HIPAA Audit Readiness Guide for Medical Device Manufacturer Patient Services

Patient services can bring a medical device manufacturer into contact with protected health information (PHI) through support calls, device maintenance, remote monitoring, patient coaching, or connected software. Audit readiness starts by mapping those services to the manufacturer’s actual role: a company is not subject to HIPAA simply because it makes or sells a medical device, but it may become a business associate when it handles PHI on behalf of a covered entity.

Use this guide to assess where PHI flows, document the safeguards that apply, and prepare evidence that shows how your patient services work in practice. The scope depends on the facts of each relationship, so confirm your obligations against current requirements and your contracts.

Which HIPAA requirements apply to medical device manufacturer patient services?

HIPAA’s Privacy, Security, and Breach Notification Rules apply to covered entities and business associates, not to every organization that handles health-related information. A device manufacturer may be a business associate when it performs services for a covered entity that involve creating, receiving, maintaining, or transmitting PHI, or when its service involves disclosure of PHI to the manufacturer. HHS specifically identifies certain device servicing arrangements as a possible business-associate relationship when the service gives a technician access to PHI stored on a device. See HHS guidance on business associates.

Assess the actual service, data, and access involved—not just the product label or contract title. For example, a manufacturer that provides patient support on behalf of a hospital and receives identifiable patient records may have a different HIPAA role from a manufacturer that sells a device directly to a consumer without acting for a covered entity. If the manufacturer is a business associate, it must comply with applicable HIPAA requirements and the terms of its business associate agreement (BAA).

Identify every party in the service chain. A cloud host, call-center provider, analytics vendor, or other business associate subcontractor that creates, receives, maintains, or transmits PHI on the manufacturer’s behalf may need a written agreement with required HIPAA protections. HHS explains that business-associate contract requirements apply to agreements with both business associates and their subcontractors; see HHS business associate guidance.

A BAA should describe the permitted and required uses and disclosures of PHI, restrict other uses and disclosures, require appropriate safeguards and reporting, address assistance with covered-entity obligations where applicable, and provide for return or destruction of PHI at termination when feasible. Review the current requirements in 45 CFR § 164.504(e). A signed agreement is important, but it does not by itself show that safeguards are implemented or that the manufacturer’s practices match the contract.

How can you determine whether patient services involve protected health information?

Map each service workflow from intake through closure, including the people, devices, applications, and vendors that touch the data. Include call recordings, service tickets, remote-access sessions, device logs, patient account details, support messages, and information exported to analytics or case-management platforms. For each data element, ask whether it identifies a person and relates to that person’s health, care, or payment for care.

Track where data is created, received, maintained, or transmitted and whether the manufacturer handles it on behalf of a covered entity. Data that appears technical—such as a device serial number, event timestamp, or diagnostic log—may still be identifying when it can be linked to a named patient or another identifying record. Document the basis for treating data as PHI or not PHI, and reassess when a workflow, data field, or linkage changes.

Separate patient-facing services from activities performed independently by the manufacturer. The purpose, relationship, and information involved matter: a manufacturer may be handling PHI for a provider in one workflow while collecting different information directly from consumers in another. If the manufacturer is neither a covered entity nor a business associate for a particular activity, HIPAA may not govern that activity; assess any other applicable obligations separately rather than assuming the HIPAA label resolves them.

Also identify whether the manufacturer holds information in a designated record set for a covered entity. A designated record set can include medical and other records used, in whole or in part, to make decisions about individuals. HHS explains that an individual’s access right generally covers PHI in a covered entity’s designated record set, including qualifying information held by its business associate. See HHS guidance on access to PHI.

What policies and procedures should an audit readiness program document?

Write policies that match the actual patient services and data flows. At a minimum, document how the organization identifies PHI, approves and limits access, handles permitted uses and disclosures, manages patient requests, reports incidents, trains relevant workforce members, and oversees business associates and subcontractors. Assign responsible owners for privacy, security, incident response, and audit coordination.

