HIPAA Gap Analysis & Remediation Guide for Practices

By Chuck Weiselberg, Founder, One Guy Consulting. Published June 13, 2026.

About the author: Chuck Weiselberg, Founder, One Guy Consulting; Certified HIPAA Professional (CHP) with 10 years of HIPAA compliance experience. Contact for practice-level remediation help. Full author bio

After a HIPAA gap analysis (assessment of current controls vs. requirements), turn every finding into a remediation plan (the list of fixes, owners and deadlines that closes each gap). Rank each gap by risk. Give it a specific fix, one named owner, a deadline, and proof it was done. Fix critical gaps first. Examples are no current risk assessment or missing business associate agreements (signed contracts with vendors who handle patient data). Review the plan monthly.

What is a HIPAA gap analysis?

A HIPAA gap analysis tells you where your compliance program falls short. It finds missing policies, weak safeguards, outdated risk assessments (the documented review of risks to patient data that 45 CFR 164.308(a)(1)(ii)(A) requires; a gap OCR cites again and again in its enforcement actions), and areas where your practice does not meet HIPAA Privacy Rule, Security Rule, and Breach Notification Rule standards.

A gap analysis is not the same as the risk analysis HIPAA requires. HHS OCR's April 2018 cybersecurity newsletter, "Risk Analyses vs. Gap Analyses", explains that a gap analysis on its own may not satisfy the Security Rule's risk analysis requirement. Most practices need both: the risk analysis to find where PHI (protected health information) is at risk, and the gap analysis to compare the program against each standard.

But the gap analysis itself does not fix anything. It is a diagnostic tool. The value comes from what happens next: HIPAA gap analysis remediation.

Too many practices finish a gap analysis, review the findings, and then let the report sit in a folder. Months pass. Nothing changes. When an audit or a breach investigation surfaces those same gaps, the practice has no proof of progress and no way to defend itself.

HIPAA gap analysis remediation is the process of taking every finding from that report and turning it into a specific, assigned, time-bound action item. Remediation (fixing each gap the analysis found, and proving it) is how practices move from knowing about their weak spots to actually closing them. This article walks through what the gap analysis report contains, how to rank findings, and how to build a remediation plan that holds up under scrutiny.

How to perform your gap analysis (step-by-step)

1. Gather what exists. Policies, the last risk assessment, training records, business associate agreements (BAAs), the incident log and any prior audit findings.
2. Map where PHI and ePHI (electronic PHI) live. The EHR, email, billing, backups, laptops, phones and every vendor that stores or sees patient data.
3. Compare against each standard. Walk the administrative, physical and technical safeguards (164.308, 164.310, 164.312), the documentation rules (164.316), and the Privacy Rule administrative requirements (164.530). NIST SP 800-66 Rev. 2 lists the questions to ask for each one.
4. Record every gap. For each: the standard it falls under, the current state, and the evidence you checked.
5. Rate the risk of each gap (critical, high, medium or lower) using the tiers below.
6. Hand the list to the remediation plan with an owner and a deadline for every item.

What the Gap Analysis Report Contains

A thorough HIPAA gap analysis report records every area where your practice does not fully meet HIPAA rules. The report covers three major areas: administrative safeguards, physical safeguards, and technical safeguards, as defined under 45 CFR §164.308 (administrative safeguards) and related sections of the Security Rule.

Each finding in the report should include a description of the gap, the specific HIPAA standard it relates to, the current state of your compliance for that item, and a suggested fix. Some reports also include a risk rating for each finding. This becomes useful when you set priorities.

Common types of findings include:

• Missing or outdated policies and procedures: policies that were never written, or that were created years ago and never updated to reflect current operations, workforce changes, or technology.
• Incomplete or absent HIPAA security risk assessment: the risk assessment is the foundation of the Security Rule. If it is missing, outdated, or generic, every downstream safeguard built on top of it is weakened.
• Training deficiencies: workforce members who have not received HIPAA training, or training that was conducted without documentation of attendance, content covered, or acknowledgment signatures.
• Access control weaknesses: shared login credentials, former employees with active accounts, no role-based access restrictions, or no periodic access reviews.
• Business associate agreement gaps: vendors with access to protected health information (PHI) who do not have signed, current BAAs in place.
• Incident response shortfalls: no documented breach notification process, no incident log, or no evidence that potential security events are being tracked and investigated.

