HIPAA Audit Readiness Guide for Health System Captive Insurance Companies

How does HIPAA apply to a health system captive insurance company?

A health system captive is not automatically a HIPAA covered entity or business associate just because it is owned by a health system or handles insurance risk. Its status depends on what it does, what kind of coverage it provides, and whether it creates, receives, maintains, or transmits protected health information (PHI) in a regulated role.

HIPAA covered entities include health plans, health care clearinghouses, and certain health care providers that conduct specified transactions electronically. A captive may require a HIPAA covered entity determination if it operates or administers a health plan, or if it performs services involving PHI on behalf of a covered entity. Review the definitions in 45 CFR § 160.103 and HHS’s covered entity guidance.

A captive that performs functions for a covered health system—such as claims administration, data analysis, or actuarial services involving PHI—may be a business associate. However, providing insurance coverage alone does not necessarily create a business associate relationship: HHS explains that a health insurance issuer or HMO does not become a business associate simply by providing coverage to a group health plan. The actual arrangement and activities matter, so document the analysis and obtain legal advice where the captive’s role is unclear. See HHS guidance on health insurers and group health plans.

If the captive is a covered entity or business associate, identify which HIPAA Privacy, Security, and Breach Notification Rule requirements apply to it. If it is not directly regulated, it may still have contractual, state-law, or organizational duties. Keep those obligations distinct from direct HIPAA obligations.

Define the captive’s audit scope, legal roles, and responsibilities

Start by recording the captive’s legal entity name, ownership, business purpose, products, locations, systems, and relationships with the health system, group health plans, third-party administrators, and other insurers. Document the captive’s HIPAA status and the facts supporting it, including the specific services it performs and whether those services involve PHI.

Set the audit scope around the captive’s actual operations rather than assuming that every health system policy or system applies to it. Identify the applicable HIPAA rules, covered business processes, departments, applications, and information flows. Where the captive shares staff, technology, or services with its parent organization, document how responsibilities and evidence are divided.

Assign named owners for privacy, security, legal, claims, information technology, vendor management, and incident response. If the captive is a covered entity or business associate, the Security Rule requires an assigned security official. Make responsibilities auditable with approved policies, role descriptions, committee records, and escalation procedures. HHS’s HIPAA audit protocol describes the types of policies, procedures, and implementation evidence auditors may review.

Inventory PHI and conduct a risk analysis

Create an electronic protected health information inventory that identifies where ePHI is created, received, maintained, or transmitted. Include claims platforms, document repositories, email, shared drives, analytics tools, endpoints, backups, cloud services, and vendor systems. For each system, record the data involved, business purpose, responsible owner, users, interfaces, storage location, and retention or disposal process.

Trace PHI flows between the captive, the health system, plan administrators, brokers, insurers, and other vendors. Note where the captive receives claim files, clinical documentation, or member information, and whether it sends data onward. HHS guidance explains that the Security Rule risk analysis covers all ePHI the regulated entity creates, receives, maintains, or transmits; see HHS guidance on risk analysis.

For a HIPAA Security Rule risk analysis, assess threats and vulnerabilities to the confidentiality, integrity, and availability of the captive’s ePHI. Document existing safeguards, likelihood and impact, risk ratings, and planned corrective actions. The analysis must be documented, but HIPAA does not prescribe a particular format or a universal annual schedule. Keep it current as operations, technology, vendors, or risks change; HHS describes the process as ongoing and says frequency depends on the organization’s circumstances.

Organize audit evidence and map it to HIPAA requirements

Build an evidence index that connects each applicable HIPAA requirement to the policy, procedure, record, or system evidence that demonstrates how it is implemented. Include an owner, approval or review date, covered system or process, and a clear file location. Keep evidence readable, current, and limited to what is relevant to the audit.

Useful evidence may include the documented role determination, risk analysis, risk-treatment plans, policies, workforce training records, access reviews, incident logs, vendor agreements, contingency-plan tests, and management approvals. For each control, show both the written requirement and proof that the process operates—for example, an access policy plus a completed user-access review and evidence that exceptions were resolved.

Use a controlled repository with version history and access restrictions. Track missing, outdated, or inconsistent evidence as findings, assign an accountable owner, and document remediation and closure. HIPAA documentation retention generally requires keeping documentation required by the Privacy and Security Rules for six years from creation or the date it was last in effect, whichever is later. This is not a blanket six-year retention rule for every business or medical record. Confirm additional state, insurance, contractual, and litigation requirements. See the Security Rule documentation provision and Privacy Rule documentation provision.