Maintain a current inventory of systems and workflows that create, receive, maintain, or transmit electronic PHI (ePHI). Document the results of a Security Rule risk analysis, including identified threats and vulnerabilities, existing safeguards, risk decisions, and corrective actions. HHS describes the required risk analysis as an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI; see HHS guidance on Security Rule risk analysis.

Keep a BAA inventory and associate each agreement with the services, data, systems, and vendors it covers. Procedures should explain how the manufacturer approves new vendors, confirms required subcontractor agreements, responds to contract changes, and handles PHI when a relationship ends. The agreement and operating procedures should align: if the BAA requires prompt incident reporting or assistance with access requests, the relevant teams need a workable process to meet those commitments.

Document incident reporting, investigation, mitigation, and breach notification procedures. Include escalation contacts, decision authority, evidence preservation, coordination with the covered entity, and how the manufacturer records the response. HIPAA’s Security Rule also requires documentation of specified security policies, procedures, actions, and assessments; under 45 CFR § 164.316, required Security Rule documentation must generally be retained for six years from creation or the date it was last in effect, whichever is later. Apply the retention rule to required documentation, and assess other records under applicable contracts and laws.

How should patient access, use, and disclosure of PHI be controlled?

Give employees and contractors access based on their assigned work, and remove or change access when responsibilities change or a person leaves. For patient services, a support specialist may need limited account or device information while a field technician may need only the data required to diagnose a particular issue. Use role-based permissions, individual accounts, approval processes, and access reviews that fit the system and risk.

Apply the minimum necessary standard when it applies: limit PHI used, disclosed, or requested to what is reasonably needed for the purpose. The standard has exceptions, including disclosures to or requests by a health care provider for treatment and disclosures to the individual who is the subject of the information. Do not treat “minimum necessary” as a blanket reason to withhold information needed for a permitted activity. See HHS minimum necessary guidance.

Route patient requests to the covered entity unless the BAA assigns the manufacturer a specific responsibility to receive or fulfill them. A covered entity remains responsible for responding to individual rights requests, but its agreement must ensure that PHI held by the business associate is available as needed; the parties may also agree that the business associate will respond directly. For information in a designated record set, document how requests are authenticated, tracked, escalated, and completed. See HHS guidance on business associates and individual rights.

Use only approved channels to disclose PHI to providers, patients, service partners, or other recipients, and verify the recipient and purpose before sending. Record disclosures when required, and ensure the BAA defines the manufacturer’s permitted uses and disclosures. When a subcontractor handles PHI, confirm that written protections and operating controls flow down through the service chain.

What evidence should you collect to demonstrate HIPAA compliance?

Build an evidence set that is organized, current, and tied to the requirement being tested. OCR’s audit protocol reviews selected requirements under the Privacy, Security, and Breach Notification Rules and may request specific documents rather than a general collection of policies. Use the HHS OCR audit protocol to understand the kinds of controls and documentation that may be examined.

• Scope and governance: service and data-flow maps, PHI inventories, system inventories, assigned privacy and security responsibilities, and records explaining the manufacturer’s business-associate analysis.
• Contracts and vendors: executed BAAs, subcontractor agreements, vendor inventories, and records showing how the organization assesses whether an agreement covers the relevant service.
• Security program: documented Security Rule risk analysis, risk-management plans, access approvals and reviews, incident records, system safeguards, and follow-up evidence for corrective actions.
• Privacy and service operations: policies for permitted uses and disclosures, minimum-necessary decisions where applicable, patient-request routing, PHI handling in support workflows, and records showing procedures were followed.
• Training and oversight: applicable training materials, completion records, security reminders, sanctions procedures, and records of reviews or assessments.
• Incident response: incident timelines, investigation notes, impact assessments, mitigation steps, covered-entity notifications, and the basis for any decision about whether breach notification is required.

Keep evidence representative of actual operations, not only policy documents. A policy may say access is reviewed, for example, while access-review records show whether the process happened and whether exceptions were resolved. Keep versions and dates clear, and be prepared to explain gaps accurately rather than implying that missing records exist.

How can you prepare staff and systems for an audit?

