A HIPAA audit checklist is only as good as the questions it anticipates, and those questions are published. OCR publishes the audit protocol it works from, last updated in July 2018 and still the live version, setting out module by module the performance criteria an auditor tests and the audit inquiry they make against each one, across the Privacy, Security and Breach Notification Rules. This checklist works backwards from that protocol: every request an auditor makes, the rule citation behind it, the evidence that closes it, and the point where most teams fall down.
It draws on more than 6,000 security audits supported by the team behind Konfirmity, and on the 2024 to 2025 audit cycle, in which OCR examined 50 covered entities and business associates against the Security Rule provisions most relevant to hacking and ransomware. If you are a CISO, compliance lead or founder at a digital health company, a payer, or any vendor that touches protected health information on behalf of one, this is the request list you will be working from.
How OCR's Audit Protocol Works
The HITECH Act of 2009 requires OCR to audit covered entities and business associates periodically, and OCR runs those audits against a published protocol rather than an auditor's judgment. It is not software and there is nothing to download: HHS presents it as a searchable table on its own site, and its own note still says export options are coming. It carries the date July 2018, which is worth knowing before you rely on it, but it remains the live published version and the closest thing to a written exam paper you will get. Reading it is the cheapest preparation available, because it tells you the exact wording of what will be asked.
The protocol is organized into modules covering the Privacy, Security and Breach Notification Rules, and within each module the entries are keyed to a specific regulatory citation, such as §164.308 or §164.502. Every entry carries three things:
| Column in the protocol | What it means for you |
|---|---|
| Established performance criteria | The regulatory text you are being measured against, quoted directly |
| Audit inquiry | The instruction the auditor follows, usually "obtain and review" a named document or a sample of records |
| Required or addressable | Whether the specification must be implemented as written, or whether a documented, reasoned alternative is acceptable |
Two things follow from that structure. First, most audit inquiries ask the auditor to obtain and review a sample, which means the evidence has to hold up at any point in the period, not on the day you assemble it. Second, "addressable" is not "optional": if you have not implemented an addressable specification, the protocol expects a documented rationale and the alternative measure you put in its place. A missing rationale is a finding.
The current cycle narrows this further. OCR's 2024 to 2025 audits examine 50 covered entities and business associates against the Security Rule provisions most relevant to hacking and ransomware, so risk analysis, access controls, audit controls and contingency planning carry more weight right now than the protocol's breadth alone would suggest.
What a HIPAA Audit Actually Covers
A HIPAA audit is an assessment of how an organization protects PHI. It verifies that the entity complies with the Privacy, Security, Breach Notification, and Enforcement rules and that documented policies are followed in practice. Audits can be internal (self-directed or assisted by partners like Konfirmity) or external (conducted by regulators such as the Department of Health and Human Services Office for Civil Rights (OCR)). Internal audits assess readiness and uncover gaps before an external authority examines your program. External audits may occur during compliance reviews, investigations, or random OCR audit programs.
Important components of a HIPAA audit include:
-
Privacy compliance – verifying that PHI is used and disclosed only as permitted under the Privacy Rule and that individuals have rights to access and correct their records.
-
Security measures – checking that administrative, physical, and technical safeguards protect electronic PHI (ePHI) and that they are documented and followed.
-
Risk assessment – confirming that the organization has conducted an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI and has implemented measures to reduce those risks.
-
Technical and physical safeguards – reviewing access controls, encryption, and facility security to protect systems and devices.
-
Incident response and breach notification – examining processes for detecting, reporting, and mitigating security incidents and notifying affected parties within required timelines.
-
Documentation and training records – validating that policies, procedures, and workforce training documents are maintained, current, and reflect actual practices.
Internal audits may focus on readiness, sample control testing, and evidence gathering. External audits often involve extensive documentation requests, interviews, and demonstration of controls over an observation window. Being prepared requires matching internal processes with regulatory expectations and maintaining evidence of ongoing operations.
Core HIPAA Rules You Need to Know
HIPAA compliance is built upon four rules, and the audit protocol has a module for three of them. What follows is not a primer on the rules themselves, which our HIPAA compliance checklist covers section by section; it is what an auditor actually tests under each one.
