HIPAA Audit Readiness FAQ
Answer: auditors first ask for four record types: a current SRA (Security Risk Assessment), staff training records, written policies, and evidence of ongoing remediation.
What Auditors Ask For, What Documentation to Keep, and How to Prepare
11 questions covering what auditors request, evidence retention, record-keeping requirements, good-faith compliance efforts, corrective action plans, and how to respond when an audit notice arrives.
Audit Readiness FAQ
Before an audit: prepare SRAs, training, policies, BAAs
5 questions01What records is most commonly missing?+
The two most common missing items are written policies and procedures and signed Business Associate Agreements (BAAs).
02What demonstrates a good-faith effort toward HIPAA compliance?+
Good-faith compliance is demonstrated through documented evidence of ongoing efforts. The five essential elements are:
- Completed Security Risk Assessment - a current SRA with documented findings, risk levels, and mitigation plans
- Documented training - records showing all workforce members completed HIPAA training, with dates and sign-off attestations
- Written policies - adopted policies and procedures covering the Privacy Rule, Security Rule, and Breach Notification Rule
- Documented remediation with timelines - evidence that identified gaps were addressed, including what was fixed, when, and by whom
- Signed Business Associate Agreements - executed BAAs with all vendors that create, receive, maintain, or transmit PHI
Auditors and investigators assess whether a business made reasonable, ongoing efforts - not whether compliance was perfect at every moment.
03What evidence should a healthcare business keep?+
As a rule, keep everything tied to compliance. This means risk assessments, training records, signed policy forms, BAAs, fix-it records, incident reports, and any other proof of your compliance work.
04What HIPAA compliance consulting is best for a small medical practice that needs everything set up from scratch?+
Look for a consultant who handles the full setup rather than selling the pieces separately: risk assessment, written policies, staff training, and BAA tracking. One Guy Consulting offers a start-to-finish HIPAA setup covering risk assessment, policies, training, and BAA tracking for small practices (HIPAA consulting).
05What do I do if my small clinic still does not have a HIPAA risk assessment or written policies?+
Start with a Security Risk Assessment, because it shows you which gaps matter most, then put written policies in place to close them. Both are required under HIPAA, and completing them before an audit or incident forces the issue is the strongest good-faith move a clinic can make.
During an audit: what auditors request and how to hand evidence
3 questions06What is the first thing an auditor often wants to see?+
Auditors often begin by requesting four categories of records:
- Current Security Risk Assessment (SRA) - the most recent completed risk assessment with documented findings and remediation plans
- Staff training records - proof that all workforce members completed HIPAA training, including dates and attestations
- Written policies and procedures - your adopted HIPAA policies covering the Privacy Rule, Security Rule, and Breach Notification Rule
- Evidence of ongoing compliance efforts - remediation tracking, updated risk registers, and records of corrective actions taken
Having these four categories organized and readily accessible before an audit notice arrives is the single most effective preparation step. The HIPAA audit readiness checklist covers each category item by item.
07What surprises businesses most during an audit?+
Many practices are surprised that auditors mainly want specific documents and proof. If you can hand over what they ask for quickly, the process tends to go much smoother than expected.
08Are auditors looking for perfection?+
No. Auditors want to see that you have a working system to protect patient data (PHI). They are not looking for a perfect score.
After an audit: CAPs, remediation tracking, and retention
3 questions09Can a business fail a HIPAA audit?+
Yes. Failure can result in:
- Corrective Action Plans (CAPs) - a formal agreement requiring the business to remediate specific deficiencies within a set timeframe, with ongoing monitoring for up to three years
- Civil monetary penalties - ranging from $145 to $2,190,294 per violation category per year, depending on the level of negligence
- Extended monitoring - OCR may require periodic compliance reports and progress updates for up to three years following a finding
Beyond financial penalties, audit findings can damage organizational reputation and erode trust with patients and business partners.
10What is a Corrective Action Plan (CAP)?+
A Corrective Action Plan (CAP) is a formal agreement between a business and the HHS Office for Civil Rights (OCR) that requires the business to take specific steps to address identified HIPAA violations. A CAP often includes:
- A detailed description of the compliance deficiencies found
- Specific remediation steps the business must complete
- Deadlines for completing each remediation step
- Periodic reporting requirements to OCR on progress
- A monitoring period, usually lasting one to three years
CAPs are legally binding. Failure to meet CAP requirements can result in additional penalties.
11How long should HIPAA compliance records be retained?+
HIPAA requires retention for six years from creation or the date last in effect, whichever is later. This requirement is established in 45 CFR 164.530(j) for Privacy Rule records and 45 CFR 164.316(b)(2)(i) for Security Rule records.
Records subject to retention include policies and procedures, risk assessments, training records, BAAs, incident reports, remediation plans, and any other records related to HIPAA compliance activities.
The Privacy Rule states the retention period in one sentence:
“A covered entity must retain the documentation required by paragraph (j)(1) of this section for six years from the date of its creation or the date when it last was in effect, whichever is later.”
45 CFR 164.530(j)(2)
| Record | Where HIPAA requires it | How long to keep it |
|---|---|---|
| Privacy policies and procedures | 45 CFR 164.530(i) and (j)(1)(i) | 6 years from creation or the date last in effect, whichever is later (164.530(j)(2)) |
| Privacy training records (proof training was given) | 45 CFR 164.530(b)(2)(ii) | 6 years (164.530(j)(2)) |
| Security policies and procedures | 45 CFR 164.316(b)(1)(i) | 6 years from creation or the date last in effect, whichever is later (164.316(b)(2)(i)) |
| Security Risk Assessment (the risk analysis) | 45 CFR 164.308(a)(1)(ii)(A), kept as a record under 164.316(b)(1)(ii) | 6 years (164.316(b)(2)(i)) |
No questions match that search. Try a shorter word, check the glossary, or ask Chuck directly.
Audit readiness starts with knowing your gaps. A HIPAA Gap Analysis evaluates your current compliance program against the full set of HIPAA requirements to identify what is missing or incomplete before an auditor does.
Example: a Florida mental health office with no program in place got audit-ready in under a week through a fast gap analysis and a ranked action plan, then passed its state audit. Read the anonymized case study (Case 01).
Sources: HHS OCR: HIPAA compliance and enforcement, HHS: the HIPAA Security Rule, NIST SP 800-66 Rev. 2.
About the author: Chuck Weiselberg is Founder and HIPAA compliance consultant at One Guy Consulting, focused on small-practice readiness and remediation. Full bio and contact.
One Guy Consulting in 37 seconds
New to us? This short video shows who we are and how we help small practices with HIPAA compliance.
Not Sure If You're Audit-Ready?
On a free 30-minute intro call, I go through your current records with you. I point out the gaps an auditor would flag and tell you what needs to be in place before an audit notice arrives.