HIPAA Audit Readiness Guide for State Medicaid Agency Contractors

State Medicaid agency contractors should prepare to show what protected health information (PHI) they handle, why their role brings them within HIPAA, and how they protect the information throughout its lifecycle. The records you need depend on your services, systems, agreements, and the Medicaid agency’s audit requirements.

How does a contractor’s role determine its HIPAA obligations?

A state Medicaid program is a HIPAA covered entity, but a contractor’s obligations depend on the work it performs—not simply on having a state contract. A contractor will generally be a business associate if it performs a function or service on the covered entity’s behalf that involves creating, receiving, maintaining, or transmitting PHI. A company that handles claims, hosts systems containing Medicaid data, or provides certain services using disclosed PHI may meet this definition. HHS guidance on state agencies and covered entities confirms that a state Medicaid program is a covered entity; HHS business associate guidance explains the business associate definition.

Map each service to the data it handles, the systems involved, and the parties that receive or access the data. A contract alone does not necessarily make every vendor a business associate, and a contractor may have different roles across different services. Check the HIPAA agreement, the agency’s instructions, applicable state requirements, and contract-specific audit terms to determine which obligations apply.

Which business associate and subcontractor agreements should be maintained?

Keep the executed business associate agreement (BAA) with the Medicaid agency, along with amendments, renewals, statements of work, and relevant security or privacy exhibits. A BAA should describe permitted and required PHI uses and disclosures; restrict other uses and disclosures; require appropriate safeguards; address reporting of impermissible uses, disclosures, or breaches; and cover other required terms, including access to records and return or destruction of PHI when applicable. See HHS guidance on required BAA provisions.

Maintain a current subcontractor agreement inventory and copies of the required written agreements with subcontractors that create, receive, maintain, or transmit ePHI on your behalf. The business associate is responsible for obtaining satisfactory written assurances from those subcontractors; HIPAA does not generally require the covered entity to contract directly with the business associate’s subcontractor. Confirm that downstream terms reflect the relevant PHI protections and the agency contract’s stricter requirements, if any. HHS’s Security Rule summary describes these subcontractor agreement requirements.

What should a documented security risk analysis include?

Maintain a documented security risk analysis that covers all ePHI your organization creates, receives, maintains, or transmits for the agency. Start with an electronic protected health information inventory: identify systems, applications, devices, storage locations, vendors, interfaces, and data flows, including where information enters, moves, and leaves your environment.

Assess reasonably anticipated threats and vulnerabilities, existing safeguards, and the likelihood and potential impact of risks to ePHI’s confidentiality, integrity, and availability. Record risk ratings, gaps, proposed or completed actions, responsible owners, and any decision to accept a risk. Update the analysis when changes to systems, services, operations, or known risks make an update necessary. HHS risk analysis guidance explains that the analysis must be documented but does not prescribe a particular format or set an annual schedule. HIPAA does not require an annual security risk analysis; the process should be ongoing and responsive to the environment.

How can contractors show that privacy and security safeguards are implemented?

Prepare evidence that links written procedures to actual practices. Examples include approved privacy and security policies, system configurations, access approvals and reviews, training records, incident tickets, audit-log review records, backup and recovery test results, and remediation tracking. Organize artifacts by system, service, control, and time period so you can demonstrate implementation rather than provide policies alone. The HHS OCR Audit Protocol describes how auditors may review policies, procedures, and implementation evidence.

Show how access is limited to authorized people and appropriate functions. Role-based access controls are one possible approach; HIPAA does not mandate a particular access-control model. Retain unique user identification and access records where applicable, and document processes for granting, changing, and removing access. Other evidence may include physical-access safeguards, incident response procedures, contingency plans, and technical safeguards appropriate to the systems and risks. See HHS’s Security Rule overview and its guidance on controlling access to ePHI.

What workforce training records should be available for audit?

HIPAA’s Security Rule requires a security awareness and training program for all workforce members, including management. Keep the workforce training materials, policies, completion rosters, dates, and records of periodic reminders or updates. If roles require different access or procedures, retain evidence that training addresses those responsibilities and relevant agency-specific policies.

A training completion certificate can document an individual’s participation; it does not establish that an organization is HIPAA-compliant. HIPAA does not set a universal annual certificate renewal requirement. Follow the training schedule and documentation terms in your agency contract and internal policies, and provide additional training when job duties, systems, or procedures change. The OCR audit protocol identifies workforce security training and implementation records among areas auditors may review. For required Security Rule documentation, retain records for six years from creation or the date they were last in effect, whichever is later, as described in the HHS Security Rule summary.

How should incidents and breach decisions be documented?

Keep a record of suspected and known security incidents, including how they were reported, when they were discovered, investigation steps, containment, mitigation, and the outcome. For a potential breach, document the PHI involved, affected systems and individuals where known, the decision process, and communications with the agency. An impermissible use or disclosure of PHI is generally presumed to be a breach unless an applicable exception or a documented risk assessment supports a determination that there is a low probability the PHI was compromised. HHS’s Breach Notification Rule guidance explains the assessment and documentation obligations.

A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is the federal outside deadline—not a recommended target: your BAA or agency procedures may require notice sooner. Record discovery and notification dates, the information provided, and any reason for delay. HHS breach notification guidance describes the business associate deadline and the covered entity’s related notification duties.

How can audit evidence be organized and mapped to HIPAA requirements?

Create an audit evidence mapping that ties each applicable HIPAA requirement and contract obligation to the responsible owner, relevant system or service, supporting records, review period, and evidence location. Track whether each item is current, complete, and approved; note identified gaps, corrective actions, deadlines, and closure evidence. Keep the mapping and evidence set controlled, with an assigned contact who can retrieve records quickly.

Share only the information needed for the audit, and protect PHI contained in the evidence itself. Retain required documentation for the applicable period and make sure records are accessible to staff responsible for implementing the relevant procedures. A clear evidence map, current agreements, an up-to-date risk analysis, and records showing safeguards in practice give auditors a coherent view of how your contractor role is managed.

FAQs

When is a state Medicaid agency contractor a business associate?

A contractor is generally a business associate when it performs a function or service on behalf of the covered Medicaid agency that involves creating, receiving, maintaining, or transmitting PHI, or when the agency discloses PHI to the contractor for such a service. The specific work and data flows determine the role.

What should a business associate agreement cover?

A BAA should define permitted and required uses and disclosures of PHI, require safeguards, prohibit unauthorized uses and disclosures, and address reporting, subcontractors, access to records, and return or destruction of PHI where applicable. It should also include other terms required by HIPAA and any relevant agency contract provisions.

Does HIPAA require an annual security risk analysis?

No. HIPAA requires a documented and ongoing risk analysis but does not prescribe an annual frequency. Review and update the analysis as needed in response to changes in systems, services, operations, or risks.

What is the deadline for a business associate to notify a covered entity of a breach?

The business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. The BAA may require earlier notice, so follow the shorter applicable deadline.