1) Privacy Rule
The Privacy Rule sets national standards for the protection of individually identifiable health information. It governs how PHI may be used and disclosed and grants individuals rights over their information, such as access, amendment, and accounting of disclosures. Covered entities and business associates must implement policies and procedures that limit uses of PHI to the minimum necessary for treatment, payment, and operations. Transparency is essential: individuals must receive notices of privacy practices outlining how their information is used and their rights to complain or request restrictions. In the protocol, this module is mostly sampled: expect the auditor to pull a set of access requests under §164.524 and test the response dates against the 30-day clock.
2) Security Rule
The Security Rule establishes national security standards for ePHI and requires administrative, physical, and technical safeguards. It is flexible and technology-neutral. The rule has three categories:
-
Administrative safeguards – actions, policies, and procedures to manage the selection, development, implementation, and maintenance of security measures to protect ePHI and to manage the conduct of the workforce. These include risk analysis and risk management, workforce training, contingency planning, and vendor management. Risk analysis must be accurate and thorough to identify risks and vulnerabilities to ePHI, and risk management requires implementing security measures sufficient to reduce risks to a reasonable extent.
-
Physical safeguards – physical measures, policies, and procedures that protect electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion. Organizations must consider all physical access to ePHI, including remote work locations and backup facilities.
-
Technical safeguards – technology and the policy and procedures for its use that protect ePHI and control access. Access controls must ensure that only authorized individuals can access ePHI and typically include unique user identification, emergency access procedures, automatic logoff, and encryption/decryption.
This is the module where the current audit cycle is concentrated, and the one where "addressable" trips teams up most often — encryption at rest and in transit are both addressable specifications, which is not the same as optional.
3) Breach Notification Rule
A breach is an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of PHI, unless a risk assessment demonstrates a low probability that the PHI was compromised. The risk assessment considers factors such as the nature of the PHI involved, who accessed it, whether it was actually viewed, and whether the risk has been mitigated. If a breach involves 500 or more individuals, the covered entity must notify the HHS within 60 calendar days of discovery; for breaches involving fewer than 500 individuals, notification must occur within 60 days of the end of the calendar year. Affected individuals must also receive written notice without unreasonable delay. Business associates have parallel responsibilities when they discover a breach, and §164.414(b) puts the burden of proof on you — the incidents you decided were not breaches need the same four-factor documentation as the ones you notified.
4) Enforcement Rule
The Enforcement Rule outlines investigation procedures and penalties. The four culpability tiers run from $145 to $2,190,294 per violation after the inflation adjustment applied in January 2026, with an annual cap per identical provision. One caveat that rarely makes it into checklists: OCR's 2019 Notice of Enforcement Discretion holds the maximums and annual caps for the first three tiers well below the published figures, so the headline number and the number OCR actually applies are not the same. As of 31 October 2024, OCR had received more than 374,000 HIPAA complaints and imposed a settlement or civil money penalty in 152 cases, totalling $144,878,972. Healthcare remains the costliest sector for data breaches, at $6.64 million per incident in 2026, down 10.5 percent from $7.42 million the year before. The enforcement module of the protocol is thin; the money sits in the Security Rule module, which is where audits are concentrated.
The HIPAA Audit Checklist: Every Request, and What Closes It
There is no separate set of HIPAA audit requirements to learn: an audit tests the requirements already written into the three rules above, using the inquiries the protocol publishes. Building a HIPAA audit checklist therefore means translating each audit inquiry into an artefact someone owns. The table below is the request list, grouped the way the protocol groups it. Work down the last column first: it is where findings come from.
