HIPAA Audit Readiness FAQ

Auditors typically begin by requesting four categories of documentation:

1. Current Security Risk Assessment (SRA) - the most recent completed risk assessment with documented findings and remediation plans
2. Staff training records - proof that all workforce members completed HIPAA training, including dates and attestations
3. Written policies and procedures - your adopted HIPAA policies covering the Privacy Rule, Security Rule, and Breach Notification Rule
4. Evidence of ongoing compliance efforts - remediation tracking, updated risk registers, and documentation of corrective actions taken

Having these four categories organized and readily accessible before an audit notice arrives is the single most effective preparation step.

Many practices are surprised that auditors mainly want specific documents and proof. If you can hand over what they ask for quickly, the process tends to go much smoother than expected.

Yes. Failure can result in:

• Corrective Action Plans (CAPs) - a formal agreement requiring the organization to remediate specific deficiencies within a set timeframe, with ongoing monitoring for up to three years
• Civil monetary penalties - ranging from $141 to $2,134,831 per violation category per year, depending on the level of negligence
• Extended monitoring - OCR may require periodic compliance reports and progress updates for up to three years following a finding

Beyond financial penalties, audit findings can damage organizational reputation and erode trust with patients and business partners.

A Corrective Action Plan (CAP) is a formal agreement between an organization and the HHS Office for Civil Rights (OCR) that requires the organization to take specific steps to address identified HIPAA violations. A CAP typically includes:

• A detailed description of the compliance deficiencies found
• Specific remediation steps the organization must complete
• Deadlines for completing each remediation step
• Periodic reporting requirements to OCR on progress
• A monitoring period, usually lasting one to three years

CAPs are legally binding. Failure to meet CAP requirements can result in additional penalties.

The two most common missing items are written policies and procedures and signed Business Associate Agreements (BAAs).

HIPAA requires retention for six years from creation or the date last in effect, whichever is later. This requirement is established in 45 CFR Section 164.530(j) for Privacy Rule documentation and 45 CFR Section 164.316(b)(2)(i) for Security Rule documentation.

Records subject to retention include policies and procedures, risk assessments, training records, BAAs, incident reports, remediation plans, and any other documentation related to HIPAA compliance activities.

No. Auditors want to see that you have a working system to protect patient data (PHI). They are not looking for a perfect score.

Good-faith compliance is demonstrated through documented evidence of ongoing efforts. The five essential elements are:

1. Completed Security Risk Assessment - a current SRA with documented findings, risk levels, and mitigation plans
2. Documented training - records showing all workforce members completed HIPAA training, with dates and sign-off attestations
3. Written policies - adopted policies and procedures covering the Privacy Rule, Security Rule, and Breach Notification Rule
4. Documented remediation with timelines - evidence that identified gaps were addressed, including what was fixed, when, and by whom
5. Signed Business Associate Agreements - executed BAAs with all vendors that create, receive, maintain, or transmit PHI

Auditors and investigators assess whether an organization made reasonable, ongoing efforts - not whether compliance was perfect at every moment.

As a rule, keep everything tied to compliance. This means risk assessments, training records, signed policy forms, BAAs, fix-it records, incident reports, and any other proof of your compliance work.

Start pulling your records and compliance proof right away. If you need help, bring in a qualified compliance consultant as soon as you can.

Most practices check their audit readiness once a year as part of their overall compliance program.