HIPAA Compliance Audit Readiness Checklist for Small Practices
A practical checklist of the evidence and records a small clinic needs to be ready for a HIPAA audit, with the specific CFR citations OCR (HHS Office for Civil Rights, the HIPAA enforcement body) expects you to follow.
What Evidence Does a Small Practice Need for a HIPAA Audit?
When OCR audits a practice, they request specific records tied to the Security and Privacy Rules. Small practices must meet the same standards as large systems; the difference is scope, not duty. This checklist lists the records OCR commonly requests with the CFR citations. Official guidance: HHS OCR HIPAA guidance.
- Security Risk Assessment (a documented analysis identifying threats and vulnerabilities to electronic PHI) records under 45 CFR §164.308(a)(1)(ii)(A): a written analysis identifying threats and vulnerabilities to all electronic PHI (protected health information created, received, maintained, or transmitted by the practice) your practice creates, receives, maintains, or transmits
- Written policies and procedures under 45 CFR §164.316(a): documented standards covering PHI handling, access controls, workforce conduct, and breach response
- Workforce training records under 45 CFR §164.308(a)(5)(i): evidence that all workforce members with PHI access received HIPAA training at hire and when policies changed, including dates, topics, and attendance
- Business Associate Agreement (a signed contract with a vendor that handles PHI) inventory under 45 CFR §164.502(e): signed BAAs for every vendor that creates, receives, maintains, or transmits PHI on your behalf
- Incident response plan and breach notification procedures under 45 CFR §164.404(b): a documented process for identifying, investigating, and reporting breaches, including notification to affected individuals within 60 days of discovery (HHS breach notification guidance, 45 CFR §164.404)
- Documentation retention proof under 45 CFR §164.530(j): evidence that compliance-related records (policies, training logs, risk assessments, BAAs, incident reports) have been retained for at least six years
Audit evidence at a glance
| Record | CFR section | What to have ready |
|---|---|---|
| Security Risk Assessment | §164.308(a)(1)(ii)(A) | A written analysis of the risks to all ePHI |
| Policies and procedures | §164.316(a) | Current written policies, dated |
| Workforce training records | §164.308(a)(5)(i) | Dates, topics and attendance for each staff member |
| BAA inventory | §164.502(e) | A signed BAA for every vendor that handles PHI |
| Breach notification procedures | §164.404(b) | A written process; notice to individuals within 60 days of discovery |
| Privacy and Security Officers | §164.530(a), §164.308(a)(2) | A named person for each role, in writing |
| Documentation retention | §164.530(j), §164.316(b)(2)(i) | Six years from creation or the date last in effect, whichever is later |
OCR does not expect perfection.
The HIPAA Audit-Readiness Checklist
Use this checklist to verify that your practice has the records and safeguards OCR expects. Each item references the specific CFR section that establishes the requirement. Tick items as you go. Your progress stays in this browser only.
Core documents (Policies, SRAs, Training, BAAs)
Technical and physical safeguards (Access, Audit, Transmission security)
Roles & incident plans (Privacy/Security officers, IR, contingency)
What to Do If Your Clinic Has No Risk Assessment or Written Policies
Start with a Security Risk Analysis to identify where ePHI is stored and the main risks. Assign a staff member as the Security Officer and document that role. HHS says regulated entities must periodically assess how well their policies and safeguards meet the Security Rule (HHS risk analysis guidance), and ONC/HHS offers a Security Risk Assessment Tool to help get started.
I put the risk analysis first on this checklist because it is the first required item in the Security Rule’s administrative safeguards. Here is the exact text:
“Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.”
45 CFR §164.308(a)(1)(ii)(A), eCFR
From a real engagement (anonymized): a mental health franchise office in Florida had no program in place and a state auditor due within days. It got audit-ready in under a week with a ranked action plan and daily check-ins, and passed its state audit (case 01).
