HIPAA Audit Readiness Guide for County EMS and Ambulance Agencies

A HIPAA review can examine more than patient-care records. It may also look at how your agency identifies ePHI risks, limits access, trains its workforce, responds to security incidents, and documents safeguards and corrective actions.

Use this guide to organize records and test whether written procedures match day-to-day work across ambulances, stations, dispatch functions, mobile devices, and systems managed by county departments or vendors. The specific requirements depend on whether your agency is a covered entity, business associate, or part of a larger governmental entity.

What HIPAA requirements may an EMS audit review?

HIPAA generally applies to health care providers that conduct certain standard transactions electronically, such as submitting electronic claims. A county agency’s ownership or public status alone does not determine whether it is covered; assess the EMS operation’s role and transactions. If a county department performs functions that make it a covered entity, it may have to comply with the applicable HIPAA Rules. See CMS guidance on covered providers and electronic transactions and HHS guidance for county and local health departments.

If covered, your agency may need to address the Privacy Rule, Security Rule, and Breach Notification Rule. The Privacy Rule governs uses and disclosures of protected health information (PHI); the Security Rule addresses safeguards for electronic PHI (ePHI); and the Breach Notification Rule establishes notification duties following certain breaches of unsecured PHI. A business associate that handles PHI for a covered entity also has applicable HIPAA duties.

An audit may review policies and procedures, risk analysis and risk management, workforce training, access controls, system activity, contingency planning, business associate arrangements, and incident or breach records. HHS OCR’s HIPAA audit protocol describes areas auditors may examine; the scope of any particular review can vary.

How should agencies document an ePHI risk analysis and risk management?

Your ePHI risk analysis should identify where ePHI is created, received, maintained, or transmitted and assess potential risks to its confidentiality, integrity, and availability. For an EMS agency, consider electronic patient care reports, dispatch and billing systems, tablets, mobile phones, email, shared drives, radio or messaging workflows, backups, and vendor-hosted platforms.

Document the systems and data included, the threats and vulnerabilities considered, the likelihood and potential impact of risks, and the safeguards already in place. Record who performed or approved the analysis, when it was completed, what information informed it, and any limitations or assumptions. The Security Rule requires an accurate and thorough assessment, but does not prescribe a particular template or assessment frequency. See 45 CFR § 164.308 and HHS risk analysis guidance.

Risk management is the follow-through: select and implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level. Maintain an action plan showing each identified risk, its priority, planned safeguard, accountable owner, target date, status, and evidence of completion or documented acceptance. HHS describes risk analysis as identifying risks and risk management as implementing measures to reduce them in its risk analysis and risk management explanation.

There is no universal HIPAA requirement to repeat the risk analysis annually. Instead, treat it as an ongoing process and update it when changes—such as a new ePCR platform, a county IT consolidation, a new vendor, a station move, or a security incident—could affect ePHI. Keep dated versions and evidence showing how findings led to decisions and action.

Which HIPAA policies, procedures, and records should be ready?

Keep an organized, access-controlled set of current policies and supporting records. The precise set depends on your agency’s responsibilities and systems, but a practical audit file may include:

• Privacy and security policies, including workforce access, appropriate use and disclosure, confidentiality, safeguards, and sanctions.
• Risk analysis, risk management plans, periodic evaluations, and records of material changes to systems or safeguards.
• Designation records for privacy and security officials, along with workforce roles and responsibilities.
• Training materials, attendance or completion records, and documentation of training on relevant policy changes.
• Access authorization and termination records, account reviews, audit-log review procedures, and relevant system activity reports.
• Incident response and breach notification procedures, incident logs, investigation records, mitigation steps, and any required notifications.
• Contingency plans, including backup, disaster recovery, emergency-mode operations, and records of testing or revisions.
• Business associate agreements and records identifying vendors that create, receive, maintain, or transmit PHI on the agency’s behalf.
• Records of complaints, disclosures, required communications, and other actions or activities that HIPAA requires the agency to document.

HIPAA-required documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. That rule does not mean every patient care record or every record containing PHI has a universal six-year HIPAA retention period; other laws and county or state retention schedules may set different requirements. See 45 CFR § 164.316, 45 CFR § 164.530, and the HHS Security Rule summary.

Use a document index to identify each record, its owner, its effective date, its review date, and where the current version is stored. Make sure staff responsible for carrying out a procedure can access the applicable documentation.

How can agencies evaluate security safeguards and monitor ePHI access?

Compare written safeguards with actual EMS workflows. Review how personnel sign in to ePCR and dispatch systems, access records from mobile devices, share information with receiving facilities, handle printed reports, and secure devices in ambulances and stations. Evaluate administrative, physical, and technical measures in light of your agency’s systems and risks.

Check whether access is assigned based on job duties, approved by the appropriate person, changed when responsibilities change, and removed promptly when a worker leaves. Review how shared accounts, emergency access, remote access, device loss, and vendor access are handled. The Security Rule requires access controls and mechanisms to record and examine activity in systems containing or using ePHI; see 45 CFR § 164.312.

