HIPAA Audit Readiness Guide for Telepsychiatry Staffing Companies

Preparing for a HIPAA audit means being able to show how your telepsychiatry staffing company handles protected health information (PHI), manages access, responds to incidents, and follows its agreements with healthcare providers. The steps you need depend on your company’s actual role and the systems and information it handles—not simply on the fact that it supplies clinicians.

Use this guide to organize evidence, test safeguards, and identify gaps before an audit or client review. HIPAA requirements vary with your role and arrangements, so confirm how they apply to your organization with qualified compliance or legal counsel.

When does a telepsychiatry staffing company qualify as a business associate?

A staffing company may be a business associate when it performs a function or service for a HIPAA covered entity and, in doing so, creates, receives, maintains, or transmits PHI on the entity’s behalf. Examples might include handling patient information for scheduling, referral coordination, billing, practice management, or other contracted services. The HIPAA definition also excludes a person acting as a member of a covered entity’s workforce, so the contractual label alone does not settle the question. Review what your company and its personnel actually do, whose behalf they act on, and who controls their work. See the eCFR definition of business associate and covered entity.

Supplying clinicians does not automatically make the staffing company a business associate in every arrangement. For example, a clinician may be treated as part of a provider’s workforce for HIPAA purposes if the provider directly controls the person’s conduct in performing work for it. Conversely, a staffing company that handles PHI as an outside service provider may have business associate obligations. Map each client relationship and workflow rather than assuming one classification covers every engagement.

If your company is a business associate, document that status and the related responsibilities in a business associate agreement (BAA) with the covered entity before handling PHI for that work. Also assess whether vendors or subcontractors that handle PHI on your company’s behalf need downstream BAAs. A BAA does not replace operational safeguards: the company still needs controls, policies, and evidence appropriate to its role.

How should business associate agreements address PHI handling?

Review each BAA against the services actually provided. It should define permitted and required uses and disclosures of PHI, prohibit unauthorized uses or disclosures, require appropriate safeguards, and establish how the parties handle requests, incidents, and termination of the relationship. HHS outlines required contract provisions in its business associate agreement guidance.

Make the agreement operational by specifying which party is responsible for each step. Address how the staffing company will:

• Limit PHI access to authorized purposes and personnel.
• Report impermissible uses or disclosures, security incidents, and breaches to the covered entity.
• Cooperate with applicable individual requests and the covered entity’s compliance duties.
• Require applicable subcontractors to accept the required PHI protections before receiving PHI.
• Return or destroy PHI at termination when feasible, and address any PHI that must be retained.
• Provide access to relevant records for compliance oversight as the agreement and law require.

Specify incident contacts, reporting channels, and practical timelines in the agreement and related procedures. HIPAA requires a business associate to notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery; an agreement may set a shorter deadline. The parties should not confuse breach notification with security-incident reporting: the BAA and incident procedures should explain how suspected or known incidents are escalated, including those that are not ultimately determined to be breaches. HHS discusses these distinctions in its guidance on security-incident reporting.

How to conduct a security risk analysis for telehealth systems

A security risk analysis under the HIPAA Security Rule must assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic PHI (ePHI) your organization holds. It should lead to a risk-management plan with documented priorities, owners, and actions—not just a checklist or a generic vendor report. The Security Rule administrative safeguards require a risk analysis and risk management; HHS’s telehealth privacy and security guidance recommends revisiting the analysis as risks emerge.

Start by identifying where ePHI enters, moves, and resides across the services you provide. Include relevant telehealth platforms, electronic health record systems, scheduling and referral tools, secure messaging, email, identity and access systems, cloud storage, backups, endpoints, and vendor connections. Include systems used by remote clinicians and staff, as well as any system that can access, transmit, or store ePHI.

For each system and workflow, record the information involved, authorized users, likely threats, existing safeguards, and remaining risks. Consider misdirected messages, stolen credentials, shared accounts, lost devices, inappropriate session recording, vendor incidents, and service outages. Assess whether current safeguards—such as encryption, multifactor authentication (MFA), endpoint protection, backups, and access restrictions—are working as intended. The exact measures should follow your risk assessment and applicable requirements.

Maintain a written record of the analysis and its follow-up. Track each identified risk, decision, mitigation or alternative control, responsible owner, due date, and completion evidence. Update the analysis when a significant technology, vendor, workflow, or organizational change affects ePHI security, and periodically review whether it still reflects your operations.

Which workforce access controls should be tested before an audit?

Test whether access matches each person’s job and client assignment. Role-based access control can help limit permissions to the functions a worker needs, but the control is only effective when roles are defined, approved, and updated. Review a sample of accounts across scheduling, clinical, administrative, and support functions, and compare system permissions with documented authorization.

Verify that each user has an individual account rather than a shared login, and check that authentication controls—including MFA where appropriate—are configured and functioning. HIPAA requires unique user identification and person-or-entity authentication; MFA is a useful safeguard to evaluate based on your risk analysis, not a stand-alone substitute for the full set of required protections. See the Security Rule technical safeguards.

Test the complete joiner, mover, and leaver process. Confirm that access is approved when granted, changed when job duties or client assignments change, and promptly removed when employment or another work arrangement ends. Sample recent departures and transfers, then compare HR or contract records with application access logs and deactivation records. HIPAA requires procedures for workforce access and termination; it does not set one universal calendar interval for permission reviews. Set and document a review cadence based on risk, client commitments, and your policies, and review access promptly after role changes or suspected misuse.

Also test emergency access procedures, password practices, login monitoring, and any process for managing privileged or vendor accounts. Keep evidence of approvals, access changes, periodic reviews, exceptions, and completed workforce access deprovisioning.

