Auditors expect written, dated proof: a current Security Risk Assessment, written HIPAA policies with review dates, training records for every workforce member, signed Business Associate Agreements (BAAs, contracts with vendors that handle patient data), access logs and access reviews, and an incident log. Verbal promises do not count. Keep it all in one organized folder.
HIPAA Audit Proof Checklist for Small Practices
Most small healthcare practices have some version of HIPAA compliance in place. Policies exist somewhere. Training happened at some point. A risk assessment was probably done.
But when an auditor asks for proof, "somewhere" and "at some point" do not count.
Auditors do not care what you say you do. They care what you can show. That means dated documents, signed records, system logs, and organized files that demonstrate your compliance program is real, active, and specific to your organization.
This is what OCR's audit program is built to evaluate. Not perfection. Evidence.
I have seen how fast this can turn around. In one Florida mental health franchise office I worked with, policies had never been written, records had holes, training was half done, and a state auditor was due in days. We got the office audit-ready in under a week, and it passed its state audit.
Chuck Weiselberg is the Founder and HIPAA Consultant at One Guy Consulting. He has been consulting since 2015. He has held roughly 23,000 meetings with more than 3,500 organizations. Zero clients fined. Zero failed audits. Read Chuck's full author bio.
Here is what small practices need to have ready.
Core Documents Auditors Expect
Every HIPAA audit starts with foundational paperwork. These are the baseline documents auditors will request before looking at anything else.
- Security Risk Assessment (SRA): a current, dated evaluation of the threats and vulnerabilities to ePHI in your specific environment. Not a generic template. Not a vendor's default output. It must reflect your systems, your workflows, and your people. Required under 45 CFR 164.308(a)(1).
- HIPAA policies and procedures: written documents covering the Privacy Rule, Security Rule, and Breach Notification Rule. They must be tailored to your practice, not copied from a downloaded PDF. Each policy should have a version date and a review history.
- Workforce training records: evidence that everyone on your workforce has completed HIPAA training. That means staff, volunteers, trainees, and anyone else who works under your control. HIPAA requires you to keep a record that the training happened (45 CFR 164.530(b)). Good records include the date of training, the topics covered, and a signed or electronically recorded acknowledgment from each person.
- Business Associate Agreements (BAAs): signed agreements with every vendor that creates, receives, maintains, or transmits PHI on your behalf. If a BAA is missing, the relationship is a compliance gap regardless of how good the vendor's security is.
These documents must be current. A risk assessment from three years ago with no updates is a red flag, not a proof point. Policies without a review date tell auditors the program is not actively maintained.
The Security Rule puts the review duty in writing:
Review documentation periodically, and update as needed, in response to environmental or operational changes affecting the security of the electronic protected health information.
Operational Evidence Auditors Look For
Policy documents show intent. Operational evidence shows execution. Auditors want both.
For a small practice, this does not require enterprise-grade tools. It requires consistency. Here is what auditors typically ask to see:
- Access logs: records showing who accessed what systems and when. Most EHR platforms generate these automatically. The key is knowing where those logs live and being able to pull them when asked.
- Periodic access reviews: documentation that someone reviewed user access rights at regular intervals. Even a simple spreadsheet showing quarterly reviews of who has access to your EHR, billing system, and file shares counts.
- Incident and breach records: a log of any security events, privacy complaints, or near-misses. If nothing has ever happened, document that too. A blank incident log with regular review dates is better than no log at all.
- Access change documentation: records showing that access was granted, modified, or revoked when employees joined, changed roles, or left. Former employees who still have active accounts are an easy gap for an auditor to spot.
A small practice with five staff members can maintain this evidence in a shared folder with simple naming conventions. The format does not matter. The habit does.
Each piece of proof traces back to a specific line in the rule:
| Proof | What the rule requires | Rule |
|---|---|---|
| Security Risk Assessment | An accurate and thorough assessment of the risks to ePHI (electronic protected health information) | 45 CFR §164.308(a)(1)(ii)(A) |
| Access logs and access reviews | Procedures to regularly review audit logs, access reports, and security incident tracking reports | 45 CFR §164.308(a)(1)(ii)(D) |
| Incident log | Document security incidents and their outcomes | 45 CFR §164.308(a)(6)(ii) |
| Written policies and procedures | Kept in written form (electronic counts) and kept for 6 years | 45 CFR §164.316(b) |
| Training records | Train every workforce member on your PHI policies and procedures, and document it | 45 CFR §164.530(b) |
| Signed BAAs | Satisfactory assurance from each vendor that it will safeguard PHI, documented in a written contract | 45 CFR §164.502(e) |
Vendor and BAA Proof
Vendor oversight is where many small practices fall short. The BAA gets signed during onboarding and then forgotten.
Auditors expect more than a signed contract in a drawer. They want to see:
- A current list of all vendors with PHI access: including cloud storage, EHR hosting, billing services, IT support, shredding companies, and answering services.
- Signed BAAs for each vendor: with dates, signatures, and terms that match current HIPAA requirements.
