HIPAA Audit Readiness Guide for University Student Health Centers

Which student health center records are subject to HIPAA or FERPA?

Start by identifying who maintains each record, whose information it contains, and the purpose for which it is maintained. A university’s student health center may handle records governed by FERPA, HIPAA, or both, depending on the record and the person receiving care.

At most postsecondary institutions, student health records maintained by a campus clinic are FERPA education or treatment records. FERPA treatment records generally concern eligible students and are made or maintained by a health professional solely in connection with treatment. These records are excluded from HIPAA’s definition of protected health information even when the university is a HIPAA covered entity. See the HHS guidance on student health clinic records.

If a clinic serves nonstudents and the institution meets HIPAA’s covered entity requirements, the individually identifiable health information of those nonstudent patients may be subject to HIPAA. A health care provider generally qualifies as a covered entity when it conducts certain standard transactions electronically. Assess HIPAA covered entity status for the institution and the clinic rather than assuming every campus health service is covered.

A covered university may designate its health unit as a hybrid entity health care component, limiting HIPAA’s application within the university to designated components. The designation and its boundaries matter when deciding which records, systems, and staff belong in a HIPAA audit readiness review. HHS explains the option in its guidance on postsecondary institutions and hybrid entities.

What does a HIPAA audit cover at a university clinic?

An OCR audit may review a covered entity’s policies, procedures, and evidence of how it follows selected requirements of the HIPAA Privacy, Security, and Breach Notification Rules. The specific requirements reviewed can vary based on the entity and the audit. OCR organizes its HIPAA audit protocol by rule and regulatory provision.

For a university clinic, first confirm that the clinic or relevant component falls within HIPAA’s scope. Then prepare to show how the covered entity handles applicable Privacy Rule responsibilities, protects electronic protected health information under the Security Rule, and evaluates and responds to incidents under the Breach Notification Rule. A review may examine documented processes as well as whether practice matches policy.

Keep the FERPA boundary clear. Student treatment records governed by FERPA are not automatically within HIPAA’s audit scope merely because they are held at a clinic within a covered university. Nonstudent patient records may be subject to HIPAA where the institution is a covered entity. Document the distinction and how the clinic handles records across its systems.

How should the clinic prepare audit documentation?

Organize evidence around the audit request and the clinic’s documented scope. Assign an owner to each request, record where the evidence came from, and check that documents reflect the versions and practices in use during the relevant period. OCR’s protocol instructs selected entities to provide specified documents rather than large, undifferentiated policy compilations.

A practical evidence set may include:

• Documentation of the institution’s covered entity status, hybrid entity designation, and health care component boundaries, where applicable.
• Current privacy and security policies, notices, role designations, and procedures for handling individual requests and complaints.
• Security risk analysis and risk management records, system inventories, access authorization records, and evidence of periodic evaluations.
• Workforce training records, relevant sanctions documentation, business associate agreements, and incident response records.
• Contingency planning and testing records, and breach assessments and notification records where applicable.

Maintain HIPAA-required documentation in accordance with the applicable retention rules. For documentation required under the Privacy Rule’s administrative requirements, the rule generally calls for retention for six years from its creation or the date it was last in effect, whichever is later. Check the relevant requirement before applying that period to other university records. The OCR audit protocol also addresses documentation and retention.

Before submitting records, confirm that the response contains the requested evidence and that the transmission method is approved for sensitive information. If a requested record does not exist, document that fact accurately rather than creating retrospective evidence that could be mistaken for contemporaneous documentation.

Which administrative, physical, and technical safeguards should be reviewed?

The Security Rule requires appropriate administrative, physical, and technical safeguards to protect electronic protected health information. The safeguards should reflect the clinic’s environment and risks; they are not a one-size-fits-all checklist. HHS summarizes the Security Rule safeguards and its core requirements.

• Administrative safeguards: Review the security risk analysis and risk management process, assignment of security responsibility, workforce access procedures, security awareness and training, incident response, contingency planning, and periodic evaluation.
• Physical safeguards: Review controls for facility access, workstations, and devices or media that can store or carry electronic health information. Consider how staff protect screens, paper printouts, portable devices, and equipment during use, storage, and disposal.
• Technical safeguards: Review how systems control access, record and examine relevant activity, protect information from improper alteration or destruction, authenticate users, and protect electronic information during transmission.

