HIPAA Audit Readiness Guide for Cooperative Oncology Group Statistical Centers

A cooperative oncology group’s statistical center may handle sensitive research information without automatically being a HIPAA covered entity or business associate. Audit readiness starts with documenting the center’s role, the legal basis for each use or disclosure of protected health information (PHI), and the safeguards that protect electronic protected health information (ePHI).

Which HIPAA rules apply to cooperative oncology group statistical centers?

HIPAA obligations depend on the center’s activities and relationships—not its name, research mission, or access to health data alone. The HIPAA Rules apply to covered entities, such as health plans, health care clearinghouses, and certain health care providers, and to business associates acting on behalf of covered entities. A health care provider is generally a covered entity if it conducts specified standard transactions electronically. See HHS guidance on covered entities.

A statistical center may be a business associate when it performs a covered function or service for a covered entity involving PHI—for example, certain data-management or de-identification services carried out on the entity’s behalf. But a researcher is not automatically a business associate simply because a covered entity provides PHI for research. HHS explains that research disclosures do not, by themselves, require a business associate agreement (BAA). See HHS guidance on researchers and business associate contracts and HHS guidance on business associates.

If the center is a covered entity or business associate, the Privacy, Security, and Breach Notification Rules may apply to its activities involving PHI. Research obligations can also arise under separate laws, study agreements, institutional policies, or funder requirements. Assess those separately rather than treating them as HIPAA requirements.

How should a statistical center document its role as a covered entity or business associate?

Prepare a written role assessment that identifies each legal entity involved, its HIPAA status, and the activities supporting that conclusion. Record whether the center furnishes health care and conducts standard electronic transactions, provides services on behalf of a covered entity that involve PHI, or receives information as a researcher for its own research purposes. Revisit the assessment when services, data flows, or organizational relationships change.

For each covered entity relationship, document what the center does with PHI and whether the arrangement is a research disclosure, a business associate service, or another permitted arrangement. If the center is a business associate, retain the signed BAA and any subcontractor agreements. Confirm that the agreement describes permitted uses and disclosures, safeguards, incident reporting, and how the center will support the covered entity’s applicable obligations.

Do not use a BAA as a substitute for identifying the correct basis for a research disclosure. Depending on the study, a covered entity may disclose PHI under a participant’s authorization, documented IRB or Privacy Board waiver, or a limited data set accompanied by a data use agreement (DUA). HHS describes these pathways in its HIPAA and Research guidance.

What policies and procedures should be ready for a HIPAA audit?

Keep current, approved policies and procedures that match the center’s actual operations. The specific set depends on its role and the information it handles, but audit-ready records commonly include privacy and security responsibilities, workforce access and training, permitted uses and disclosures, incident response, sanctions, vendor oversight, and retention and disposal practices.

If the center is subject to the Security Rule, maintain a documented HIPAA Security Rule risk analysis. It should account for where ePHI is created, received, maintained, and transmitted; reasonably anticipated threats and vulnerabilities; existing security measures; and identified risks. Keep remediation decisions, assigned owners, and follow-up evidence with the analysis. HHS states that risk analysis is a required Security Rule implementation specification and provides risk-analysis guidance.

Document workforce training and access decisions, including who received training, when it occurred, and the policies covered. Training should address the center’s own procedures and the person’s responsibilities. HIPAA does not establish a universal annual certificate-renewal requirement; an organization may set its own refresher schedule based on its policies, risks, and other applicable obligations.

Organize evidence so you can retrieve it by policy, study, system, vendor, or incident. HHS’s HIPAA Audit Protocol describes the types of policies, procedures, and implementation evidence auditors may review.

How can research data access and disclosures be documented?

Maintain a study-level record linking each dataset and disclosure to its authorized purpose and applicable HIPAA pathway. Depending on the arrangement, retain the relevant participant authorization, IRB or Privacy Board waiver documentation, DUA for a limited data set, or other applicable records. A research consent form alone should not be assumed to meet HIPAA authorization requirements.

For an IRB or Privacy Board waiver, preserve the required approval documentation and identify the data and research purpose it covers. For a limited data set, retain the DUA, permitted purpose, approved data elements, recipient restrictions, and any required approvals. A limited data set is still PHI; its use and disclosure remain subject to HIPAA restrictions. See HHS requirements for research uses and disclosures.

Apply the minimum necessary standard where it applies. Document how the center limits workforce access and data requests to information reasonably needed for the purpose, such as through role-based permissions, approved variables, or review of non-routine requests. The standard has exceptions, including disclosures made under an individual’s authorization; it does not apply identically to every HIPAA-permitted use or disclosure. See HHS minimum necessary guidance.

Maintain access records that can show who accessed research data, when access occurred, and—where systems support it—what actions were taken. Document approvals, user provisioning and removal, exports, transfers, and periodic access reviews. HIPAA requires audit controls for systems containing or using ePHI, but it does not prescribe one universal log format or require a particular commercial tool.

What safeguards protect electronic protected health information?

Build safeguards around the ePHI inventory and risk analysis. The Security Rule addresses administrative, physical, and technical safeguards. Depending on the center’s systems and risks, controls may include unique user IDs, role-based access, prompt removal of unneeded accounts, secure workstations, physical protections for devices, backups, and procedures for restoring access after an emergency.