What audit evidence and logs should staffing companies maintain?

Organize evidence so you can show both what your policies require and how your company carries them out. A practical audit file may include:

• Current BAAs, subcontractor agreements, and a list of systems and vendors that handle PHI.
• Risk analyses, risk-management plans, remediation records, and documented updates.
• Workforce access approvals, role assignments, access reviews, and deprovisioning records.
• System configurations and evidence of safeguards relevant to your risk assessment, such as authentication, encryption, and backup controls.
• Audit control logs, access reports, login monitoring, and records showing that system activity is regularly reviewed.
• Security-incident reports, investigation notes, containment and mitigation steps, and breach notification documentation.
• Current policies, workforce training records, policy acknowledgments, and records of corrective actions where applicable.

Logs should be attributable to unique users, protected against inappropriate alteration, retained according to applicable requirements and policy, and reviewed through a defined process. Record what was reviewed, when, by whom, what exceptions were found, and how they were resolved. The Security Rule requires both regular review of information-system activity and audit-control mechanisms that record and examine activity in systems containing or using ePHI. Refer to the administrative safeguards and technical safeguards.

For documentation required by the Security Rule, retain the records for six years from creation or from the date they were last in effect, whichever is later. Review and update documentation as needed when environmental or operational changes affect ePHI security. See 45 CFR § 164.316. Other records may have separate requirements under HIPAA, other laws, contracts, or your retention policies.

How to prepare telehealth policies, workforce training, and incident response records?

Keep written policies aligned with the services you actually perform. Relevant topics may include permitted PHI use, identity and access management, secure communications, remote work, device safeguards, telehealth session recording, vendor oversight, incident escalation, business continuity, and records retention. Assign responsible owners and document approvals, effective dates, revisions, and how changes are communicated.

Training should address both HIPAA requirements relevant to each person’s role and the covered entity or staffing company’s own procedures. Keep records that identify the learner, training date, content or version, completion status, and any follow-up. The Privacy Rule requires covered entities to provide workforce training appropriate to members’ functions; the Security Rule requires a security awareness and training program for the workforce. Do not treat an annual certificate as a universal federal requirement. Training timing should reflect applicable rules, policy, role changes, and the employer’s procedures. See 45 CFR § 164.530 and the Security Rule administrative safeguards.

Maintain an incident-response process that lets workers report suspected loss, misdirected communications, unusual account activity, or other security concerns without delay. For each incident, preserve relevant evidence and document dates, systems and information involved, investigation steps, decisions, containment, mitigation, communications with clients, and the final outcome. If a matter may involve unsecured PHI, document the breach assessment and the basis for the notification decision; when notification is required, retain evidence of what was reported and when. HHS explains business associate breach-notification duties in its Breach Notification Rule guidance.

How do privacy safeguards apply across telepsychiatry workflows?

Map privacy safeguards to every point where patient information may be used or disclosed: referrals and scheduling, clinician assignment, intake, video or audio visits, follow-up messages, records access, billing support, and vendor troubleshooting. For each step, identify the responsible party, the systems involved, the purpose of access, and how the PHI is protected. Confirm that the workflow matches the BAA and that the staffing company does not use or disclose PHI outside its permitted role.

Before a visit, check that the appropriate clinician can access the correct patient information and that the platform and communication channel are approved for the workflow. During a visit, use private settings and secure connections, verify identities as appropriate, and avoid recording unless the workflow allows it and required permissions and safeguards are in place. After a visit, use authorized channels for follow-up and keep any necessary records within approved systems. HHS provides practical telehealth considerations in its telehealth privacy and security guidance.

For mental-health services, pay particular attention to sensitive communications, accidental disclosure on shared screens or in public spaces, and inappropriate access to appointment or clinical details. Establish clear procedures for verifying recipients, handling misdirected messages, and escalating privacy concerns. Because telepsychiatry workflows can involve multiple organizations, align the staffing company’s procedures with each client’s rules and make responsibilities clear to clinicians and support staff.

Audit readiness comes down to a documented, working connection between your role, your BAAs, your risk analysis, your access controls, your workforce practices, and your incident records. Keep evidence current, test controls in the systems you actually use, and close identified gaps with assigned owners and documented follow-up.

FAQs

Does a telepsychiatry staffing company need a business associate agreement?

It depends on the company’s role and the PHI it handles. If it performs a service for a covered entity that involves creating, receiving, maintaining, or transmitting PHI on the entity’s behalf, it may be a business associate and generally needs a BAA before handling that PHI. A staffing arrangement in which an individual is part of a covered entity’s workforce may be treated differently. Assess the actual relationship and workflow using the HIPAA business associate definition.

What evidence should be available for a HIPAA audit?

Be prepared to produce relevant BAAs, risk analyses and remediation plans, policies, training records, access approvals and deprovisioning evidence, audit control logs and review records, and incident investigation and notification documentation. Keep required documentation organized and available to the people responsible for implementing the procedures. The precise evidence depends on your HIPAA role and the audit’s scope.

How often should workforce access permissions be reviewed?

HIPAA requires appropriate access-management procedures but does not prescribe one universal calendar interval for reviewing permissions. Set a documented, risk-based cadence, follow any applicable client or contract requirements, and review access promptly when a worker changes roles, changes client assignments, leaves, or no longer needs access. Retain evidence of the review and any changes made.

Which telehealth systems should be included in a security risk analysis?

Include the systems that create, receive, maintain, or transmit ePHI, plus connected systems and devices that can affect its security. Depending on your workflows, that may include video platforms, EHRs, scheduling and referral tools, secure messaging, email, cloud storage, backups, identity systems, endpoints, and vendor integrations. Document the boundaries and connections you assessed so the analysis reflects how information actually moves.