HIPAA Audit Readiness Guide for Patient Assistance Program Administrators

A strong HIPAA audit readiness process starts with a clear answer to two questions: which organization is regulated, and how does protected health information (PHI) move through the program? Once you document those answers, you can assemble evidence that your safeguards match your role and actual operations.

This guide covers HIPAA covered entity status, business associate agreements, the Security Rule risk analysis, PHI access controls, audit controls, breach assessment, and related records. HIPAA applicability depends on the organization’s functions and relationships—not simply on a program’s name or its handling of health information.

How do you determine whether HIPAA applies to your patient assistance program?

Start by identifying the legal entity that operates the program. HIPAA applies to covered entities—health plans, health care clearinghouses, and health care providers that conduct certain standard electronic transactions—and to business associates performing covered functions or services involving PHI on behalf of a covered entity. Review the definitions in 45 CFR § 160.103 and HHS’s Covered Entities and Business Associates guidance.

Do not assume that handling patient information, receiving public funding, or participating in an assistance program automatically makes an organization a covered entity. Assess the organization’s legal structure and activities, including whether it operates a health plan, provides health care, or performs standard electronic transactions. Government programs may require fact-specific analysis; HHS notes that some government-funded programs are not health plans depending on their principal purpose or activity.

Participation in an AIDS Drug Assistance Program (ADAP) does not, by itself, settle the HIPAA question. Determine whether the state or other program operator meets a covered-entity definition, and separately assess whether it performs services involving PHI on behalf of a covered entity. Document the analysis, its assumptions, the responsible decision-maker, and any changes that could trigger a fresh review.

Keep HIPAA applicability separate from other privacy obligations. State law, grant terms, program contracts, or other federal requirements may impose confidentiality duties even when an organization is not a HIPAA covered entity or business associate.

How should you document the program’s HIPAA role and PHI data flows?

Create a concise role memorandum that identifies the program operator, its relevant legal entities, and its role for each data relationship: covered entity, business associate, business associate subcontractor, or another type of recipient. Explain why each classification applies and identify the agreements or legal authorities that support the information exchange.

Then map how PHI enters, moves through, and leaves the program. Include applicants, providers, pharmacies, health plans, manufacturers, administrators, call centers, claims processors, data-hosting services, and other vendors. For each transfer, record what information is involved, who sends and receives it, the purpose, the system or channel used, and the applicable agreement or authorization.

Include paper forms, email, portals, phone workflows, file transfers, backups, and vendor platforms—not only the main case-management system. HHS’s Security Rule risk analysis guidance says organizations should identify where electronic PHI (ePHI) is created, received, maintained, or transmitted and document relevant data gathered for the analysis.

Use the map to confirm that written procedures reflect actual practice. Review it when the program adds a vendor, changes its eligibility or payment process, adopts a new system, or changes how staff access information.

Which records should administrators prepare for a HIPAA audit?

Prepare an indexed evidence file that lets you move from a requirement to the policy, record, or system evidence showing how the program addresses it. The precise records depend on the organization’s HIPAA role and the scope of the review; not every program will hold every record listed below.

• Applicability and governance: the HIPAA role memorandum, organizational chart, privacy and security responsibilities, and current policies and procedures.
• Data and systems: PHI data-flow diagrams, inventories of systems and devices that handle ePHI, authorized-user lists, and records showing how access is approved, changed, and removed.
• Security management: the current Security Rule risk analysis, risk management plan, risk-treatment decisions, and documentation of periodic evaluations or updates.
• Workforce practices: role-based training records, confidentiality commitments where used, sanctions or corrective-action records when applicable, and procedures for reporting incidents.
• Vendor relationships: a vendor inventory, executed business associate agreements (BAAs) where required, subcontractor terms, and evidence of vendor oversight.
• Incident handling: security-incident logs, investigations, breach assessments, mitigation records, and evidence of any required notifications.
• Technical and operational evidence: access reviews, system activity records, backup and contingency procedures, and remediation records tied to identified risks.

HHS’s HIPAA Audit Protocol illustrates the kinds of policies, procedures, and evidence that may be reviewed. Use it as a preparation reference, not as a substitute for identifying the requirements that apply to your organization and the scope of a particular review.

What privacy and security safeguards should be ready for review?

For PHI generally, be ready to explain how the program limits uses and disclosures, manages privacy requests and complaints where applicable, trains its workforce, and responds to suspected privacy violations. For ePHI, the Security Rule requires administrative, physical, and technical safeguards to protect its confidentiality, integrity, and availability.

Review PHI access controls against staff roles and job duties. Keep evidence of unique user accounts, timely access changes when roles change or staff leave, authentication procedures, and periodic access reviews. The Security Rule’s technical safeguards also require audit controls that record and examine activity in systems containing or using ePHI; retain relevant logs and show how the program reviews and responds to them. See 45 CFR § 164.312.

Maintain a Security Rule risk analysis that covers ePHI across systems, locations, and vendors. Link identified risks to a risk management plan with owners, actions, priorities, and completion evidence. HHS distinguishes risk analysis—the assessment of risks and vulnerabilities—from risk management, which implements measures to reduce those risks in its guidance on the two processes.