- Renewal or review dates: evidence that BAAs are reviewed periodically, not just signed once and filed away.
- Third-party review notes: any documentation of vendor security reviews, questionnaire responses, or due diligence checks you have conducted.
Vendor proof gets overlooked because it feels administrative. But if a vendor causes a breach and you cannot show a valid BAA or any record of oversight, your practice has its own violation to answer for. HIPAA requires a written BAA before a vendor handles PHI for you (45 CFR 164.502(e) and 164.308(b)).
This gap is common. At one single-location practice I worked with, several vendors were handling PHI with no BAA in place. We got every missing BAA signed and set up a vendor review the practice can repeat.
Common Evidence Gaps
These are the gaps that create real audit risk for small practices. They are not obscure technical failures. They are basic documentation problems.
- Missing employee sign-offs: training happened, but nobody signed an acknowledgment form. Without a record, the training did not happen as far as an auditor is concerned.
- Stale policies with no review date: policies were written years ago and never revisited. No version history, no review signature, no evidence that anyone has read them since they were created.
- No training completion logs: the practice runs training sessions but keeps no record of who attended, what was covered, or when it occurred.
- Scattered files and unclear ownership: compliance documents are spread across personal email accounts, random desktop folders, and a filing cabinet nobody opens. There is no single person responsible for knowing where everything is.
- No risk assessment follow-up: the SRA identified gaps, but there is no remediation plan, no assigned owners, and no timeline for fixes. The assessment exists, but nothing came of it.
Each of these gaps is easy to fix. The problem is that nobody fixes them until an audit forces the issue. For a step-by-step approach to closing these gaps before OCR comes knocking, see our guide to HIPAA audit readiness for small practices.
A Simple Evidence Folder Structure
You do not need compliance software to organize audit evidence. You need a folder structure that a small team can maintain without confusion.
Here is a simple layout:
- 01-Risk-Assessment
- Current SRA document
- Remediation plan with owners and dates
- Prior year SRA (for comparison)
- 02-Policies-and-Procedures
- Privacy policies
- Security policies
- Breach notification procedures
- Version history and review log
- 03-Training-Records
- Training materials and agendas
- Employee sign-off sheets (by year)
- Completion records
- 04-BAAs-and-Vendors
- Signed BAAs (one per vendor)
- Vendor inventory list with renewal dates
- Due diligence notes
- 05-Access-Management
- User access lists by system
- Quarterly access review records
- Onboarding and termination checklists
- 06-Incident-Records
- Incident log (even if empty, with review dates)
- Breach investigation reports
- Breach notification documentation
- 07-Annual-Reviews
- Annual compliance review summary
- Policy review sign-off
- Risk assessment update notes
Name files with dates. Keep the structure consistent. Assign one person to maintain it. That is the entire system.
FAQs
Do auditors expect every HIPAA policy to be custom-written?
Not necessarily, but policies must reflect your actual operations. A template is a starting point, not a finished product. If your policies describe procedures your practice does not follow, or reference systems you do not use, they will not satisfy an auditor. Review every policy and make it specific to your workflows, your staff roles, and your technology.
How far back do auditors look at training records?
HIPAA requires you to train each new workforce member within a reasonable time after they join. You also need to train the staff whose jobs are affected when you make a material (meaning significant) change to your policies. Auditors typically want to see at least the most recent training cycle for all current employees, plus evidence that new hires received training during onboarding. HIPAA also says how long to keep these records: six years. The clock starts on the date a record was created or the last date it was in effect, whichever is later (45 CFR 164.530(j)).
What if our practice has never had a security incident?
That is fine, but document it. Maintain an incident log and record regular reviews even if there is nothing to report. An empty log with quarterly review dates shows the process is active. No log at all suggests nobody is paying attention.
Can we store compliance evidence digitally instead of on paper?
Yes. HIPAA does not require paper records. Digital storage is acceptable as long as the files are accessible, organized, backed up, and protected from unauthorized access. A shared drive with proper access controls and a clear folder structure works for most small practices.
Conclusion
One Guy Consulting helps small healthcare practices organize HIPAA compliance evidence and prepare for audits with confidence; the case studies show how that plays out at real practices. Book a free 30-minute intro call to see where your documentation stands.
One Guy Consulting in 37 seconds
Sources
- HHS HIPAA Audit Program
- 45 CFR Part 164
- 45 CFR 164.308: Administrative Safeguards
- HHS OCR Enforcement Actions
Key point: OCR published a report on its 2016-2017 audits. It found that most audited covered entities did not do their risk analysis properly. Covered entities are the health plans, clearinghouses, and providers HIPAA applies to. The risk analysis is required under 45 CFR 164.308(a)(1)(ii)(A). That makes it the most important item on any audit prep checklist.
Compliance Program Resources
- OCR Audit Program Guide for Healthcare
- Healthcare Regulatory Compliance Guide
- Building a Healthcare Compliance Culture
Related Reading
Try three One Guy Consulting 3D staff training courses free →