HIPAA Audit Readiness Guide for Fecal Microbiota Transplant Programs

A HIPAA audit readiness plan for a fecal microbiota transplant (FMT) program should connect the systems that handle electronic protected health information (ePHI) with the people, safeguards, and documented procedures that protect it. Because an FMT program is not automatically a HIPAA-regulated entity simply by providing FMT, first determine whether the organization is a covered entity, business associate, or neither under the HHS definitions of covered entities and business associates.

How should an FMT program document its HIPAA risk analysis?

Document an accurate and thorough assessment of risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI the regulated organization creates, receives, maintains, or transmits. HHS explains that a useful starting point is an inventory of systems and applications that access or house ePHI, followed by consideration of potential threats, vulnerabilities, likelihood, and impact. See the HHS Guidance on Risk Analysis and 45 CFR § 164.308.

For an FMT program, map the information lifecycle rather than limiting the review to the electronic health record. Consider systems that handle patient referrals, scheduling, consent, clinical documentation, laboratory results, donor screening, product tracking, communications, billing, backups, and storage. Include vendor-hosted applications and portable devices when they create, receive, maintain, or transmit ePHI.

Record the assessment method, systems and information included, identified risks, existing safeguards, risk ratings or rationale, and planned corrective actions. Assign an owner and target date to each action, and retain evidence of completion or a documented decision about how the risk will be managed. Revisit the assessment when technology, workflows, vendors, facilities, or identified threats change.

The Security Rule requires documentation of applicable policies, procedures, and actions or assessments that must be documented. Such documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later; this is not a blanket HIPAA retention period for every clinical or product record. See 45 CFR § 164.316.

Which administrative, physical, and technical safeguards should FMT programs review?

Review the HIPAA Security Rule safeguards against the program’s documented risks and actual workflows. The rule is designed to be flexible and technology-neutral, so the appropriate measures depend on the organization’s size, capabilities, infrastructure, and risks to ePHI. The HHS Summary of the HIPAA Security Rule describes the safeguards currently in effect.

• Administrative safeguards: Review assigned security responsibility, workforce authorization and termination procedures, security awareness and training, incident response, contingency planning, periodic evaluation, and procedures for reviewing system activity. Confirm that policies are current and staff can follow them in day-to-day work.
• Physical safeguards: Review facility access, visitor handling, workstation use and security, and controls for devices and media. Check how computers and removable media are secured, moved, reused, and disposed of, including devices used in offices, laboratories, and clinical areas.
• Technical safeguards: Review access controls, audit controls, integrity protections, person or entity authentication, and transmission security. Evaluate how the program grants access, identifies users, records system activity, protects information from improper alteration, and secures electronic transmission.

Some Security Rule implementation specifications are required and others are addressable. “Addressable” does not mean optional without review: assess whether the specification is reasonable and appropriate in the program’s circumstances, implement it when appropriate, or document an equivalent alternative or why it is not reasonable and appropriate. The relevant standards appear in 45 CFR § 164.308, § 164.310, and § 164.312.

How can programs verify user access and emergency access procedures?

Maintain a current list of workforce members and other authorized users, their roles, the systems they can access, and the business reason for that access. Check that access is approved, appropriate to job duties, reviewed when duties change, and removed promptly when employment or another access arrangement ends.

Use unique user identification so system activity can be associated with a specific user. During an audit readiness review, look for shared or generic accounts, inactive accounts, excessive privileges, and evidence that access approvals and changes were completed as documented. HIPAA’s access-control standard and implementation specifications are set out in 45 CFR § 164.312.

Review the written emergency access procedure for obtaining necessary ePHI during an emergency, and check that authorized personnel know how to use it. The procedure should explain who may authorize emergency access, how access is granted, how activity is recorded, and how access is reviewed or closed afterward. Separately, the contingency plan should address backup, recovery, and continuation of critical processes when systems containing ePHI are unavailable.

Keep evidence of access reviews, approvals, account changes, emergency procedure testing, and follow-up on identified problems. The aim is to show that the process works—not simply that a policy exists.

What audit controls should cover systems containing electronic PHI?

Identify each information system that contains or can access ePHI, then determine what activity must be recorded and how the program will review it. Potential systems include electronic health records, laboratory and donor-management applications, product-tracking systems, secure messaging, cloud storage, and connected devices, where they handle ePHI.

HIPAA requires audit controls that record and examine activity in systems containing or using ePHI, and administrative safeguards require regular review of system activity records. Depending on the system and risk, useful records may show user access, changes to data, exports, privileged actions, failed access attempts, and security events. Document the review schedule, the person responsible, issues found, escalation steps, and corrective action. See 45 CFR § 164.312 and 45 CFR § 164.308.

HIPAA does not prescribe one audit-log product or a single log format for every program. Select controls and review practices based on the risk analysis, and verify that logs are available, protected from unauthorized alteration, and useful for investigating activity. Keep the required documentation of reviews and actions under the applicable retention requirements; do not assume that the six-year documentation rule automatically sets the retention period for every raw technical log.