Establish a documented process for reviewing audit logs or other system activity. Define which systems and events are reviewed, who performs the review, how often it occurs under agency policy, what triggers investigation, and how concerns are escalated and resolved. Keep samples of completed reviews and follow-up records so you can show that audit controls operate in practice, not only on paper. HHS’s audit protocol includes review of system activity records such as audit logs and access reports.

Conduct periodic technical and nontechnical evaluations, including after relevant operational or environmental changes. Also examine backups, restoration procedures, emergency-mode workflows, and downtime procedures so crews can continue critical operations while protecting ePHI during an outage. The Security Rule identifies contingency-plan testing and revision procedures as addressable implementation specifications; document your agency’s approach and the reasons supporting it. See 45 CFR § 164.308.

What should EMS workforce training cover?

Training should explain the agency’s applicable HIPAA policies and the steps each person must follow in their role. Include employees, volunteers, trainees, and other workforce members whose conduct is under the agency’s direct control, as applicable.

Use EMS-specific examples: protecting patient information during dispatch and handoffs, limiting access to care records, securing tablets and phones, avoiding unauthorized photos or messages, and promptly reporting a lost device or suspected improper access. Explain how to handle paper records and verbal disclosures in stations, ambulances, and public settings.

Document who received training, when it was provided, and what topics or policy versions it covered. HIPAA requires Privacy Rule training appropriate to workforce functions and Security Rule security awareness and training; new workforce members and people affected by material policy changes must receive applicable training within the required timeframes. Federal HIPAA rules do not impose a universal annual certificate-renewal requirement. A training certificate shows completion of a course; it does not by itself establish that the agency complies with HIPAA. See 45 CFR § 164.530 and the HHS Security Rule summary.

How should agencies prepare for and respond to security incidents?

Maintain a written process for reporting, triaging, investigating, containing, and documenting suspected or known security incidents. Make reporting channels available to crews working shifts and in the field, and assign clear responsibility for preserving evidence, coordinating with county IT, and escalating potential privacy or security issues.

Document the event, when it was discovered, the systems and information potentially involved, who was notified, the investigation and mitigation steps, and the outcome. An incident is not automatically a breach that requires notification: assess whether PHI was involved and whether the event meets the Breach Notification Rule’s definition and applicable exceptions. Keep the decision and its supporting facts in the file.

When notification is required for a breach of unsecured PHI, a covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery; notice to HHS and, in some cases, the media may also be required. A business associate must notify the covered entity as required by the Breach Notification Rule and its agreement. Maintain written breach notification procedures and records showing the decisions made and notifications provided. See the HHS Breach Notification Rule guidance and 45 CFR Part 164, Subpart D.

How can an EMS compliance program document audit findings and corrective actions?

Record each finding with its source, the requirement or policy involved, the affected system or workflow, the evidence reviewed, and the risk or operational impact. Distinguish a confirmed control gap from a recommendation or an issue that requires more investigation.

For each finding, assign an accountable owner, corrective action, target date, and method for verifying completion. Preserve evidence such as revised procedures, access-review results, completed training records, technical changes, or test results. If a finding cannot be fully corrected immediately, document interim safeguards, the reason for the delay, and the plan for continued follow-up.

Recheck completed actions to confirm they work and update the risk analysis, policies, or training when the findings reveal broader issues. A well-organized audit file connects identified risks to safeguards, monitoring, incident response, and verified corrective actions—helping your agency demonstrate an ongoing compliance process.

FAQs

Which HIPAA rules may apply to a county EMS or ambulance agency?

If the agency is a covered entity, the HIPAA Privacy, Security, and Breach Notification Rules may apply. A provider’s covered-entity status generally depends on whether it conducts certain adopted standard health care transactions electronically; a business associate handling PHI for a covered entity has applicable duties as well. County or local government status alone does not decide the question. See CMS guidance and HHS guidance on covered entities and business associates.

How often should an EMS agency update its ePHI risk analysis?

HIPAA does not set a fixed annual interval. Treat risk analysis as an ongoing process and update it when changes in systems, operations, vendors, threats, or incidents may affect ePHI. Document the analysis and the reasons for updates or decisions to retain existing safeguards. See HHS risk analysis guidance.

How long must HIPAA-required documentation be retained?

HIPAA-required documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. This rule applies to required documentation; it does not establish a universal six-year HIPAA retention period for all medical records. State law and county records schedules may impose other retention requirements. See 45 CFR § 164.316 and 45 CFR § 164.530.

What records should an EMS agency provide during a HIPAA audit?

Provide records responsive to the audit’s scope, which may include current policies and procedures, the ePHI risk analysis and risk management plan, training documentation, access and audit-log review records, evaluations, contingency plan records, business associate agreements, and incident or breach documentation. The agency should organize materials by requirement, protect PHI during the review, and retain a record of what was provided. HHS’s audit protocol describes examples of documentation auditors may review.