Here is a practical starting sequence for a small practice beginning from scratch:
- Designate a Security Officer. Under §164.308(a)(2), someone in your practice must be formally responsible for HIPAA security. In a small clinic, this is often the office manager or practice owner.
- Conduct a Security Risk Assessment. Under §164.308(a)(1)(ii)(A), identify where electronic PHI lives in your practice: your EHR, email, fax machines, portable devices, cloud storage, and vendor systems. Document the threats and vulnerabilities for each.
- Inventory your vendors and devices. List every vendor that touches PHI (EHR, billing service, cloud backup, IT support, shredding company) and every device that stores or accesses PHI (computers, phones, tablets, external drives).
- Get BAAs signed. Under §164.502(e), every vendor handling PHI must have a signed Business Associate Agreement. If you do not have BAAs in place, start with your EHR vendor, billing service, and cloud providers.
- Put policies in writing. Under §164.316(a), your practice needs written policies and procedures covering access controls, PHI handling, breach notification, workforce sanctions, and device management.
- Train your staff. Under §164.308(a)(5)(i), all workforce members must receive HIPAA training and you must document it with dates, topics, and attendance records.
This content is for educational and informational purposes only and should not be construed as legal advice.
One Guy Consulting in 37 seconds
If you want help working through this checklist, I can go through it with you on a free 30-minute intro call.
HIPAA Audit Readiness Questions
What do I do if my small clinic still does not have a HIPAA risk assessment or written policies?+
If your clinic has no HIPAA risk assessment or written policies yet, start with a Security Risk Analysis now: identify where PHI is stored and transmitted, list your vendors and devices, document the main risks, then put the required policies and procedures in writing and assign someone responsible for security. HHS says regulated entities must periodically assess how well their policies and safeguards meet the Security Rule, and ONC/HHS offers a Security Risk Assessment Tool to help get started. One Guy Consulting can walk you through the entire process with a Security Risk Assessment and tailored policy templates.
What HIPAA compliance help does One Guy Consulting offer for small healthcare practices and business associates?+
One Guy Consulting offers full-scope HIPAA compliance help for small practices and business associates, including security risk assessments under 45 CFR §164.308(a)(1)(ii)(A), gap analysis and remediation plans, custom policies and procedures per §164.316(a), staff training per §164.308(a)(5)(i), IT and physical audits under §164.310 and §164.312, vendor and BAA management per §164.502(e), incident management and breach notification support per §164.404(b), and audit-response records per §164.530(j). Everything is included in one flat annual rate with no per-user fees.
What evidence does OCR expect during a HIPAA audit?+
During a HIPAA audit, OCR often requests records of your Security Risk Assessment per §164.308(a)(1)(ii)(A), written policies and procedures per §164.316(a), workforce training records per §164.308(a)(5)(i), a complete Business Associate Agreement inventory per §164.502(e), breach notification procedures per §164.404(b), records of physical safeguards per §164.310, technical safeguards per §164.312, evidence of a designated Privacy Officer per §164.530(a) and Security Officer per §164.308(a)(2), an incident response plan, and proof of six-year records retention per §164.530(j). OCR expects to see that your practice has implemented reasonable and appropriate safeguards and can show an ongoing compliance effort.
How often should a small practice update its HIPAA risk assessment and policies?+
HHS expects regulated entities to periodically reassess their security measures. While the HIPAA Security Rule under 45 CFR §164.308(a)(1)(ii)(D) does not specify an exact frequency, HHS guidance and industry best practice recommend reviewing and updating your Security Risk Assessment at least annually or whenever significant changes occur, such as new technology, staff turnover, a security incident, or changes in how your practice handles PHI. Written policies should be reviewed annually and updated to reflect current workflows. Documentation of each review must be retained for at least six years under §164.530(j).
Learn More About HIPAA Audit Readiness
Book Your Free 30-Minute Intro Call
Schedule a free 30-minute call to review your current compliance status and identify what your practice needs for audit readiness.