HIPAA Audit Readiness Guide for Hospice and Palliative Care Agencies

Hospice and palliative care agencies handle sensitive health information across offices, care facilities, and patients’ homes. Audit readiness means being able to show how your agency protects that information, responds to risks, and follows its written procedures—not simply having a policy manual on file.

Use this guide to organize evidence, identify gaps, and show how your safeguards operate in practice. HIPAA requirements depend on your agency’s role and activities, so confirm that your policies also account for applicable state law and contractual obligations.

Which HIPAA requirements apply to hospice and palliative care agencies?

A hospice or palliative care provider is generally a HIPAA covered entity if it electronically transmits health information in connection with a transaction for which HHS has adopted a standard, such as certain electronic billing or eligibility transactions. Using email or another electronic tool by itself does not make a provider a covered entity; the relevant question is whether it conducts a covered transaction. See the HHS overview of covered entities.

Covered agencies must follow the HIPAA Privacy, Security, and Breach Notification Rules. The Privacy Rule governs uses and disclosures of protected health information (PHI), including paper records and conversations. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI (ePHI). The Breach Notification Rule applies when a breach of unsecured PHI requires notification. Business associates may also have direct obligations under HIPAA. These requirements are summarized in HHS’s HIPAA Security Rule overview and its Privacy Rule overview.

For day-to-day operations, build procedures around how clinicians, social workers, aides, schedulers, billing staff, and volunteers encounter PHI. The minimum necessary standard generally requires reasonable efforts to limit uses, disclosures, and requests to the amount needed for the purpose. It does not apply to disclosures to, or requests by, a health care provider for treatment purposes; see HHS guidance on the minimum necessary standard.

How should agencies conduct a HIPAA risk analysis and document remediation?

A HIPAA Security Rule risk analysis must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of all ePHI your agency creates, receives, maintains, or transmits. Start by mapping where ePHI lives and how it moves: electronic health records, scheduling and billing systems, staff phones and laptops, cloud services, remote access, and information exchanged with partners. HHS explains the required scope in its Guidance on Risk Analysis.

For each system or workflow, identify relevant threats and vulnerabilities, estimate the likelihood and potential impact of harm, and record existing safeguards. Then document what needs improvement, who owns each action, its priority and target date, and how completion will be verified. Keep evidence such as updated configurations, revised procedures, training records, or completed tests with the remediation record.

The Security Rule requires risk management—implementing measures to reduce identified risks to a reasonable and appropriate level—not just a written assessment. Risk analysis should be an ongoing process, updated as operations, systems, vendors, or risks change. HIPAA does not prescribe a universal annual schedule for conducting a comprehensive risk analysis; HHS notes that frequency depends on the organization and its circumstances. See HHS’s explanation of risk analysis and risk management and its risk analysis guidance.

When a safeguard specification is “addressable,” it is not automatically optional. Assess whether it is reasonable and appropriate for your agency; if it is not, document that determination and implement an equivalent alternative measure when reasonable and appropriate. Retain the assessment and remediation evidence so reviewers can trace each identified risk to a decision and action.

What policies and records should be ready for an audit?

Organize the evidence that demonstrates both written procedures and actual implementation. Depending on the audit’s scope, this may include:

• Current Privacy and Security policies, including procedures for handling, using, disclosing, and safeguarding PHI.
• Your HIPAA Security Rule risk analysis, risk-management plan, remediation tracker, and periodic evaluations.
• Workforce privacy and security training materials and records, plus applicable sanction and incident procedures.
• Current business associate agreements and an inventory of vendors that create, receive, maintain, or transmit PHI for the agency.
• Access-control procedures, user-access records, and evidence that access is changed or removed when job duties or employment status change.
• Security incident records, breach assessments, and documentation of any required notifications or the rationale that notification was not required.
• Contingency plans, backup and recovery procedures, and records of relevant exercises or tests.
• Privacy official and complaint-contact designations, where applicable, and records related to patient requests and complaints within the audit scope.

HIPAA generally requires Security Rule policies and required Security Rule documentation to be retained for six years from creation or the date they were last in effect, whichever is later. This is not a blanket HIPAA retention period for every clinical record: HIPAA does not set a general medical-record retention period, though other laws may. See HHS’s Security Rule documentation overview and its FAQ on medical-record retention.

Check that records are dated, approved where your procedures require approval, easy to retrieve, and consistent with current practice. The six-year documentation rule does not, by itself, establish that every system log must be kept for six years; determine log retention through applicable requirements, agency policy, and risk analysis.

How can agencies verify workforce training and access controls?

Maintain evidence that workforce members received Privacy Rule training appropriate to their duties and Security Rule awareness training. A useful training record identifies the person, training date, subject matter, and completion status. Keep training materials and records of follow-up instruction when an employee’s duties or relevant policies change.

HIPAA does not impose a universal annual training certificate-renewal requirement. Covered entities must train workforce members as necessary and appropriate for their functions, including new workforce members within a reasonable period and affected members after material policy changes. A completion certificate shows that a person completed a course; it does not establish that the agency as a whole complies with HIPAA or that employees understand employer-specific procedures. See the HHS HIPAA Audit Protocol for the training and documentation areas reviewers may examine.

Review whether access matches each person’s job duties. Keep records of user accounts, approved access, role or location changes, and timely account deactivation. HIPAA requires unique user identification for users who access ePHI and audit controls that record and examine activity in systems containing or using ePHI. Review access control audit logs according to your procedures, and retain evidence of reviews, follow-up, and investigation of unusual activity. HHS describes these controls in its Audit Protocol and unique-user-identification guidance.

