Ryan White HIV Services Providers: A HIPAA Audit Readiness Guide

Which Ryan White providers must comply with HIPAA?

Receiving Ryan White HIV/AIDS Program funding does not, by itself, make an organization a HIPAA covered entity. A health care provider generally qualifies when it furnishes health care and electronically conducts a transaction for which HHS has adopted a standard, such as submitting health claims. Health plans and health care clearinghouses are also covered entities. Review the HHS HIPAA Basics for Providers guide to assess your organization’s status.

A provider that is not a covered entity may still have HIPAA obligations if it handles protected health information (PHI) for a covered entity as a business associate. A written business associate agreement may be required for that relationship. Ryan White award terms, subrecipient agreements, state law, and other confidentiality rules may also impose obligations regardless of whether HIPAA applies directly.

Start by documenting the organization’s role, the health services it provides, how it handles electronic standard transactions, and whether it performs services involving PHI for another covered entity. If your status or a particular data-sharing arrangement is unclear, have qualified compliance or legal staff review it.

What privacy and security safeguards should providers document?

Maintain written privacy and security policies that match your actual services, systems, workforce, and information flows. HIPAA’s Privacy Rule applies to PHI in multiple forms, while the Security Rule addresses electronic PHI. The HIPAA Security Rule administrative safeguards include a security management process, risk analysis, risk management, workforce security, and regular review of information-system activity.

For audit readiness, keep current, dated evidence showing that policies are implemented—not just approved. Depending on your role and operations, your evidence file may include:

• Risk analyses, risk-management plans, and records of follow-up on identified risks.
• Privacy and security policies, incident-response procedures, contingency plans, and documentation of periodic reviews or updates.
• Workforce security-awareness training records, sanctions procedures, and signed confidentiality agreements. A confidentiality agreement is useful evidence of your process, but it is not a substitute for the broader safeguards that apply.
• Business associate agreements and relevant subcontractor agreements, where required.
• Security incident records, system activity reviews, and documentation of corrective actions.

HIPAA requires covered entities and business associates to retain required Security Rule documentation for six years from its creation or the date it was last in effect, whichever is later. That documentation-retention rule does not, by itself, set a six-year retention period for every client record. See 45 CFR § 164.316 and apply any separate record-retention requirements relevant to your program.

How should providers control access to client records and systems?

Set access according to each person’s job duties, and document how access is approved, changed, reviewed, and removed. The HHS guidance on the minimum necessary standard explains that covered entities generally must take reasonable steps to limit PHI access and disclosure to what is needed for the purpose. The standard does not apply to every situation; for example, it does not apply to disclosures to or requests by a health care provider for treatment.

Use individual accounts rather than shared credentials so you can attribute system activity to a user. Document role-based permissions, access approvals, periodic reviews, and prompt removal or adjustment of access when staff roles change or an employment relationship ends. Keep records of these actions so you can demonstrate that access is managed in practice.

For systems containing electronic PHI, the HIPAA Security Rule addresses technical safeguards, including access controls, unique user identification, audit controls, authentication, and transmission security. Review access logs and investigate unusual or unauthorized activity under your written procedures.

When is a HIPAA-compliant authorization required to disclose client information?

HIPAA generally requires a valid authorization when a covered entity wants to use or disclose PHI and no Privacy Rule permission or requirement covers the activity. Some common situations—such as many disclosures for marketing, certain disclosures of psychotherapy notes, and sales of PHI—have specific authorization requirements. Other disclosures may be permitted without authorization, including many uses and disclosures for treatment, payment, and health care operations. Check the applicable rule rather than assuming every disclosure requires a form.

A valid HIPAA authorization must identify the information to be disclosed, who may disclose it, who may receive it, the purpose, an expiration date or event, and the individual’s signature and date. It must also include required statements about revocation, whether treatment or payment may be conditioned on signing, and potential redisclosure. It must be written in plain language; when the covered entity asks the individual to sign it, the individual must receive a copy. See 45 CFR § 164.508.