Maintain access control audit logs and procedures to review activity in systems containing or using ePHI. HIPAA requires mechanisms that record and examine such activity. Record how the center selects systems and events to monitor, who reviews alerts or logs, and how potential inappropriate access is escalated. The technical safeguard requirements are summarized in HHS’s Security Rule overview.

Encryption is an addressable Security Rule implementation specification, not a simple blanket rule that every ePHI file must use one particular encryption method. The organization must assess whether encryption is reasonable and appropriate in its environment and document its decision, including any alternative measures. Protect data transfers as well: HHS says ePHI may be sent by email or over an open network when adequately protected under the applicable safeguards. See HHS guidance on sending ePHI.

Use tested procedures for backup, recovery, data disposal, and media reuse. Limit access to identifiable data when analysts can work with a more restricted dataset, and separate any re-identification key when appropriate. These measures should be supported by the center’s risk analysis and documented policies rather than assumed to be sufficient on their own.

How should statistical centers prepare for breach reporting and incident response?

Maintain a written process for identifying, reporting, investigating, mitigating, and documenting suspected or known security incidents. Train workforce members to report concerns promptly, preserve relevant logs and records, and escalate incidents to designated privacy and security leads. HIPAA requires regulated entities to respond to security incidents and document incidents and outcomes. See HHS guidance on Security Rule incident procedures.

For a suspected exposure of research data, promptly determine what information and systems may be involved, whose data may be affected, whether the information was unsecured PHI, and whether the event was an impermissible use or disclosure. Preserve evidence, contain ongoing exposure where practicable, document the assessment and mitigation, and notify the covered entity or other responsible party under the BAA, DUA, study terms, and incident procedures. Do not delay escalation while waiting to confirm every detail.

If the center is a business associate, it must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery; a BAA may require faster reporting. The covered entity generally handles required notices to affected individuals and HHS, though notice tasks may be delegated as allowed. For breaches affecting fewer than 500 individuals, covered entities generally report to HHS within 60 days after the end of the calendar year in which the breach was discovered. See HHS’s Breach Notification Rule guidance and HHS breach-reporting instructions.

Keep the incident timeline, investigation findings, affected-data assessment, notifications, decisions, corrective actions, and evidence supporting any conclusion that notification was not required. HIPAA places the burden on the covered entity or business associate, as applicable, to document that required notifications were made or that an exception or low probability of compromise applies. See HHS breach documentation guidance.

What audit evidence should be retained and how long?

Maintain an indexed evidence set that includes applicable role assessments and agreements; current policies and procedures; risk analyses and remediation records; training records; access approvals and reviews; relevant system logs; study approvals and data-use documentation; incident files; and records showing how safeguards are implemented. Keep evidence available to the people responsible for carrying out the procedures.

For documentation required by the Security Rule, retain it for six years from its creation or the date it was last in effect, whichever is later. This is a HIPAA documentation-retention rule, not a universal HIPAA requirement to retain every research dataset, source record, or medical record for six years. Other laws, state requirements, study protocols, contracts, or institutional policies may require different or longer retention. See HHS’s Security Rule summary and its guidance on medical-record retention.

In short, audit readiness depends on a documented HIPAA role, a valid basis for each research use or disclosure, risk-based safeguards for ePHI, a tested incident process, and retrievable evidence retained for the applicable period.

FAQs.

Does HIPAA apply to cooperative oncology group statistical centers?

It depends on the center’s role and activities. A center may be a covered entity if it meets a covered-entity definition, or a business associate when it performs covered services on behalf of a covered entity involving PHI. A center that receives PHI solely as a researcher is not automatically a business associate; research disclosures must still have a permitted HIPAA basis when made by a covered entity. See HHS covered-entity guidance and HHS research-contract guidance.

What HIPAA documentation should a statistical center maintain for an audit?

Depending on its HIPAA role, maintain role assessments, BAAs or DUAs where applicable, policies and procedures, Security Rule risk-analysis records, training and access evidence, study authorization or waiver records, relevant audit logs, and incident investigations. Security Rule documentation generally must be retained for six years from creation or from when it was last in effect, whichever is later. See HHS Security Rule documentation guidance.

How should a statistical center handle a suspected breach of research data?

Escalate it promptly under the center’s incident procedures and applicable agreements. Contain the exposure where practicable, preserve evidence, investigate what data and individuals may be affected, document the assessment and mitigation, and notify the covered entity or other responsible party as required by the relationship and agreement. The covered entity and business associate should determine whether breach notification is required under the Breach Notification Rule. See HHS breach-response guidance.

Do de-identified research datasets remain subject to HIPAA?

Information that has been de-identified in accordance with HIPAA’s Safe Harbor or Expert Determination method is no longer PHI under the Privacy Rule. A limited data set, by contrast, remains PHI and requires a DUA. A business associate must also be authorized by its agreement to de-identify PHI on behalf of a covered entity. Other laws, contracts, or research rules may still apply to de-identified data. See HHS de-identification guidance and HHS guidance on business associates and de-identification.