| What the auditor asks for | Rule citation | What closes it | Where it usually breaks |
|---|---|---|---|
| ☐ Risk analysis covering every location ePHI resides | §164.308(a)(1)(ii)(A) | A dated, accurate and thorough analysis spanning databases, cloud storage, medical devices, laptops and third-party systems | Scope stops at the EHR and misses laptops, shared drives and vendor systems |
| ☐ Risk management plan and evidence of remediation | §164.308(a)(1)(ii)(B) | Tracked corrective actions with owners, dates and closure evidence | The analysis exists, the remediation trail does not |
| ☐ Information system activity review | §164.308(a)(1)(ii)(D) | Completed reviews of audit logs, access reports and incident tracking reports, not just their retention | Reviews happen informally in a chat channel and leave no record |
| ☐ Workforce training records | §164.308(a)(5) | Dated completion records by person and role, including onboarding and refreshers | Attendance is logged but role-specific content is not evidenced |
| ☐ Workforce clearance and termination procedures | §164.308(a)(3) | Screening records, and access removal timestamps for leavers | Access removal lags the termination date |
| ☐ Business Associate Agreements | §164.308(b) and §164.502(e) | A vendor inventory with a current, signed BAA for every party touching ePHI | The inventory is incomplete, or BAAs predate a change of service |
| ☐ Contingency plan, backups and restoration testing | §164.308(a)(7) | Backup schedule, a documented restore test, and stated RTO and RPO | Backups run, restoration has never been tested |
| ☐ Facility access controls and visitor records | §164.310(a) | Badge or biometric logs, visitor logs, and a documented facility security plan | Remote work locations are outside the plan entirely |
| ☐ Device and media disposal and reuse records | §164.310(d) | Chain-of-custody records and destruction certificates for retired media | Devices are recycled without a certificate |
| ☐ Unique user identification and access review | §164.312(a)(1) | Unique IDs per user, least-privilege roles, and dated quarterly access reviews | Shared or service accounts with no named owner |
| ☐ Encryption of ePHI at rest and in transit | §164.312(a)(2)(iv) and §164.312(e) | Encryption configuration evidence, or a documented rationale and alternative if not implemented | Treated as optional because it is addressable, with no rationale on file |
| ☐ Audit controls and log review | §164.312(b) | Logging enabled on systems holding ePHI, with evidence that logs are reviewed, not merely retained | Logs are collected; nobody can show a review |
| ☐ Policies and procedures, retained six years | §164.316 | Current, version-controlled and approved documents, with superseded versions retained | Policies describe a process the team stopped following |
| ☐ Breach risk assessments and notification records | §164.402 and §164.404 | The four-factor risk assessment for each incident, plus proof of notification and its timing | The determination that something was not a breach is undocumented |
| ☐ Notice of Privacy Practices and individual rights records | §164.520 and §164.524 | The current notice, and records of access, amendment and accounting requests with response dates | Access requests are answered informally and never logged |
The last column matters more than the first. In the protocol, most inquiries instruct the auditor to obtain and review a sample from the audit period, so a control that started working last month does not close a request that covers last year.
Free download
The HIPAA Audit Request List
Every request above as a tracker: rule citation, evidence owner, where the evidence lives, and the date it was last refreshed — plus worked risk analysis, PHI inventory, training and log-review tabs, and an addressable-specifications register. Enter your work email and we'll send the PDF.
Incident Response and Breach Notification
-
Defined response process – document an incident response plan detailing how to detect, respond to, and recover from security incidents. Assign roles and responsibilities, including a breach response team with clear escalation paths.
-
Documentation of incidents and notifications – maintain records of incidents, including analysis, remediation, and notifications. For breaches, document risk assessments used to determine whether notifications are required and maintain evidence of notifications sent to individuals and regulators.
Contingency Planning
-
Backup processes – implement scheduled backups of ePHI to geographically separated locations. Test backup restoration to ensure data can be recovered.
-
Disaster recovery – develop and test a disaster recovery plan that includes recovery time objectives (RTOs) and recovery point objectives (RPOs). Ensure that critical systems can be restored within timeframes acceptable to business and regulatory needs.
A HIPAA audit checklist is only useful when your controls are already working.
Share your work email and build a security posture that satisfies auditors before they ask.
Step-by-Step Guide to Conducting a HIPAA Audit
The request list tells you what has to exist. This section is about producing it. Each step below ends in an artefact that closes one or more rows in the table above, which is a different job from planning the engagement itself: for the readiness timeline, who does what and when, see our HIPAA audit preparation guide, and for running the exercise internally, our HIPAA internal audit guide.