The report is not a pass/fail score. It is a detailed list of every compliance weak spot, set up so you can act on each one in order.

Prioritizing remediation tasks

Not every gap carries the same weight. A missing breach notice policy is a more urgent problem than a training record that lacks a specific date format. HIPAA gap analysis remediation starts with sorting findings by the risk they pose to your practice and to patient data.

A practical ranking method uses four tiers:

• Critical (immediate action required): gaps that create direct exposure to a HIPAA violation, a data breach, or an enforcement action. Examples include no current risk assessment, no BAAs with key vendors, or no encryption on devices that store ePHI. These items need to be addressed within 30 days or less.
• High (address within 60 days): gaps that represent significant compliance weaknesses but do not pose an immediate threat of breach or regulatory action. Examples include outdated policies that need revision, incomplete training records, or access reviews that have not been conducted in over a year.
• Medium (address within 90 days): gaps that are real but manageable. Examples include documentation formatting issues, minor procedural inconsistencies, or enhancements to an existing program that would improve its defensibility without addressing an active vulnerability.
• Lower (address within 120 days): gaps that still matter but are usually less urgent than the gaps above. One example is gaps in how physical safeguards are written down. Physical safeguards are the physical steps that protect your computer systems and the buildings and equipment that hold them.

This tiered approach stops the common problem of treating all findings as equally urgent, which leads to paralysis. It also helps practices put limited staff time and budget where the risk is greatest.

Building a Remediation Plan

A remediation plan is a structured document. It maps every gap analysis finding to a specific fix, an owner, a deadline, and a status tracker. It is the working backbone of HIPAA gap analysis remediation.

A good remediation plan includes these details for each finding:

• Finding reference: the gap ID or description from the analysis report, so every action traces back to the original assessment.
• HIPAA standard: the specific regulation section the finding relates to (e.g., §164.308(a)(1)(ii)(A) for the risk analysis requirement).
• Corrective action: a clear, specific description of what needs to be done. Not "improve access controls" but "implement role-based access in the EHR system and remove shared login accounts by August 15."
• Assigned owner: the person responsible for completing or overseeing the corrective action. Compliance cannot own everything. IT, HR, operations, and practice management all have roles.
• Target completion date: a realistic deadline aligned with the risk priority tier.
• Evidence of completion: what documentation will prove the corrective action was taken. A revised policy document, a screenshot of updated access settings, a signed training acknowledgment, a countersigned BAA.
• Status: open, in progress, completed, or deferred (with documented justification for any deferral).

Store the remediation plan in a central, easy-to-reach spot, not buried in someone's email. Review it at regular intervals. Monthly works well for most practices. Update it as items are done or timelines shift.

If your practice has already finished a HIPAA audit proof checklist, the remediation plan builds on that base by closing the gaps the checklist reveals.

Assigning Ownership and Deadlines

The most common reason remediation plans fail is that nobody owns the work. Findings get written down, priorities get set, and then the plan sits untouched. This happens because every action item is assigned to "the compliance team" or "IT" without a named person.

Real ownership means one person is on the hook for each fix. That person does not have to do the work alone. But they must make sure it gets done and report on progress. In a small practice, this might be the office manager for policy updates, the IT contractor for technical safeguards, and the practice owner for vendor oversight.

Deadlines must be specific and doable. "As soon as possible" is not a deadline. Neither is "Q3." A remediation plan with vague timelines can signal to auditors and to OCR that the practice is not serious about closing its gaps.

Each deadline should account for the actual time of the person in charge. If the IT contractor is free two days per week, a technical fix task cannot have the same timeline as a policy update that the compliance officer can handle during normal business hours.

Monthly check-ins keep the plan on track. During each review, update the status of every open item. Write down any delays with a reason. Adjust deadlines if things have changed. This review history itself becomes proof of an active, working compliance program.

Common Gaps That Require Immediate Action

Certain findings from a HIPAA gap analysis should move to the front of the fix queue no matter the practice size. These are gaps that HHS enforcement actions have cited again and again as triggers for investigations, corrective action plans, and fines.

