HIPAA Audit Readiness Guide for Freestanding Children’s Hospitals

A practical HIPAA audit-readiness program helps your hospital show how it protects electronic protected health information (ePHI), responds to privacy requests, and addresses risks. Organize evidence so staff can connect policies to actual safeguards, approvals, reviews, and corrective actions.

Use this guide as an operational checklist, not as a substitute for legal advice. HHS states that the current Security Rule remains in effect while proposed changes are considered; distinguish any proposed requirements from the rules currently in force. HHS HIPAA Security Rule NPRM page

How to conduct and update a security risk analysis for ePHI

Start with an ePHI asset inventory that identifies where the hospital creates, receives, maintains, or transmits ePHI. Include clinical and administrative systems, medical devices that connect to networks, mobile devices, backups, interfaces, cloud services, and relevant business associates. Record system owners, data types, locations, connections, and how each asset is used.

Use the inventory to conduct and document a Security Rule risk analysis: identify reasonably anticipated threats and vulnerabilities, consider the likelihood and impact of harm, and record the risk level and planned response. Include risks to confidentiality, integrity, and availability—for example, unauthorized access to pediatric records, unavailable systems during an emergency, or an unpatched device that stores or transmits ePHI. HHS explains that the Security Rule requires an accurate and thorough assessment and that the analysis should feed into risk management. HHS Guidance on Risk Analysis

Keep a risk register that links each finding to an owner, mitigation decision, target date, and evidence of completion. If you accept a risk temporarily, document the rationale, approval, compensating safeguards, and review date. The Security Rule does not prescribe a single risk-analysis format or a universal annual schedule; conduct ongoing analysis and update it when environmental or organizational changes affect ePHI security. HHS risk-analysis guidance

Revisit the analysis after material changes such as a new electronic health record module, facility renovation, merger, vendor change, newly connected device, security incident, or change in care workflows. Keep the prior version and the updated version so auditors can see what changed, why it changed, and how the hospital followed through.

Which HIPAA audit documents should a children’s hospital organize

Build an indexed, access-controlled audit repository with a named owner for each document category. Include current policies and procedures, assigned privacy and security responsibilities, workforce training and sanction records, risk analyses and remediation plans, incident files, access approvals and review evidence, business associate agreements, and records of privacy-rights requests and responses.

Keep both the governing document and evidence that it is being used. For example, pair an access-control policy with role definitions, approval records, termination records, and audit log review notes. Pair an incident-response procedure with incident tickets, investigation records, mitigation steps, and any required breach notices.

HIPAA’s documentation rule generally requires covered entities to retain required policies, procedures, and specified documentation for six years from creation or from the date the document was last in effect, whichever is later. This is a HIPAA documentation period; it is not a universal medical-record retention period. State law and other requirements may set separate retention rules for clinical records. HHS Summary of the HIPAA Security Rule

Organize evidence by rule area and date, and maintain a document index with the record owner, effective date, review date, and retention trigger. Limit repository access to people with a business need, and make sure records can be produced promptly without exposing unrelated patient information.

How to document access approvals reviews and monitoring

Document how the hospital grants, changes, and removes access to ePHI. For each workforce member, retain the role or job function, requested access, approving manager or data owner, systems and permissions granted, and the effective date. Use role-based access control where appropriate, while ensuring permissions reflect actual duties rather than job title alone.

Keep evidence of transfers, leave, termination, temporary assignments, and emergency access. A record should show when access was changed or disabled and who completed the action. For emergency “break-glass” access, record the reason, user, patient or system involved, time period, and subsequent review.

The Security Rule requires technical controls that record and examine activity in systems containing or using ePHI. Establish a risk-based audit log review process that identifies which systems and events are monitored, who reviews them, how often reviews occur, what triggers escalation, and how findings are resolved. HIPAA does not set one universal review frequency; document a cadence that is appropriate to the hospital’s risk analysis and systems. HHS OCR Audit Protocol

Retain review records that show the period examined, systems or accounts sampled, suspicious activity identified, investigation steps, and disposition. Demonstrate that monitoring covers sensitive pediatric workflows and is not limited to successful logins—for example, unusual searches, access to records outside a user’s care relationship, bulk exports, and repeated failed attempts.

How to manage children’s privacy rights and disclosure requests

Use a documented intake process for access, amendment, accounting, restriction, and disclosure requests. Record the request date, identity and authority checks, records or date range involved, responsible team, applicable deadline, decision, and date and method of response. Under HIPAA, a covered entity generally must act on an individual’s access request within 30 calendar days; one additional 30-day extension is allowed if the hospital provides a written explanation and completion date within the initial period. HHS guidance on access-request timing

For pediatric record authorization, do not assume that every parent or guardian has identical authority for every part of a child’s record. The parent is generally the minor’s personal representative when authorized to make health care decisions, but state or other law may create exceptions, including for certain services to which a minor may consent independently. HIPAA also permits limited exceptions when a provider reasonably believes that treating a person as the personal representative could endanger the child or when abuse or neglect is involved. HHS guidance on personal representatives and minors

Verify the requester’s identity and authority using records appropriate to the situation, such as legal guardianship documents, custody orders, or other applicable authorization. Route complex or disputed requests to privacy and legal staff, check relevant state law, and document which records are affected and the basis for the decision. Avoid applying a restriction to unrelated records when an exception concerns only a specific service or portion of the record.

For disclosures to family members who are not acting as personal representatives, document the patient’s agreement or the hospital’s professional judgment that sharing is in the patient’s best interests, as applicable. Keep copies of authorizations, disclosures, and the reasoning supporting decisions, while limiting access to the documentation to appropriate staff.

