HIPAA Compliance Audit Checklist for Healthcare & Medical Organisations

The annual risk analysis is the most fundamental HIPAA requirement — and the most cited OCR finding when it is absent or inadequate. Everything else in the compliance programme should flow from the documented risk analysis.

• Confirm Privacy Officer is appointed — a named individual responsible for Privacy Rule compliance across the organisation
• Confirm Security Officer is appointed — a named individual responsible for Security Rule compliance
• Conduct the annual Risk Analysis — a thorough assessment of potential risks to the confidentiality, integrity, and availability of all ePHI created, received, maintained, or transmitted
• Develop and implement a Risk Management Plan addressing the risks identified in the risk analysis with specific security measures
• Review and update all HIPAA policies and procedures at least annually — document the review date and any changes made
• Ensure all workforce members receive HIPAA training annually — covering Privacy Rule, Security Rule, and breach notification; document completion
• Implement sanction policies — documented procedures for workforce members who fail to comply with HIPAA policies
• Establish a workforce access management process — authorisation and/or supervision of workforce members who work with PHI; regular access reviews

• Confirm Notice of Privacy Practices (NPP) is current — describes permitted uses and disclosures; patient rights; complaints process; effective date
• Confirm NPP is provided to patients at first service delivery — acknowledgement of receipt obtained and documented
• Confirm minimum necessary standard is applied — policies in place to limit PHI use to the minimum necessary for the intended purpose
• Confirm patient rights procedures are in place — right of access (provide records within 30 days), right to amend, right to accounting of disclosures, right to restrict certain disclosures
• Confirm Business Associate Agreements (BAAs) are in place with all vendors, contractors, and third parties who create, receive, maintain, or transmit PHI on behalf of the covered entity
• Confirm authorisation procedures for uses and disclosures requiring patient authorisation — current authorisation forms meet HIPAA requirements
• Audit PHI disclosure logs — accounting of disclosures is maintained; logs are accurate and up to date

• Confirm the Risk Analysis is documented — scope, methodology, identified risks, and assigned risk levels; updated at least annually or when significant changes occur
• Confirm the Risk Management Plan is implemented — specific measures addressing identified risks are in place and effective
• Confirm a Contingency Plan exists — data backup plan, disaster recovery plan, emergency mode operations plan, testing procedures; tested at least annually
• Confirm information access management policies — procedures for authorising access to ePHI; role-based access control implemented
• Confirm workforce security procedures — authorisation, supervision, and termination of access for all workforce members
• Confirm security awareness and training — periodic security updates and reminders; phishing awareness training

• Confirm facility access controls — documented policies controlling physical access to facilities containing ePHI; access logs maintained
• Confirm workstation security policies — screens not visible to unauthorised individuals; automatic screen lock implemented; clean desk policy for PHI
• Confirm device and media controls — policies for disposal, reuse, and accountability of hardware and electronic media containing ePHI
• Confirm portable device policy — laptops, mobile phones, tablets, and USB drives used to access or store ePHI are encrypted and tracked
• Confirm workstation access policies — only authorised users access clinical workstations; shared workstations have appropriate controls

• Confirm access controls are implemented — unique user identification for all users; role-based access to ePHI; automatic logoff for inactive sessions
• Confirm encryption of ePHI at rest and in transit — particularly for portable devices, email containing PHI, and patient portal communications
• Confirm audit controls are in place — hardware, software, and procedural mechanisms to record and examine activity in systems containing ePHI; audit logs reviewed regularly
• Confirm integrity controls — ePHI is not altered or destroyed in an unauthorised manner; mechanisms to authenticate ePHI
• Confirm transmission security — ePHI transmitted over electronic networks is protected against unauthorised access; encryption or equivalent alternative measures

• Confirm breach identification procedures — workforce knows what constitutes a HIPAA breach; any impermissible use or disclosure of PHI is presumed a breach unless assessed by the four-factor risk assessment
• Confirm breach risk assessment procedure — the four-factor test (probability of PHI compromise, sensitivity, who accessed, extent of risk mitigation) is documented and followed
• Confirm individual breach notification procedure — written notice to affected individuals within 60 days of breach discovery
• Confirm HHS notification procedure — breaches of 500+ individuals reported to HHS within 60 days; breaches of fewer than 500 reported within 60 days of the end of the calendar year in which they were discovered
• Confirm incident response plan is documented and tested — including roles, escalation paths, evidence preservation, and containment procedures

• Inventory all business associates — a complete list of all vendors, contractors, and third parties with access to PHI on behalf of the organisation
• Confirm a current BAA exists for each business associate — signed, current (reflecting current HIPAA requirements), and meeting all required contract provisions
• Include cloud service providers and IT vendors — any vendor who hosts, processes, or has access to ePHI is a business associate requiring a BAA
• Review BAAs when business associate relationships change — new services, new vendors, or significant changes to existing arrangements
• Confirm business associates have appropriate safeguards — BAAs require business associates to implement HIPAA-equivalent safeguards; periodic verification is a best practice