HIPAA Compliance Audit Readiness Checklist for Small Practices

When the HHS Office for Civil Rights (OCR) conducts a HIPAA audit or investigates a complaint, they request specific documentation. Small practices are held to the same standards as large health systems. The difference is scope, not obligation. Here is what OCR typically expects to see:

1. Security Risk Assessment documentation under 45 CFR §164.308(a)(1)(ii)(A) — a written analysis identifying threats and vulnerabilities to all electronic PHI your practice creates, receives, maintains, or transmits
2. Written policies and procedures under 45 CFR §164.316(a) — documented standards covering PHI handling, access controls, workforce conduct, and breach response
3. Workforce training records under 45 CFR §164.308(a)(5)(i) — evidence that all workforce members with PHI access received HIPAA training at hire and when policies changed, including dates, topics, and attendance
4. Business Associate Agreement inventory under 45 CFR §164.502(e) — signed BAAs for every vendor that creates, receives, maintains, or transmits PHI on your behalf
5. Incident response plan and breach notification procedures under 45 CFR §164.404(b) — a documented process for identifying, investigating, and reporting breaches, including notification to affected individuals within 60 days of discovery
6. Documentation retention proof under 45 CFR §164.530(j) — evidence that compliance-related records (policies, training logs, risk assessments, BAAs, incident reports) have been retained for at least six years

If your clinic has no HIPAA risk assessment or written policies yet, start with a Security Risk Analysis now: identify where PHI is stored and transmitted, list your vendors and devices, document the main risks, then put the required policies and procedures in writing and assign someone responsible for security. HHS says regulated entities must periodically assess how well their policies and safeguards meet the Security Rule, and ONC/HHS offers a Security Risk Assessment Tool to help get started.

Here is a practical starting sequence for a small practice beginning from scratch:

1. Designate a Security Officer — Under §164.308(a)(2), someone in your practice must be formally responsible for HIPAA security. In a small clinic, this is often the office manager or practice owner.
2. Conduct a Security Risk Assessment — Under §164.308(a)(1)(ii)(A), identify where electronic PHI lives in your practice: your EHR, email, fax machines, portable devices, cloud storage, and vendor systems. Document the threats and vulnerabilities for each.
3. Inventory your vendors and devices — List every vendor that touches PHI (EHR, billing service, cloud backup, IT support, shredding company) and every device that stores or accesses PHI (computers, phones, tablets, external drives).
4. Get BAAs signed — Under §164.502(e), every vendor handling PHI must have a signed Business Associate Agreement. If you do not have BAAs in place, start with your EHR vendor, billing service, and cloud providers.
5. Put policies in writing — Under §164.316(a), your practice needs written policies and procedures covering access controls, PHI handling, breach notification, workforce sanctions, and device management.
6. Train your staff — Under §164.308(a)(5)(i), all workforce members must receive HIPAA training and you must document it with dates, topics, and attendance records.

This content is for educational and informational purposes only and should not be construed as legal advice.