HIPAA Audit Readiness Guide for Multi-State Home Care Franchises

Multi-state home care franchises need to understand which organizations in their network are subject to HIPAA, where protected health information (PHI) moves, and who is responsible for protecting it. A practical audit-readiness program brings together each covered entity’s policies, risk assessment, workforce records, vendor agreements, incident documentation, and evidence of corrective action.

When does HIPAA apply to a home care franchise and its agencies?

HIPAA does not apply automatically to every home care business or franchise location. A home care agency is generally a covered entity if it is a health care provider that furnishes, bills, or is paid for health care and electronically conducts a transaction for which HHS has adopted a standard, such as submitting electronic claims. Using email alone does not make a provider a covered entity. See the HHS explanation of covered entities.

Assess each agency and the franchisor based on its own activities and relationships. A franchisor that accesses or handles PHI on behalf of a covered agency may be a business associate, depending on the services it performs. Common examples to review include centralized billing, scheduling, record hosting, IT support, and administrative services. A franchise relationship by itself does not determine HIPAA status; document the analysis for each relevant organization and function.

Start with a data-flow map that identifies which locations create, receive, maintain, or transmit PHI; the systems and people involved; and the entity responsible for each activity. Include paper records and information used by caregivers in clients’ homes, as well as electronic records, mobile devices, messaging, and remote access. This map helps you distinguish covered entities, business associates, and organizations that may fall outside HIPAA while remaining subject to other laws or contractual duties.

Which HIPAA rules and records may an audit review?

HIPAA audit readiness should address the Privacy Rule, Security Rule, and Breach Notification Rule. The HHS audit protocol evaluates selected requirements and may vary according to the type of entity and the audit’s scope; an audit should not be assumed to cover every record or requirement. Review the HHS HIPAA audit protocol to understand the kinds of evidence auditors may request.

Organize a current, searchable evidence set that can include:

• HIPAA Privacy Rule procedures, notices of privacy practices, and applicable acknowledgments.
• Security policies, the HIPAA Security Rule risk analysis, risk-management plans, and documented evaluations or updates.
• Workforce security awareness training records, role-based training materials, confidentiality commitments, access approvals, and sanctions documentation where applicable.
• Access-control records, user account reviews, device and media safeguards, contingency plans, and relevant system or security logs.
• Complaints, individual rights requests, disclosure records where required, incident investigations, and Breach Notification Rule documentation.
• Business associate agreements (BAAs), vendor inventories, and records showing how identified issues were addressed.

HIPAA documentation generally must be retained for six years from its creation or the date it was last in effect, whichever is later, where the applicable rule requires documentation. That is not a universal federal retention period for all medical records. Check other applicable federal and state requirements before setting retention schedules. The HHS audit protocol describes documentation and retention evidence auditors may examine.

How to conduct and document a security risk assessment

The Security Rule requires covered entities and business associates to conduct an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic PHI they create, receive, maintain, or transmit. HHS does not prescribe a single assessment method; the approach should reflect the organization’s size, complexity, systems, and operations. See HHS guidance on risk analysis.

For a franchise network, define the scope across all relevant systems and locations rather than treating the office as the only place where ePHI is handled. Identify systems, devices, applications, data flows, users, vendors, and work practices that could affect ePHI. Consider the risks associated with caregiver access in the field, lost or shared devices, inappropriate access, inaccurate records, unavailable systems, and paper-to-electronic workflows.

Keep a written record of the method, scope, participants, identified threats and vulnerabilities, risk ratings, existing safeguards, and decisions about additional controls. Link each significant risk to a management action, a responsible owner, a target date, and evidence of completion. A risk analysis identifies and evaluates risk; risk management is the process of implementing measures to reduce it.

Revisit the analysis when changes in systems, locations, vendors, or operations could affect ePHI security, and document periodic evaluations and updates. HIPAA does not establish one universal annual date for every organization’s assessment. The HHS risk analysis guidance explains the required scope and notes that methods may vary.

How to maintain HIPAA policies across multiple states

Use a consistent federal baseline for HIPAA Privacy Rule procedures, security safeguards, incident response, and workforce responsibilities, then identify state-specific requirements that apply to each location and activity. State health information privacy laws may provide greater privacy protections or rights than HIPAA, and certain state provisions can continue to apply. See HHS guidance on more stringent state laws.

Maintain a state-law matrix that records the jurisdictions where the franchise and agencies operate, the requirements identified for review, the policy or process affected, and the person responsible for monitoring changes. Depending on the agency’s services and circumstances, have qualified counsel assess issues such as consent, sensitive health information, breach reporting, records access, retention, and applicable home care requirements. Do not assume the same state rule applies identically to every record or service.