For each of these Security Rule safeguards, compare policy with practice. For example, access policies should align with current accounts and role assignments, while incident procedures should align with incident records and staff understanding. HHS describes risk analysis as an accurate and thorough assessment of potential risks and vulnerabilities to electronic protected health information in its Security Rule summary.

How should workforce members be included in audit readiness?

Include the people who handle information or support clinic operations in the readiness process. HIPAA’s workforce can include employees, volunteers, trainees, and other people whose conduct is under the covered entity’s direct control, whether or not they are paid. In its audit protocol, OCR also identifies on-site contractors and students among workforce members. Whether a particular student or contractor is part of the clinic’s workforce depends on the arrangement and the work performed.

Train workforce members on the privacy and security policies relevant to their roles, including how to handle records, limit access, report suspected incidents, and follow the clinic’s procedures. Keep evidence of training and make sure staff can identify where to raise questions or report concerns. HIPAA calls for training that is necessary and appropriate to a person’s functions; it does not establish a universal annual certificate renewal requirement. See HHS guidance on workforce training and management.

Orient readiness activities to clinic-specific practices and university policy. A general training completion certificate is not proof that the organization is HIPAA compliant, and it does not replace the clinic’s own required training, procedures, or documentation.

What roles do privacy and security coordinators play?

HIPAA requires a covered entity to designate a privacy official responsible for developing and implementing its privacy policies and procedures. It must also designate a contact person or office for complaints and questions about privacy practices. The Security Rule separately requires a designated security official responsible for developing and implementing required security policies and procedures. HHS describes these duties in its summaries of the Privacy Rule and the Security Rule.

In audit readiness, these officials can coordinate the clinic’s scope, evidence collection, staff questions, and responses to identified gaps. The university may assign additional coordinators or divide tasks among departments, but it should document who is responsible for each function and make sure responsibilities are clear across the health care component and the larger institution.

Keep the official designations and supporting records current. When privacy, security, and breach response responsibilities involve different offices, agree in advance how incidents are escalated and who approves audit submissions.

What are the limits of a HIPAA audit readiness review?

A readiness review is an assessment of evidence and practices within a defined scope; it is not an official OCR audit, a certification of compliance, or a guarantee that no problem will be found later. An internal review can help identify gaps, but its conclusions depend on the records examined, the systems included, and the accuracy of information provided.

Scope is especially important at a university. A clinic may serve students and nonstudents, and a hybrid entity designation may limit which university components are subject to HIPAA. FERPA may govern student records that are excluded from HIPAA. If the clinic’s status or records are unclear, resolve those questions before drawing conclusions about audit coverage.

OCR’s protocol covers the Privacy, Security, and Breach Notification Rules, but a particular audit may assess selected requirements rather than every requirement applicable to an organization. Treat readiness as a continuing process: update the assessment when operations, systems, or risks change, and seek qualified legal or security advice when the review raises questions beyond the clinic’s expertise.

FAQs

Are student health center treatment records covered by HIPAA or FERPA?

At most postsecondary institutions, student health center records that qualify as education records or FERPA treatment records are governed by FERPA and excluded from HIPAA’s definition of protected health information. If a covered clinic serves nonstudent patients, their individually identifiable health information may be subject to HIPAA. The institution’s status and the purpose and handling of each record matter.

What documents should a university clinic provide during a HIPAA audit?

Provide the documents specifically requested for the audit, which may include relevant policies, risk analysis and risk management evidence, training records, access and incident documentation, and breach response records. Organize materials by request, check that they are current for the period under review, and avoid sending unrelated records or unsupported claims.

Who counts as workforce for HIPAA audit readiness?

Workforce may include employees, volunteers, trainees, and other people whose conduct is under the covered entity’s direct control, regardless of whether they are paid. Students and contractors may also be included depending on their role and relationship to the clinic. Identify who handles the clinic’s information and confirm their responsibilities, training, and access.

Does a HIPAA audit review every Privacy, Security, and Breach Notification Rule requirement?

Not necessarily. OCR’s audit protocol covers requirements across those rules, but the provisions reviewed may vary depending on the entity and audit. Follow the actual audit request to determine what evidence is needed.

In summary: Establish which records and clinic components fall under HIPAA or FERPA, document how safeguards work in practice, involve the relevant workforce and officials, and keep audit evidence focused on the requirements and scope under review.