HIPAA Audit Readiness Guide for Medical Malpractice Insurance Carriers

Does HIPAA apply to medical malpractice insurance carriers?

A medical malpractice insurance carrier is not automatically a HIPAA covered entity simply because it insures healthcare professionals or handles claims involving patient information. HIPAA covered entities are health plans, healthcare clearinghouses, and certain healthcare providers. HHS identifies liability insurance as an excepted benefit that is not a health plan under HIPAA’s definition. See the HHS guidance on insurance coverage under HIPAA and the federal definitions of covered entity and health plan.

A carrier may, however, be a business associate when it performs a regulated function or service for a covered entity and receives, creates, maintains, or transmits protected health information (PHI) in doing so. The business associate definition includes certain claims-processing and legal services provided on behalf of a covered entity. A carrier’s role depends on its actual work, contractual relationships, and information flows—not just its industry or access to medical records. Review each business line and relationship separately; a company may also have a distinct role, such as a health plan, in another part of its operations. See 45 CFR § 160.103.

If a carrier acts as a business associate, HIPAA obligations apply to that role. Business associates are directly subject to applicable HIPAA requirements, including the Security Rule for ePHI they create, receive, maintain, or transmit on behalf of a covered entity. The carrier should document its role determination, identify the PHI it handles, and confirm whether a business associate agreement (BAA) is required.

What do HIPAA audits assess under the Privacy, Security, and Breach Notification Rules?

An OCR audit may review a covered entity’s or business associate’s policies, procedures, controls, and evidence of implementation. The audit scope varies by the entity’s role and the requirements selected for review; the HHS OCR Audit Protocol is organized by Privacy, Security, and Breach Notification Rule requirements.

• Privacy Rule: Review whether PHI is used and disclosed as permitted, whether required safeguards and business associate arrangements are in place, and whether any delegated Privacy Rule functions are performed appropriately. The specific obligations depend on whether the carrier is a covered entity or business associate and on its contracts.
• Security Rule: Review the administrative, physical, and technical safeguards protecting ePHI. Evidence may include the security risk analysis, risk-management plans, access controls, workforce procedures, incident response, contingency planning, and system activity reviews.
• Breach Notification Rule: Review how the organization identifies, assesses, documents, and reports breaches of unsecured PHI. If a breach occurs at or by a business associate, the business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery; a BAA may set a shorter reporting deadline. See 45 CFR § 164.410.

For a carrier acting as a business associate, audit readiness means being able to show how it meets the requirements that apply to business associates and the obligations in its BAAs. Do not assume that every Privacy Rule obligation imposed on a covered entity applies identically to the carrier.

How to evaluate and document safeguards for electronic PHI

Start by identifying where the carrier creates, receives, maintains, or transmits electronic protected health information (ePHI). Map the systems, applications, storage locations, users, vendors, and data exchanges involved in claims, legal, and support workflows. Include information handled by remote workers and subcontractors when it is within the scope of the carrier’s business associate role.

The HIPAA Security Rule’s administrative safeguards require an accurate and thorough risk analysis, risk management, appropriate workforce sanctions, and regular review of information-system activity. The analysis should assess potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI, then connect identified risks to mitigation decisions and evidence of implementation. See 45 CFR § 164.308 and HHS guidance on Security Rule risk analysis.

Evaluate administrative, physical, and technical safeguards in the context of the carrier’s environment. A practical evidence file can include:

• A current inventory of ePHI systems and a description of relevant data flows.
• Written security risk analysis documentation that records risks, vulnerabilities, risk decisions, and planned corrective actions.
• Policies and procedures for access authorization, workforce security, security training, incident response, contingency planning, and vendor oversight.
• Evidence that selected safeguards operate, such as access reviews, training records, incident records, recovery tests, and remediation tracking.
• Evaluation reports showing findings, decisions, responsible owners, and follow-up dates.

When a Security Rule implementation specification is “addressable,” that does not mean the organization can ignore it. The carrier must assess whether it is reasonable and appropriate in its environment. If it is not, document that determination and implement an equivalent alternative measure when reasonable and appropriate. See 45 CFR § 164.306.

Which business associate agreements and assurances are required?

When a covered entity allows a business associate to create, receive, maintain, or transmit ePHI on its behalf, it must obtain satisfactory assurances through a written contract or other permitted arrangement. The BAA should define permitted and required uses and disclosures, require appropriate safeguards, address reporting of impermissible uses and disclosures and security incidents, and set out applicable cooperation with individual rights requests. See 45 CFR § 164.504 and HHS business associate guidance.

A carrier acting as a business associate should maintain its upstream BAAs with covered-entity customers and determine whether vendors or other subcontractors that handle PHI on its behalf need downstream agreements. The carrier must ensure that applicable subcontractors agree to the same restrictions and conditions that apply to the carrier. Keep an agreement inventory linked to the services, PHI involved, contract owner, and renewal or review dates.