Which administrative physical and technical safeguards should be reviewed

Review safeguards across all three Security Rule categories and connect each control to risks identified in the Security Rule risk analysis. The Security Rule requires reasonable and appropriate safeguards to protect the confidentiality, integrity, and availability of ePHI; the specific measures should reflect the organization’s circumstances and risks. HHS Summary of the HIPAA Security Rule

• Administrative safeguards: Confirm assigned security responsibility, risk analysis and risk management, workforce security and access management, security awareness and training program, security incident procedures, contingency planning, and periodic technical and non-technical evaluations. Maintain evidence of approvals, exercises, reviews, and corrective actions.
• Physical safeguards: Review facility access controls, visitor handling, workstation use and security, device and media controls, equipment movement, and protections for areas where systems or records are kept. Include clinical locations where shared workstations and portable devices are used.
• Technical safeguards: Review unique user identification, access control, emergency access procedures, authentication, audit controls, integrity protections, and transmission security. Assess encryption decisions in light of risk; an “addressable” implementation specification is not simply optional—document whether and how it is reasonable and appropriate, including any alternative measures. HHS guidance on encryption

Test whether written procedures match real practice. Sample user accounts, facility access records, workstation configurations, backup and restoration results, and audit log review records. For gaps, document the risk, interim protections, responsible owner, and planned correction rather than relying on policy language alone.

How to prepare workforce and business associate records for an audit

Maintain a workforce roster that connects each person’s role to required training, authorized access, supervisor, and employment or assignment dates. Keep training content and completion evidence, including onboarding and relevant policy updates. HIPAA requires a security awareness and training program, but it does not impose a universal federal annual certificate-renewal requirement. A training completion certificate is evidence of an individual’s training; it does not, by itself, establish that the organization is HIPAA compliant. HHS Summary of the HIPAA Security Rule

Document how the hospital communicates its own procedures and policies, including pediatric privacy workflows, access rules, incident reporting, and sanctions. Preserve evidence of acknowledgments, training completion, and any corrective action where a workforce member did not follow policy.

Keep an inventory of vendors and other organizations that create, receive, maintain, or transmit PHI on the hospital’s behalf. For each applicable business associate, organize the business associate agreement, service description, effective term, subcontractor information where relevant, security contacts, and evidence of how incidents and individual-rights requests are escalated. The HIPAA Rules generally require satisfactory assurances through a contract or other written arrangement when a business associate handles PHI for a covered entity. HHS Business Associates guidance

Check that agreements address permitted uses and disclosures, safeguarding PHI, reporting security incidents and breaches, and support for the hospital’s Privacy Rule duties. Track renewals and service changes, and keep a record of follow-up when vendor performance or an incident raises concerns. Do not assume that every provider receiving information for treatment is a business associate; classify the relationship based on the services and applicable HIPAA rules.

How to document incident response and retain HIPAA records

Maintain a written process for reporting, triaging, investigating, containing, and documenting suspected or known security incidents. An incident file should identify when the event was detected and reported, systems and information affected, people involved, containment and recovery actions, evidence preserved, and decisions made by the response team. Record lessons learned and track corrective actions to closure.

For a suspected impermissible use or disclosure of PHI, document the breach notification assessment. Unless an exception applies, an impermissible use or disclosure is presumed to be a breach unless the hospital demonstrates a low probability that the PHI was compromised. The assessment must consider the nature and extent of the PHI, who received or used it, whether it was actually acquired or viewed, and mitigation. Retain the analysis and evidence supporting the outcome. HHS OCR Audit Protocol

If notification is required, document how the hospital met the applicable deadlines and requirements. Individual notices must be provided without unreasonable delay and no later than 60 calendar days after discovery; reporting to HHS depends in part on the number of affected individuals. Keep copies of notices, submission confirmations, affected-person lists, and communications with business associates. HHS Breach Notification Rule guidance

Apply the six-year HIPAA documentation retention rule to required Security Rule documentation, policies, and procedures, and separately confirm retention requirements for medical records and other records under state law or other applicable requirements. Suspend routine destruction when a legal hold, investigation, or other obligation requires preservation. A reliable audit package links each policy to current evidence, each identified risk to a management decision, and each incident to a documented outcome.

FAQs

How often should a freestanding children’s hospital update its security risk analysis?

HIPAA does not set a universal annual update interval. The analysis should be ongoing and revisited when environmental or organizational changes affect ePHI security, such as new technology, significant workflow changes, new vendors, or security incidents. Document the hospital’s review cadence and the reasons for updates. HHS Guidance on Risk Analysis

What HIPAA documentation should be ready for an audit?

Prepare current policies and procedures; risk analyses and remediation plans; workforce training and access records; audit log review evidence; physical and technical safeguard records; business associate agreements; privacy-request files; and incident and breach notification assessments. Organize the records so you can show both the requirement and how the hospital implemented it.

How long must HIPAA Security Rule documentation be retained?

Required Security Rule documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later. This HIPAA period does not establish how long the hospital must retain medical records; separate state or other requirements may apply. HHS Summary of the HIPAA Security Rule

How should hospitals verify authority for requests involving children’s records?

Verify the requester’s identity and legal authority, review any relevant guardianship or custody documentation, and determine whether state or other law changes who may act for the child or access specific information. Escalate uncertain or disputed cases to privacy and legal staff, and document the records covered and the decision’s rationale. HHS guidance on personal representatives and minors