How should FMT programs manage business associate agreements?

Inventory organizations that handle PHI for the program, such as certain technology, hosting, billing, laboratory, or records services, and determine whether each relationship meets HIPAA’s definition of a business associate. A vendor name or service category alone does not decide the issue; consider what the vendor does and whether that work involves PHI.

When a business associate agreement (BAA) is required, confirm that a written agreement is signed and matches the service actually provided. It should address permitted and required uses and disclosures, appropriate safeguards, reporting of impermissible uses or disclosures and security incidents, applicable access or records-support obligations, subcontractors, and return or destruction of PHI when the agreement ends, where feasible. Review the HHS sample business associate agreement provisions and HHS Business Associates guidance.

Keep a BAA inventory with the vendor, services, PHI involved, agreement owner, effective date, and review status. A BAA does not replace the program’s own risk analysis, safeguards, or appropriate vendor oversight. When a business associate uses a subcontractor that handles PHI on its behalf, the agreement must address the required downstream protections.

Which donor, product, and clinical records should be prepared for an audit?

Prepare an organized evidence set that distinguishes HIPAA security documentation from clinical, laboratory, product, research, or regulatory records. The exact records to maintain depend on the program’s activities and applicable legal, institutional, contractual, and protocol requirements. For HIPAA readiness, be prepared to show how ePHI in these records is identified, accessed, protected, and reviewed.

• Security and governance evidence: Risk analysis and risk-management documentation, current policies, workforce training records, access approvals and reviews, system activity reviews, incident records, contingency-plan evidence, and vendor BAAs.
• Donor records: As applicable to the program, donor screening questionnaires, consent or authorization records, infectious-agent testing records, laboratory reports, eligibility decisions, and related review or follow-up documentation. Treat donor information according to its status and context; do not assume every donor record is automatically PHI under HIPAA.
• Product records: As applicable, collection and processing details, product identifiers, storage conditions, quarantine and release decisions, handling and transport records, and traceability from donation through use or disposition.
• Clinical records: Patient consent, treatment documentation, product-to-patient linkage, follow-up, and adverse-event documentation, consistent with the program’s applicable requirements.

FDA’s November 2022 FMT guidance describes a limited enforcement-discretion policy for certain uses to treat Clostridioides difficile infection not responding to standard therapies. The policy does not apply to FMT obtained from a stool bank, and it is not a general HIPAA records checklist. Programs should determine which FDA requirements or guidance apply to their specific model and use. See the FDA FMT enforcement policy guidance.

What are the limits of HIPAA audit readiness guidance for FMT programs?

HIPAA audit readiness is not a certification and does not by itself establish that an FMT program complies with every applicable requirement. HIPAA’s Security Rule applies to ePHI handled by covered entities and business associates; whether a particular program is regulated depends on its role and activities. The Security Rule does not cover paper or verbal information, although other HIPAA requirements may apply to PHI held by a covered entity.

This guide also does not determine which FDA, research, state, institutional, professional, or contractual requirements apply to a particular FMT program. FDA’s enforcement-discretion guidance has defined limits, so programs should not assume it covers stool-bank product or every FMT indication. HHS also distinguishes the Security Rule currently in effect from proposed modifications; do not treat proposed provisions as current requirements unless they become final and effective. See the HHS Security Rule overview.

In short, build readiness around a documented ePHI risk analysis, working safeguards, accountable access and audit processes, appropriate BAAs, and well-organized records. Then confirm the separate FMT-specific obligations that apply to your program with qualified compliance, privacy, and regulatory professionals.

FAQs.

What should an FMT program include in its HIPAA risk analysis?

Include the ePHI systems, applications, devices, workflows, and vendors in scope; the threats and vulnerabilities affecting confidentiality, integrity, and availability; the likelihood and potential impact of risks; existing safeguards; and planned actions to manage remaining risks. Document the method, decisions, owners, and updates as the environment changes.

Which systems and records should HIPAA audit controls cover?

Cover systems that create, receive, maintain, or transmit ePHI, which may include clinical, laboratory, donor-management, product-tracking, messaging, and cloud systems. Review relevant activity records and document the review process and follow-up. Keep the scope focused on systems containing or using ePHI, while considering associated security risks identified by the program.

What should an FMT program's business associate agreement address?

Address permitted and required uses and disclosures of PHI, safeguards, reporting of impermissible disclosures and security incidents, applicable support for individual rights, subcontractor protections, and return or destruction of PHI at termination where feasible. Make sure the agreement reflects the actual services and responsibilities of the parties.

How should donor screening and product handling records be protected?

Restrict records to authorized personnel, use appropriate physical and electronic safeguards, maintain traceability and handling documentation, and apply the program’s applicable retention and disclosure rules. Determine whether donor information is PHI in the relevant context, and separately verify the FDA, institutional, research, state, and protocol requirements that apply.