Do not treat every safeguard as a one-size-fits-all technical checklist. The Security Rule calls for reasonable and appropriate measures based on factors such as the organization’s size, technical environment, costs, and risks. For an addressable implementation specification, document the assessment and either implement it when reasonable and appropriate or document why it is not and implement an equivalent alternative when reasonable and appropriate. See 45 CFR § 164.306.

When does a patient assistance program vendor need a business associate agreement?

A BAA is generally required when a covered entity engages an outside person or organization to perform a function or service on its behalf that involves PHI. Examples may include administering applications, processing claims, hosting a program platform, or providing data analysis for the covered entity. HHS describes these relationships and the required contract terms in its Business Associates FAQs.

Classify the relationship by what the vendor does and whose behalf it acts on—not simply by whether the vendor can see patient data. A vendor that receives PHI for its own independent purpose is not automatically the covered entity’s business associate. Conversely, a service provider may qualify even when it does not routinely view the information, depending on its role and access.

If a business associate uses a subcontractor to create, receive, maintain, or transmit PHI on its behalf, the subcontractor may also be a business associate and must have the required written safeguards. Review contracts for permitted uses and disclosures, safeguards, incident reporting, cooperation with individual rights and audits, and return or destruction of PHI when the arrangement ends where feasible. HHS provides details in its Business Associate Contracts guidance.

Record the outcome of the review for every vendor: whether a BAA is required, why, who approved the determination, and when the agreement was last reviewed. If HIPAA does not require a BAA, other privacy, security, or confidentiality terms may still be appropriate or required under another agreement or law.

How long must HIPAA audit documentation be retained?

For required Security Rule documentation, retain written policies and procedures and required records of actions, activities, and assessments for six years from the date they were created or the date they were last in effect, whichever is later. The rule also requires periodic review and updates when environmental or operational changes affect ePHI. See 45 CFR § 164.316.

The Privacy Rule has a similar six-year period for documentation it requires, such as certain policies, notices, complaints, and other required actions or designations. This is not a general HIPAA requirement to keep every medical record or all PHI for six years. HHS explains that HIPAA does not set a general medical-record retention period; state law and other applicable requirements may govern those records. See HHS’s Summary of the HIPAA Privacy Rule and its guidance on medical-record retention.

Set a retention schedule that distinguishes required HIPAA compliance documentation from patient files, business records, and contract records. Apply any longer period required by state law, program terms, litigation holds, or other applicable obligations, and ensure records remain protected until securely disposed of.

How should administrators validate and remediate audit findings?

Validate each finding against the requirement, the program’s documented role, and the evidence of what staff and systems actually do. Check whether the issue is isolated or reflects a broader process weakness, such as excessive access, incomplete vendor documentation, missing logs, or an outdated risk analysis.

Record each finding with its risk, affected systems or workflows, accountable owner, corrective action, target date, and validation method. Prioritize issues according to the sensitivity and volume of PHI, the likelihood of exposure, and potential impact. Update the risk management plan and track the issue to verified closure rather than treating a revised policy as proof that a technical or operational fix worked.

For an impermissible use or disclosure, preserve the facts and complete a breach assessment promptly. Under HHS’s Breach Notification Rule guidance, an impermissible use or disclosure is generally presumed to be a breach unless an exception applies or the organization demonstrates a low probability that PHI was compromised. The assessment considers the PHI involved, the recipient, whether the information was acquired or viewed, and mitigation. Document the analysis and any notification decision.

Close the loop by retesting the correction, updating relevant procedures and training, and reviewing whether similar processes or vendors need the same fix. Audit readiness is an ongoing process: clear role documentation, accurate data-flow maps, retained evidence, and verified remediation make it easier to demonstrate how the program protects PHI.

FAQs.

Does participating in an ADAP automatically make an organization subject to HIPAA?

No. ADAP participation alone does not determine HIPAA status. Assess whether the relevant organization meets the definition of a covered entity or performs services as a business associate, based on its activities and relationships. Other laws, state requirements, or program terms may impose privacy duties even if HIPAA does not apply. See 45 CFR § 160.103.

What documentation should a patient assistance program administrator have ready for a HIPAA audit?

Prepare records relevant to the organization’s HIPAA role and the review’s scope: the role analysis, PHI data-flow and system inventories, applicable policies, Security Rule risk analysis and risk management plan, access and audit-control evidence, workforce training records, vendor agreements, incident logs, breach assessments, and remediation records. Keep the materials organized and current, and protect PHI while producing evidence.

When is a business associate agreement required for a program vendor?

A BAA is generally required when a covered entity engages a vendor to perform a function or service on its behalf that involves PHI. A business associate must also obtain the required written agreement from a subcontractor that handles PHI on its behalf. Assess the vendor’s actual role and applicable exceptions rather than relying only on a contract label.

How long must HIPAA Security Rule documentation be retained?

Retain documentation required by the Security Rule for six years from its creation or the date it was last in effect, whichever is later. This applies to required compliance documentation, not automatically to every patient record. Other laws or agreements may require longer retention.