Control policy versions centrally, but specify which entity adopts, approves, distributes, and enforces each policy. Use state addenda or workflow instructions when necessary, and retain effective dates, approvals, distribution records, and superseded versions. This helps a location demonstrate which policy applied at the time of an event without implying that every franchise must use an identical operational procedure.

How to train franchise and agency workforces and retain evidence

Train workforce members on the Privacy Rule procedures and security practices relevant to their duties. For home care teams, make the training practical: explain how to verify identity and authority before sharing information, use approved communication tools, secure records and devices during visits, report suspected incidents promptly, and access only the information needed for assigned work.

HIPAA requires training for workforce members as necessary and appropriate to their functions, including training new members within a reasonable period and training affected members within a reasonable period after a material policy change. Covered entities must document that required training was provided. HIPAA does not set a universal annual training interval or require every worker to renew a certificate each year. Employers may set additional schedules under their own policies, contracts, or other applicable requirements. See the HHS audit protocol’s training criteria.

Keep workforce security awareness training records that show the learner, course or topic, completion date, and any assessment or acknowledgment used. Also retain role-specific instructions, policy-change notices, attendance records, and documented follow-up for incomplete training. A course completion certificate is evidence of training; it does not by itself establish that an agency or franchise is HIPAA compliant.

How to oversee business associates and business associate agreements

Inventory organizations that create, receive, maintain, or transmit PHI for a covered entity, or perform certain functions or services involving PHI on its behalf. Depending on the arrangement, these may include technology providers, billing services, record-storage vendors, or a franchisor providing centralized support. Determine whether a business associate relationship exists based on the actual services and access, rather than the vendor’s label.

When a business associate agreement is required, use a written contract that describes permitted and required uses and disclosures of PHI, requires appropriate safeguards, addresses reporting of impermissible uses or disclosures and breaches, and sets out applicable subcontractor and termination provisions. HHS summarizes the required provisions in its business associate contract guidance.

Keep signed agreements, amendments, service descriptions, renewal or termination records, and a clear record of which covered entity the agreement supports. Risk-based vendor reviews, evidence of safeguards, and escalation procedures are useful oversight practices, but HIPAA does not generally require covered entities to monitor every method a business associate uses to carry out safeguards. If a covered entity learns of a material contractual violation, it must take reasonable steps to cure the breach or end the violation and, if unsuccessful, terminate the arrangement where feasible. See HHS guidance on business associate oversight responsibilities.

How to monitor locations and track corrective actions

Use a repeatable monitoring process to check that each location follows the applicable policies in practice. Depending on the network’s risks, sample access approvals, workforce training evidence, device handling, paper record storage, incident reporting, vendor agreements, and completion of required assessments. Document the locations or processes reviewed, the sample and review date, findings, and evidence examined.

Record each gap in a corrective-action log with a risk level, accountable owner, due date, interim safeguards if needed, and verification method. Close an item only after someone confirms that the corrective action was implemented and is working. Escalate overdue or recurring issues to the responsible agency and franchise leadership, while preserving the evidence that supports the decision and resolution.

Set review intervals based on risk and operational changes rather than presenting an annual audit as a universal HIPAA requirement. Reassess when a location opens, systems or vendors change, incidents reveal a control weakness, or a policy or state-law review requires an update. For breach matters, retain documentation of notifications or the analysis supporting a decision that notification was not required; the HHS Breach Notification Rule guidance explains this documentation responsibility.

Strong audit readiness comes from clear responsibility at each entity and location, current policies that account for state requirements, documented risk analysis, trained workforces, appropriate business associate agreements, and corrective actions verified to completion.

FAQs

Are all home care franchise agencies covered entities under HIPAA?

No. An agency is generally a covered entity if it is a health care provider that conducts a HIPAA-standard electronic transaction, such as electronic billing. Assess each agency’s activities individually; a franchise relationship alone does not determine HIPAA status. An organization that is not a covered entity may still be a business associate if it performs relevant services involving PHI for a covered entity.

What records should a home care franchise have ready for a HIPAA audit?

Prepare applicable privacy and security policies, risk analyses and risk-management records, training documentation, access and incident records, breach assessments and notifications, business associate agreements, and evidence of corrective actions. The specific records requested depend on the entity and audit scope, so organize current documents by requirement and location.

How often should multi-location home care agencies review HIPAA compliance?

HIPAA does not prescribe one universal annual audit or risk-assessment schedule. Agencies should evaluate their safeguards periodically, update documentation as needed, and review compliance when significant operational, technology, vendor, or legal changes occur. Set a documented schedule appropriate to the organization’s risks and applicable requirements.

Do state privacy laws add requirements beyond HIPAA?

They can. HIPAA generally establishes a federal baseline, and certain more protective state privacy laws may continue to apply. Identify the states where each agency operates and have qualified counsel assess which state requirements apply to its services, records, and disclosures.