Verify access controls and security safeguards

Review who can access ePHI, why access is needed, and whether permissions match each person’s role. Test joiner, mover, and leaver processes, including approvals for new access, changes after role transfers, and timely removal when access is no longer needed. Review privileged accounts and emergency access procedures, and document how exceptions are authorized and monitored.

Inspect the access control audit trail for systems containing ePHI. Confirm that relevant systems generate activity records, that logs are protected from unauthorized changes, and that someone reviews them for unusual or inappropriate access. Retain evidence of the review, findings, escalation, and follow-up rather than presenting logs alone.

Assess administrative, physical, and technical safeguards against the captive’s documented risks. Depending on the environment, evidence may include security training, facility controls, workstation protections, backups, disaster recovery tests, and transmission safeguards. Select measures based on the organization’s size, systems, and risks; do not treat a particular tool or control as universally required unless the applicable HIPAA provision says so. HHS summarizes the HIPAA Security Rule safeguards and their risk-based approach.

Assess vendor and business associate compliance

Maintain a vendor inventory that identifies which vendors create, receive, maintain, or transmit PHI for the captive or on its behalf. Determine whether each relationship meets the business associate definition; having access to a system or being called a “vendor” does not by itself settle the legal question.

Where a business associate relationship exists, keep the signed business associate agreement (BAA) and confirm that it describes permitted uses and disclosures, required safeguards, incident reporting, and the handling of PHI at contract termination. If a business associate uses a subcontractor that handles PHI, verify that the applicable written assurances extend down the service chain. HHS explains the basic relationship and contract expectations in its business associate guidance.

Do not rely on a BAA as proof that a vendor’s controls work. Review risk-based evidence such as security assessments, incident history, access practices, recovery capabilities, and remediation plans. Record who reviewed the evidence, any limitations or exceptions, and how unresolved risks are managed. A vendor’s security report may support the review, but it does not replace the captive’s own assessment of risks to ePHI.

Document incidents, breach assessments, and corrective actions

Maintain a process for employees and vendors to report suspected security incidents promptly. Record the report date, discovery date, systems and data involved, people or entities affected, investigation steps, containment measures, and final disposition. Document security incidents even when the investigation finds no breach, and connect relevant incidents to updates in the risk analysis or safeguards.

For an impermissible use or disclosure of unsecured PHI, document the breach notification assessment. The assessment should address the required factors, the evidence considered, the conclusion, and whether notification is required. Preserve supporting records for any exception or conclusion that notification is not required. HHS explains that covered entities and business associates must be able to demonstrate that required notifications were made or that an incident did not constitute a reportable breach in its Breach Notification Rule guidance.

When notification is required, coordinate responsibilities and deadlines with the covered entity, business associate, insurer, and counsel as applicable. A business associate generally must notify the covered entity without unreasonable delay and no later than 60 days after discovery; the covered entity has its own notification duties. Do not assume that 60 days is the operational target—contracts may require faster reporting.

Track corrective actions from identification through closure. Record the root cause, assigned owner, planned control changes, due dates, approvals, and evidence that the fix was implemented and tested. A clear record of the captive’s role, PHI flows, safeguards, vendor oversight, and incident decisions helps demonstrate audit readiness while exposing gaps that need attention.

FAQs

Is a health system captive insurance company a HIPAA covered entity or business associate?

Not automatically. A captive may be a covered entity if it meets the HIPAA definition of a health plan or another covered entity, and it may be a business associate if it performs services on behalf of a covered entity that involve PHI. Determine its status from its actual coverage, functions, and information flows; the legal entity’s name or ownership alone is not decisive.

What evidence should a captive insurance company prepare for a HIPAA audit?

Prepare evidence supporting the captive’s HIPAA role determination, audit scope, PHI inventory, risk analysis, policies, assigned responsibilities, access approvals and reviews, audit logs, vendor inventory and BAAs, incident and breach assessment records, and corrective-action tracking. Include proof that controls operate, not only written policies.

How often should a captive update its PHI risk analysis?

HIPAA does not set a universal annual interval. The risk analysis should be an ongoing process, reviewed and updated as needed when changes in technology, operations, ownership, vendors, incidents, or threats affect ePHI risks. Set a review cadence that fits the captive’s environment and document the reasons for updates or continued applicability.

How long must HIPAA compliance documentation be retained?

Required HIPAA documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later. This rule does not automatically apply to every business record or medical record. Other laws, contracts, insurance requirements, or litigation holds may call for longer retention.