• No current risk assessment: not having a risk assessment is one of the gaps OCR cites most often in its enforcement cases. If your organization does not have a current, documented risk assessment, this is the first item to address. Everything else in the Security Rule depends on it.
• Missing BAAs with active vendors: every vendor that touches PHI needs a signed BAA. Cloud storage providers, billing services, IT support companies, EHR vendors, shredding services, and answering services are all common examples. A vendor relationship without a BAA is an open compliance gap with no defense.
• No workforce training documentation: HIPAA requires that all workforce members receive training on policies and procedures. If there is no record of who was trained, when, and on what topics, the training effectively did not happen from a compliance standpoint.
• No breach notification procedures: organizations must have a documented process for identifying, investigating, and reporting breaches. Without this process in place, a breach event becomes compounded by the failure to respond appropriately.
• Unencrypted devices with ePHI access: laptops, workstations, mobile devices, and portable media that access or store electronic protected health information without encryption represent both a technical vulnerability and a regulatory exposure. Lost or stolen unencrypted devices have been behind many reported breaches and OCR penalties.

These items are not optional. They are baseline HIPAA requirements. They are the gaps most likely to bring enforcement action if left open.

Remediation Priority Matrix

Not all gaps carry equal risk. Use this framework as a starting point to rank your fixes.

Practical remediation checklist for offices

• A current, documented risk analysis, reviewed after any major change (164.308(a)(1)(ii)(A)).
• A signed BAA on file for every vendor that touches PHI (164.504(e)).
• Training records for every workforce member: who, when, and what was covered (164.530(b)).
• Encryption on laptops, phones and backup drives that hold ePHI, or a written reason it is not reasonable and appropriate (164.312(a)(2)(iv) and 164.306(d)(3)).
• Unique logins, no shared accounts, and former staff removed (164.312(a)(2)(i)).
• A breach procedure that meets the federal clock: notice to affected patients no later than 60 days after discovery, and to HHS at the same time when 500 or more people are affected (164.404(b) and 164.408).
• A remediation plan with an owner, deadline and status on every finding, reviewed monthly.

Documenting remediation

Keep the gap analysis, the remediation plan, and the proof of each fix for six years from creation or last effective date (164.316(b)(2)(i)). A deferred item needs the same paper trail: why it waits, what interim safeguard covers it, and when the permanent fix lands.

"A focused gap analysis reveals specific remediation tasks and a clear timeline for your practice."

(Chuck Weiselberg, Founder, One Guy Consulting)

Case note (anonymized): before its review, a practice had several vendors touching PHI with no BAA in place. After it, every missing BAA was signed and the practice had a vendor review it can run again. Read case 05. In another case, a mental health franchise office in Florida with no program in place got audit-ready in under a week and passed its state audit (case 01).

FAQ

What is a HIPAA gap analysis?

This article explains how a gap analysis identifies gaps between your current practices and HIPAA expectations.

What does remediation include?

Remediation here covers prioritized actions, an implementation timeline, and documentation steps for your office.

Who should run the gap analysis?

This guide is written for Practice Managers and Office Managers as the primary audience.

Next steps and One Guy Consulting services

One Guy Consulting helps you turn your gap analysis findings into a HIPAA gap analysis remediation plan, ranked so you know what to fix first. The Full-Scope plan ($1,300 a year, or $120 a month, flat rate per location) includes the automated gap analysis and remediation plans, plus four hours a month of one-on-one implementation calls with Chuck. Book a free 30-minute intro call to walk through your findings and build a clear path to compliance.

Sources

• HHS OCR Cybersecurity Newsletter, April 2018: Risk Analyses vs. Gap Analyses
• HHS OCR: Guidance on Risk Analysis
• NIST SP 800-66 Rev. 2: Implementing the HIPAA Security Rule
• eCFR 164.312: Technical Safeguards
• eCFR 164.316: Policies, Procedures and Documentation
• eCFR 164.404: Breach Notification to Individuals
• HHS HIPAA Enforcement Page
• eCFR §164.308: Administrative Safeguards

Related Reading

• How to Conduct a HIPAA Gap Analysis for Small Practices
• What Proof Do Auditors Expect for HIPAA Compliance?
• Should We Start With a HIPAA Security Risk Assessment?
• HIPAA Risk Assessment Template: Free Guide for 2026
• HIPAA Gap Analysis Guide for Healthcare Teams
• HIPAA Risk Assessments for Business Associates
• HIPAA Policies and Training for Small Practices
• Free HIPAA Status Tune-Up Quiz