Make audit responsibilities clear before a request arrives. Identify who receives the request, who validates its scope, who gathers records, who approves responses, and who coordinates with the covered entity. Keep a controlled document repository so staff can locate current policies, BAAs, risk-analysis materials, and implementation evidence without assembling unrelated records.

Train workforce members on the policies and security procedures relevant to their roles. Staff who handle patient services should know how to verify identity, avoid unnecessary access, use approved communication channels, recognize misdirected information, and escalate a suspected incident. HHS’s Security Rule materials describe security awareness and training for the workforce; see HHS’s Security Rule summary.

Training records help show that training occurred, but a completion certificate does not establish that the organization as a whole is HIPAA compliant. Training should reflect employer-specific policies and the work each person performs. HIPAA does not set a universal annual certificate-renewal requirement; maintain the training and updates your applicable requirements and organizational procedures call for.

Test the systems and procedures that protect ePHI. Confirm that access controls, account termination, incident reporting, backups, and escalation routes work as documented. Run a mock evidence request or tabletop incident exercise, record gaps, assign owners, and track remediation to completion. An exercise is useful preparation, but it does not replace the required risk analysis or other HIPAA obligations.

What limitations and compliance risks should manufacturers assess?

Do not assume that every device or patient-service activity falls under HIPAA. Applicability depends on whether the organization meets the definition of a covered entity or business associate in the particular activity and whether the information is PHI. Conversely, do not assume that a manufacturer avoids business-associate status simply because it does not routinely view patient records: maintaining or transmitting ePHI on behalf of a covered entity can also be relevant. Confirm each workflow and agreement against the facts.

Watch for gaps between contracts and operations. A BAA may not reflect a new remote-support feature, cloud service, analytics pipeline, or subcontractor. A vendor’s security assurances do not replace the manufacturer’s own assessment of its obligations, risks, and responsibilities under the agreement. Revisit the analysis when services, technologies, data, or parties change.

Prepare for suspected incidents without treating every security event as a confirmed breach. A suspected event should be promptly escalated, contained where appropriate, investigated, and documented. If unsecured PHI may have been breached, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; the BAA may require a shorter reporting period. The covered entity generally handles required notices to affected individuals and HHS unless responsibilities have been delegated. See HHS breach notification guidance.

Audit readiness is strongest when the manufacturer can connect each patient service to its HIPAA role, contract, PHI workflow, safeguards, and evidence. Keep the analysis current, train staff for their specific responsibilities, and coordinate with covered entities so patient services and incident responses work as documented.

FAQs.

When does a medical device manufacturer become a HIPAA business associate?

A manufacturer may become a business associate when it performs a service for a covered entity that involves creating, receiving, maintaining, or transmitting PHI, or when the service involves disclosure of PHI to the manufacturer. The specific facts matter; making or selling a device alone does not automatically make the manufacturer a business associate. See HHS business associate guidance.

What should a business associate agreement cover for patient services?

A BAA should define permitted and required uses and disclosures of PHI; require the business associate to protect the information, report specified improper uses, disclosures, and breaches, and ensure subcontractors agree to required protections; and address assistance with covered-entity obligations when applicable. It should also address return or destruction of PHI at termination when feasible. Review 45 CFR § 164.504(e) and make sure the agreement matches the services actually performed.

What evidence may be requested during a HIPAA audit?

Depending on the audit scope, evidence may include policies and procedures, risk-analysis records, BAAs, training documentation, access controls and reviews, incident records, and documentation showing how safeguards operate. OCR’s audit protocol addresses selected requirements and the documents relevant to them; see the HHS OCR audit protocol.

How should a manufacturer respond to a suspected PHI breach?

Escalate the event promptly under the incident-response plan and BAA, contain the issue where appropriate, preserve relevant evidence, investigate what happened and what PHI may be involved, and document actions and findings. Notify the covered entity according to the contract and without unreasonable delay if a breach of unsecured PHI has occurred; the HIPAA outside limit is no later than 60 calendar days after discovery, but a BAA may set a shorter deadline. Coordinate external notifications with the covered entity unless the agreement delegates that responsibility. See HHS breach notification guidance.