HIPAA Audit Readiness Guide for PACE Programs Serving Older Adults

A HIPAA audit readiness guide for PACE programs should connect written policies to the way staff and systems actually protect participant information. Because PACE organizations coordinate medical and social services across care settings, prepare evidence that covers participant records, workforce practices, technology, and outside service providers.

Keep HIPAA requirements distinct from PACE program oversight: CMS and state agencies may review records under PACE regulations, while an OCR HIPAA audit examines selected requirements of the Privacy, Security, and Breach Notification Rules. CMS describes PACE as a program providing comprehensive medical and social services to eligible older adults living in the community. CMS’s PACE overview and the HHS OCR audit protocol explain these program and audit contexts.

What does a HIPAA audit review in a PACE organization?

An OCR HIPAA audit may review selected requirements and assess whether the organization’s policies and procedures are implemented in practice. The HHS audit protocol is organized around the Privacy, Security, and Breach Notification Rules; the scope varies depending on the type of entity and the provisions selected for review.

For a PACE organization, that can mean showing how participant health information is protected across the PACE center, home and community-based care, and systems used by employed or contracted staff. Auditors may compare policies with records and operational evidence—for example, whether access is authorized, whether security activity is reviewed, and whether incidents are handled under documented procedures. The HHS OCR audit protocol provides examples of evidence auditors may request.

CMS and the state administering agency have a separate PACE oversight role. PACE regulations require organizations to make specified records—including participant health outcomes data, financial records, medical records, and personnel records—available for review. 42 CFR § 460.200 describes these record-access requirements.

Which participant records and policies should be audit-ready?

Organize materials so you can retrieve them by audit topic, system, date, and responsible owner. A practical evidence set may include:

• Current Privacy, Security, and breach-response policies, with approval dates and prior versions.
• Participant medical-record policies and evidence that records are complete, accurate, timely, and available to authorized personnel.
• Workforce role descriptions, access authorization records, and procedures for granting, changing, reviewing, and ending access.
• Risk analysis and remediation records, security evaluation results, and information-system activity reviews.
• Security-awareness training records, Privacy Rule training records, and records of sanctions when applicable.
• Incident investigation documentation, breach assessments, notification records where required, and corrective actions.
• Business associate agreements and records showing how relevant vendor relationships are identified and managed.

Use a secure, controlled repository with an index and named record owners. Provide auditors only the information requested, using a process that protects participant privacy and tracks what was disclosed. PACE regulations also require safeguards for participant-identifying information and timely, accurate recordkeeping. 42 CFR § 460.200 sets out those PACE record and confidentiality duties.

How should PACE programs document risk analysis and remediation?

A HIPAA Security Rule risk analysis should identify where electronic protected health information (ePHI) is created, received, maintained, or transmitted; assess relevant threats and vulnerabilities; and document the likelihood and potential impact of risks. Include systems used by the PACE organization and relevant service providers, not just the primary electronic health record. The Security Rule requires an accurate and thorough assessment of risks to ePHI’s confidentiality, integrity, and availability. 45 CFR § 164.308 and HHS OCR’s risk analysis guidance describe the requirement and considerations.

Keep the analysis connected to the risk-management work that follows. For each finding, record the affected system or process, risk rating, planned safeguard, accountable owner, target date, status, and evidence used to verify completion. If a risk is accepted or an action is deferred, document the rationale, approval, and any interim safeguards.

Impact-analysis templates can help teams apply consistent fields and compare findings, but HIPAA does not prescribe a particular template or format. Use a template as an internal work aid, then retain the completed analysis, management decisions, remediation evidence, and updates. HHS explains that risk-analysis documentation feeds the risk-management process and that the Security Rule does not require a specific documentation format. HHS OCR’s risk analysis guidance provides further detail.

What workforce training and sanctions records should be retained?

Keep evidence that workforce members receive training appropriate to their roles. The Security Rule requires a security-awareness and training program for all workforce members, including management. The Privacy Rule requires training on relevant Privacy Rule policies and procedures for workforce members, including new staff within a reasonable period and staff affected by material policy changes. 45 CFR § 164.308 and 45 CFR § 164.530 set out these obligations.

Maintain security-awareness training records and Privacy Rule training records that show the learner, course or topics, completion date, and applicable policy version. Keep records of periodic security reminders and role-specific education where provided. HIPAA does not establish a universal annual certificate-renewal requirement; follow applicable federal requirements, state law, and your organization’s training policies. A training completion certificate documents an individual’s course completion—it does not, by itself, establish that the organization is HIPAA compliant.

Retain the organization’s sanction policy and relevant records of sanctions applied. The Security Rule requires a sanction policy for workforce members who fail to comply with security policies and procedures. The Privacy Rule also requires covered entities to apply appropriate sanctions for violations and document sanctions imposed. 45 CFR § 164.308 and 45 CFR § 164.530 describe these requirements.