For a site-visit or monitoring request, do not assume that the request itself establishes whether an authorization is needed. Have the privacy lead confirm the applicable disclosure basis, the requester’s authority, and what information is appropriate to provide. Where the minimum necessary standard applies, disclose only what is reasonably needed for the purpose; where it does not apply, other privacy, program, or contractual requirements may still matter.

What records and reports should providers prepare for site visits?

Prepare an organized, current set of records that matches the scope of the visit and the terms of your award or subaward. HRSA’s 2025 Ryan White HIV/AIDS Program Part A National Monitoring Standards describe monitoring that can include policies, reports, client charts, financial documentation, and corrective action plans. The Part B National Monitoring Standards likewise address monitoring records and subrecipient documentation.

• Privacy and security: relevant policies, risk-analysis documentation, workforce training records, confidentiality agreements, access reviews, incident documentation, and business associate agreements, as applicable.
• Program and service delivery: current service protocols, eligibility and service documentation, performance reports, and requested client charts or records.
• Fiscal and award management: subaward or contract terms, expenditure support, procurement records where relevant, audit reports, and evidence that funds were used for allowable purposes.
• Monitoring and follow-up: prior monitoring reports, responses to findings, corrective action plans, and evidence of completed corrective actions.

Use the recipient’s monitoring protocol to confirm the requested scope, timing, and method for chart review. HRSA’s Part B manual says a chart review may use an established random sampling methodology rather than reviewing every record. Before sharing client information, confirm the disclosure basis and use secure, controlled procedures for access, copying, storage, and return or destruction of records.

How should providers respond to audit findings and corrective action plans?

Respond promptly and factually. Preserve relevant records, identify the requirement involved, assess whether the issue affects other clients or systems, and notify the appropriate program, privacy, or security lead. If the finding involves a possible privacy or security incident, follow your incident-response process and have qualified staff assess any applicable reporting or notification duties.

Develop a corrective action plan (CAP) that states the underlying cause, the specific corrective steps, the person responsible for each step, target dates, and the evidence that will demonstrate completion. Address both the immediate issue and any process weakness that could cause it to recur.

Coordinate with the Ryan White recipient or other monitoring authority about the CAP format, submission process, and deadlines. HRSA’s 2025 Part B manual describes CAPs for findings and requires the recipient to monitor their satisfactory completion. Retain the CAP, progress updates, and verification records with your monitoring documentation.

In short, audit readiness depends on knowing which requirements apply, keeping evidence of safeguards and access decisions, validating the basis for disclosures, and resolving findings with documented corrective actions.

FAQs.

Do all Ryan White HIV services providers qualify as HIPAA-covered entities?

No. Ryan White funding alone does not determine HIPAA-covered-entity status. A provider generally qualifies if it conducts covered electronic health care transactions, and an organization may have separate obligations as a business associate. Grant terms, state law, and other confidentiality requirements may apply even when HIPAA does not apply directly.

What should a HIPAA-compliant authorization include?

It should describe the PHI involved, identify who may disclose it and who may receive it, state the purpose, include an expiration date or event, and be signed and dated by the individual or an authorized personal representative. It must also contain required statements about revocation, conditioning treatment or payment, and possible redisclosure, and be written in plain language. See 45 CFR § 164.508.

How often may Ryan White providers undergo site visits?

Frequency depends on the provider’s role, program part, award terms, and monitoring arrangements. For Ryan White Parts A and B, HRSA monitoring standards generally expect annual site visits of subrecipients, subject to an approved exemption. HRSA’s Part B manual also describes risk-based visits to Part B recipients and says comprehensive visits are scheduled at least once every three to five years. Confirm the requirements that apply to your specific award or agreement.

What should providers do after an audit identifies a compliance gap?

Preserve relevant evidence, assess the scope and cause of the gap, promptly notify responsible organizational and program contacts, and follow applicable incident procedures if PHI or system security may be involved. Then prepare a CAP with specific actions, owners, due dates, and proof of completion, coordinate it with the monitoring authority, and document progress through verified closure.