Review security incident reporting provisions carefully. HIPAA requires a business associate BAA to address reporting of security incidents, and the Breach Notification Rule sets a maximum 60-calendar-day deadline for reporting a breach of unsecured PHI to the covered entity. The parties may agree to a shorter operational deadline so the covered entity has time to investigate and meet its own notification obligations. See 45 CFR § 164.410.

How to maintain audit controls for systems containing PHI

HIPAA requires information system audit controls: hardware, software, or procedural mechanisms that record and examine activity in systems containing or using ePHI. The Security Rule also requires regular review of information-system activity records, such as audit logs, access reports, and security incident tracking reports. See 45 CFR § 164.312 and 45 CFR § 164.308.

For useful information system audit controls, identify the systems that contain or use PHI, configure available logs and reports, restrict access to those records, and define who reviews them and how potential issues are escalated. Depending on the risk analysis, review evidence may include user access, failed logins, administrative changes, and activity relevant to a security incident. Document review procedures, findings, investigations, and corrective actions.

The Security Rule does not prescribe a single log format or a universal review frequency for every system. Set review procedures based on the risk analysis, system capabilities, and the sensitivity and use of the information. Also distinguish operational logs from HIPAA documentation: the six-year documentation rule applies to documentation required under the Security Rule, but it should not automatically be treated as a universal six-year retention period for every system log.

What HIPAA documentation must carriers retain and for how long?

For Security Rule documentation, a covered entity or business associate must maintain required policies and procedures in written or electronic form and keep written or electronic records of actions, activities, or assessments that the Security Rule requires it to document. The required retention period is six years from the date the documentation was created or the date it was last in effect, whichever is later. See 45 CFR § 164.316.

For audit readiness, organize the relevant records so you can retrieve current and historical versions of policies, risk analyses, risk-management decisions, evaluation results, incident documentation, and other required records. Track when each document was created, revised, approved, and superseded; make it available to staff responsible for carrying out the procedures it describes.

The six-year HIPAA documentation retention rule is not a blanket retention period for every insurance claim file, medical record, or business record. Other federal or state requirements, litigation holds, contracts, and company schedules may require a different or longer period. Identify those obligations separately rather than treating HIPAA’s documentation rule as the only retention standard.

What are the limits of business associate audit rights?

HIPAA requires a business associate to make relevant internal practices, books, and records available to HHS for purposes of determining a covered entity’s compliance with the Privacy Rule. That regulator-facing obligation is not the same as an automatic right for every customer to conduct an on-site audit or inspect all of a business associate’s security records. See 45 CFR § 164.504.

HHS explains that the HIPAA Rules do not expressly require a business associate cloud service provider to document its security practices for customers or allow customer audits. Customers may negotiate additional assurances—such as security reports, evidence of safeguards, or audit rights—in a BAA, service-level agreement, or other contract, based on their risk analysis and compliance needs. See HHS guidance on customer audits of business associate cloud service providers.

When negotiating audit provisions, define scope, notice, frequency, permitted evidence, confidentiality, and alternatives such as independent assessment reports. These are contractual and risk-management choices, not universal HIPAA audit rights. A clear audit trail, appropriate agreements, documented risk decisions, and required six-year documentation retention are central to a carrier’s audit readiness.

FAQs

Are medical malpractice insurance carriers covered entities under HIPAA?

Not solely because they provide malpractice liability insurance. HHS identifies liability insurance as an excepted benefit rather than a HIPAA health plan. A carrier may have a different HIPAA role if it separately operates as a covered entity or performs business associate services involving PHI on behalf of a covered entity. See HHS guidance on insurance coverage under HIPAA.

How often must a carrier evaluate its security safeguards?

The Security Rule requires periodic technical and nontechnical evaluations and reassessment in response to environmental or operational changes affecting ePHI, but it does not set one universal interval. HHS also explains that the rule does not specify a fixed frequency for risk analysis. Set and document a schedule appropriate to the carrier’s environment and reassess when significant changes or newly recognized risks warrant it. See 45 CFR § 164.308 and HHS risk analysis guidance.

How long must HIPAA Security Rule documentation be retained?

Retain documentation required by the Security Rule for six years from its creation or the date it was last in effect, whichever is later. This applies to required policies, procedures, and documented actions, activities, or assessments—not automatically to every business or claims record. See 45 CFR § 164.316.

Does HIPAA require business associates to permit customer audits?

HIPAA does not generally require a business associate to permit customer audits of its security practices. A covered entity or business associate customer may negotiate audit or documentation provisions in its contract. The business associate has a separate obligation to make relevant practices, books, and records available to HHS in the circumstances specified by the rule. See HHS guidance on customer audits and 45 CFR § 164.504. In short, readiness depends on accurately determining the carrier’s HIPAA role, documenting risk-based safeguards, maintaining appropriate business associate assurances and audit controls, and retaining required documentation for six years.