How can access controls and safeguards be evidenced?

Demonstrate how access is matched to each person’s job responsibilities and how changes are handled when someone joins, changes roles, or leaves. Useful evidence includes approved access requests, role or group assignments, access review results, and termination or modification records. These access authorization records should be traceable to the relevant policy and system.

For systems containing ePHI, retain examples or reports that show unique user identification, emergency-access procedures, and mechanisms for recording and examining system activity. The Security Rule requires technical access controls and audit controls; it also addresses authentication, integrity, and transmission security. Some implementation specifications are “addressable,” meaning the organization must assess and document how to address them based on its circumstances—not simply ignore them. 45 CFR § 164.312 describes the technical safeguards.

Show that system activity is regularly reviewed by retaining review schedules, completed review records, follow-up tickets, and escalation notes. The Security Rule also requires regular review of records of information-system activity, such as audit logs, access reports, and security incident tracking reports. 45 CFR § 164.308 describes the information-system activity review requirement.

What incident and business associate documentation may auditors request?

For security incidents, maintain policies for identifying, responding to, mitigating, and documenting incidents, along with incident investigation documentation showing what happened, when it was detected, who responded, what information or systems were involved, and how the matter was resolved. Where a potential breach of unsecured protected health information is involved, retain the assessment and the basis for the notification decision, plus copies of notices and evidence of their timing when notification is required. The Security Rule requires documentation of security incidents and their outcomes; the Security Rule and Breach Notification Rule provide the applicable requirements.

Maintain an inventory of vendors that create, receive, maintain, or transmit ePHI on the organization’s behalf, and determine which are business associates. Keep executed business associate agreements (BAAs), relevant contract provisions, and records of reported security incidents or breach notifications. Auditors may also ask how the organization follows up on concerns about a business associate and whether required agreements cover relevant subcontractor arrangements. HHS guidance on business associates and 45 CFR § 164.308 describe business associate safeguards and contract requirements.

Do not treat a vendor’s security certification or marketing statement as a substitute for reviewing the agreement and the organization’s own responsibilities. Keep the contract, relevant evidence of oversight, and the process for receiving and evaluating vendor incident reports together so the record shows how the relationship is managed.

How long must HIPAA audit documentation be retained?

HIPAA Security Rule documentation must generally be kept for six years from its creation or from the date it was last in effect, whichever is later. This includes written security policies and procedures and records of actions, activities, or assessments that the Security Rule requires to be documented. The Privacy Rule has a similar six-year period for its required documentation. 45 CFR § 164.316 and 45 CFR § 164.530 state these time limits.

PACE organizations have a separate, longer record-retention requirement: retain records for the longest of the period required by state law, ten years from the last entry date, or— for a disenrolled participant’s medical records—ten years after disenrollment. If litigation, a claim, a financial management review, or an audit begins before the retention period ends, retain the records until the matter or findings are resolved. 42 CFR § 460.200 provides the current PACE requirements.

Apply the retention period that governs each record category, and pause routine destruction when a legal hold, investigation, claim, or audit requires preservation. In short, audit readiness means keeping a current, traceable record of policies, risk decisions, access, training, incidents, vendor relationships, and the actions taken to protect participant information.

FAQs

What documents should a PACE organization prepare for a HIPAA audit?

Prepare current Privacy, Security, and breach-response policies; participant-record procedures; risk analysis and remediation records; access authorization records; evidence of system activity reviews; training and sanction records; incident investigation documentation; and applicable business associate agreements. Organize the evidence so it can be retrieved by topic and date, and securely provide only the records requested.

How long must HIPAA Security Rule documentation be retained?

Retain required Security Rule documentation for six years from its creation or from the date it was last in effect, whichever is later. PACE records may have a longer retention period: the PACE rule generally requires the longest of state law, ten years from the last entry date, or ten years after disenrollment for medical records of disenrolled participants. Keep records longer when a covered audit, claim, litigation, or financial management review remains unresolved. See 45 CFR § 164.316 and 42 CFR § 460.200.

What evidence should support a PACE program’s risk remediation plan?

For each finding, retain the risk analysis, affected system or process, risk rating, selected safeguard, responsible owner, target date, progress notes, management approvals, and evidence that the corrective action was completed and evaluated. Document the reason for any accepted or deferred risk and any interim safeguards. A template can standardize the record, but HIPAA does not prescribe a particular template.

Which vendor records should be available for a HIPAA audit?

Keep a current vendor inventory, documentation identifying business associates, executed business associate agreements, relevant security and incident-reporting terms, and records of reported incidents and follow-up. Include applicable subcontractor arrangements when relevant, and retain evidence of how the organization addresses vendor concerns or reported problems.