How should agencies safeguard PHI in home-based care and vendor relationships?

Home-based care requires safeguards that work outside a controlled office. Set clear procedures for staff using mobile devices and paper records during visits. Depending on your risk analysis, practical safeguards may include device encryption, screen locks, secure remote access, multifactor authentication, remote device management, and a process for reporting a lost device. Protect printed notes and visit lists from household members or visitors, avoid leaving PHI visible in vehicles or shared spaces, and use approved channels for sending clinical information.

These are risk-based operational measures, not a single federally prescribed home-visit checklist. HIPAA requires reasonable and appropriate safeguards; HHS confirms that mobile devices may be used to access ePHI when appropriate safeguards are in place. See HHS guidance on mobile devices and cloud access.

Identify whether a vendor is a business associate based on the services it performs and its handling of PHI. When a business associate relationship exists, put the required protections in a business associate agreement (BAA), including permitted uses and disclosures, safeguards, incident reporting, and applicable subcontractor protections. A BAA does not replace your agency’s own risk analysis or oversight. HHS explains the requirements in its Business Associates FAQs and sample business associate agreement provisions.

Keep a current vendor inventory, signed agreements, and evidence of relevant vendor reviews. Review contract terms for incident-reporting timelines and cooperation with investigations; those terms can set expectations that are more operationally useful than waiting for a regulatory deadline. Not every vendor is automatically a business associate, so assess the relationship rather than relying on the vendor’s label.

What breach response and incident records should agencies maintain?

Train staff to report suspected or known security incidents promptly, including misdirected messages, lost devices, inappropriate access, and suspected cyberattacks. Document the report, dates, people involved, information and systems affected, containment steps, investigation findings, mitigation, and outcome. The Security Rule requires entities to identify and respond to security incidents, mitigate harmful effects to the extent practicable, and document incidents and outcomes. See 45 CFR § 164.308.

A security incident is not automatically a reportable breach. For an impermissible use or disclosure of PHI, document the breach assessment and the facts considered, including the nature and extent of the information, who received or used it, whether it was actually acquired or viewed, and what mitigation occurred. Preserve relevant records and system evidence while the agency investigates.

If notification is required for a breach of unsecured PHI, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more individuals have additional HHS reporting obligations within that timeframe; for breaches affecting fewer than 500 individuals, HHS reporting may be made annually, by 60 days after the end of the calendar year in which the breach was discovered. A breach affecting more than 500 residents of a state or jurisdiction also triggers media notice. Business associates must notify the covered entity as required by the rule and their agreement. Review the current HHS Breach Notification Rule guidance and the text of 45 CFR Part 164, Subpart D.

Maintain the incident report, investigation and risk assessment, mitigation records, copies of notices, proof of delivery or reporting, and any documented rationale for concluding that notification was not required. Do not treat a vendor’s notice or a staff member’s initial description as a substitute for the agency’s own assessment.

How can agencies prepare for auditor requests and address compliance gaps?

Assign a response lead and identify who can retrieve evidence for privacy, security, workforce, vendor, and clinical operations topics. Create an index that maps likely requests to the relevant policy, record, system owner, and date range. Before providing records, confirm that the response matches the request and use a secure transfer method for PHI.

Check that the evidence is complete and internally consistent. If a policy describes access reviews, for example, be prepared to show the review records and how identified issues were handled. If a record is missing or a safeguard has not been implemented, document the gap accurately, assess the risk, assign an owner and target date, and track corrective action. Do not backdate records or present planned remediation as completed work.

Keep a clear record of requests, submitted materials, follow-up questions, and the agency’s responses. An organized risk analysis, reliable records, tested contingency plan, documented access controls, and timely incident handling help demonstrate an ongoing compliance process. Treat audit preparation as a way to verify and improve your safeguards—not as a guarantee that an auditor will find no gaps.

FAQs

What documents should a hospice agency prepare for a HIPAA audit?

Prepare current Privacy and Security policies, the risk analysis and remediation records, workforce training evidence, access-control and log-review records, business associate agreements, incident and breach records, and contingency plans with relevant testing or exercise records. Also organize patient-related records and complaint or request documentation if they fall within the audit scope. Keep required HIPAA documentation for the applicable retention period and distinguish those records from clinical records whose retention may be governed by other laws.

How often should a hospice or palliative care agency conduct a HIPAA risk analysis?

HIPAA does not specify a fixed annual interval for a comprehensive risk analysis. Conduct it as part of an ongoing risk-management process and revisit it when changes in systems, operations, vendors, or security incidents could affect ePHI risks. Your agency may set a regular review schedule based on its circumstances, but a calendar schedule alone does not replace updates prompted by material changes.

What HIPAA safeguards apply to staff accessing PHI in patients’ homes?

Use reasonable and appropriate administrative, physical, and technical safeguards based on the agency’s risk analysis. Procedures may address secure devices and connections, screen locking, keeping paper records out of view, limiting access to job-related needs, and reporting lost devices or suspected disclosures. HIPAA does not prescribe one specific set of home-visit technologies for every agency; safeguards should fit the risks and the way staff provide care.

What should an agency do if it discovers a potential HIPAA breach?

Promptly report and document the incident, contain it where practicable, preserve relevant evidence, investigate what PHI and individuals may be affected, and perform the required breach assessment. Follow the agency’s response procedures and involve the privacy or security lead. If the incident is a breach of unsecured PHI requiring notification, notify affected individuals without unreasonable delay and no later than 60 days after discovery, and complete any applicable HHS and media reporting.