed screens, lost devices, and unusual account activity. Make sure they know how to report a concern promptly, whom to contact, and what information to preserve. Explain the minimum necessary standard in the context of their duties, including when it does not apply, such as provider-to-provider disclosures for treatment.

Prepare a reliable process for responding to an auditor or investigator. Assign a point person, keep requested records organized, track what was provided and when, and make sure responses are accurate and consistent with the evidence. Do not create or backdate records to fill gaps; document corrective actions and current status transparently.

How to document and respond to suspected breaches

Take every suspected exposure or unauthorized access seriously. Promptly report and document what was discovered, when and how it was discovered, the systems and information involved, who may have accessed or received the information, and what containment steps were taken. Preserve relevant messages, logs, and other evidence, and involve the people responsible for privacy, security, and legal review.

Assess whether the event is a breach of unsecured PHI under the Breach Notification Rule. An impermissible use or disclosure is generally presumed to be a breach unless an exception applies or the practice documents a risk assessment demonstrating a low probability that the PHI was compromised. Record the facts, analysis, mitigation, and decision, including why notice was or was not required. HHS’s Breach Notification Rule guidance explains the rule and its documentation expectations.

If notification is required, notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery, subject to applicable exceptions. For breaches affecting 500 or more individuals, notify the Secretary of HHS without unreasonable delay and within that same 60-day limit. For breaches affecting fewer than 500 individuals, the Secretary must be notified no later than 60 days after the end of the calendar year in which the breach was discovered. A breach affecting more than 500 residents of a state or jurisdiction may also require notice to prominent media outlets serving that area. Review HHS’s notification requirements and breach reporting instructions. State law or other obligations may require additional or earlier action.

Keep copies of notices, submission confirmations, affected-person counts, investigation records, and any documented basis for concluding notification was not required. Use the findings to address the cause, reduce the risk of recurrence, and update policies, training, or safeguards as appropriate.

In short, audit readiness depends on a current view of where ePHI lives, documented risk decisions, workable policies, appropriate vendor agreements, controlled access, trained staff, and a traceable incident-response process. Keep the evidence organized and revisit it when your practice or its risks change.

FAQs

Are concierge medicine practices covered entities under HIPAA?

A concierge practice is a covered entity if it is a health care provider that transmits health information electronically in connection with a transaction for which HHS has adopted standards. The concierge model itself does not decide coverage; assess the practice’s transactions and operations.

How often should a concierge practice update its HIPAA risk analysis?

HIPAA does not set a universal annual interval. The practice should revisit its analysis as needed, including when changes to technology, vendors, staffing, workflows, or security conditions may affect ePHI. Document the review and any resulting risk-management actions.

What records should a concierge practice keep for a HIPAA audit?

Keep the risk analysis and remediation records, current policies and procedures, training documentation, applicable BAAs, access approvals and reviews, audit-log review records, NPP documentation, and incident or breach files. Security Rule documentation generally must be retained for six years from creation or the date it was last in effect, whichever is later; separate rules may govern other records.

When must a concierge practice notify patients about a breach?

If the practice determines that a breach of unsecured PHI requires notification, it generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. The practice must assess the incident and document its decision; exceptions may apply. Notification to HHS and, in some cases, the media may also be required.