Define Scope and Inventory PHI
Begin by identifying where PHI and ePHI are created, stored, and accessed. This includes electronic health record systems, billing platforms, cloud storage, laptops, mobile devices, and paper records. Create a PHI inventory tracker — a table that lists each system, owner, location, and data classification. Don't forget hidden stores such as email attachments, shared folders, support ticket attachments, or removable media; those are the rows auditors most often catch teams missing. The inventory informs risk analysis and helps prioritize controls.
Conduct a Risk Assessment
Next, conduct a risk assessment; see our HIPAA gap assessment guide for a step-by-step walkthrough. Use the inventory to identify threats and vulnerabilities, rate their likelihood and impact, and document findings. Follow NIST SP 800-66 guidance to protect ePHI against anticipated threats and evaluate security measures based on your size and risk environment. Assign risk scores and remediate high-risk items first. Konfirmity uses automated scoring and service agreements (SLAs) — for example, high-risk items are addressed within 30 days.
Review and Strengthen Access Controls
Verify that users have only the access they need. Implement multi-factor authentication, strong passwords, automatic logoff, and unique user IDs. Review access rights at least quarterly and remove dormant accounts. Use VPNs and endpoint management for remote access. Automate privileged account reviews; Konfirmity integrates with identity providers to generate evidence. Every service and shared account needs a named human owner, because §164.312(a)(2)(i) is tested against a user list, and an unowned account is the row that gets flagged.
Document Training and Awareness Programs
Training is more than a check-the-box task. Document all workforce training, including dates, content, and attendees. Provide role-based training for engineers, clinicians, and support staff. Record pre-hire screening and ensure terminated employees are promptly removed from systems. Use interactive sessions rather than slide decks; measure understanding through quizzes and adjust content based on incident trends. Keep the module version alongside the completion record — that pairing is what evidences role-specific training rather than headcount. Our HIPAA training requirements guide covers what each role needs to receive.
Evaluate Security and Technical Safeguards
Review the implementation of technical controls. Confirm that ePHI is encrypted at rest and in transit, and where it is not, that the addressable rationale and the alternative measure are written down. Evaluate logging — logs should capture important actions and be aggregated centrally. Test configurations against hardening guides such as the CIS benchmarks. Implement mobile device management for devices in clinical settings. These measures meet technical safeguard requirements; our HIPAA encryption requirements guide covers the addressable-versus-required distinction in detail.
Perform Policy and Procedure Reviews
Review policies for privacy, security, incident response, vendor management, and workforce discipline. Ensure they reflect current operations and have leadership approval. Adjust policies or practices when mismatches arise. Conduct at least annual reviews and record approvals, and retain superseded versions for six years from creation or last effective date, whichever is later. Konfirmity often sees "policy drift" when teams adopt new tools without updating documents; catching this early prevents findings.
Prepare Incident and Breach Records
Gather documentation related to security incidents, including the date, description, impact, root cause, corrective actions, and notification details. For each breach, include the risk assessment that determined whether it was a breach under HIPAA and evidence of notifications to individuals and regulators. Do the same for the incidents you closed as non-breaches — that is what §164.414(b)'s burden of proof means in practice. Maintain a log of near-miss events and lessons learned. Audit teams will review these records to evaluate the maturity of your incident management process.
Final Gap Analysis and Remediation
After collecting evidence and reviewing controls, perform a gap analysis. Compile findings, categorize them by severity, and assign remediation actions. Track progress through a remediation tracker, with assigned owners and due dates. Present the findings to leadership and secure the resources needed to address gaps. For external audits, prepare a package of evidence (policies, risk assessments, training logs, vendor agreements, logs) that demonstrates compliance. Engage independent assessors, such as Konfirmity's audit partners, to perform mock audits or readiness reviews; our HIPAA auditor selection guide covers how to choose one. They will simulate auditor questions and help refine your evidence package, and our HIPAA common audit findings guide shows which gaps recur most often.
Templates and Audit Tools
Reusable templates and tools turn each request into something a named person maintains. Use these as starting points and customize them for your organization:
| Template | Purpose | Essential fields |
|---|---|---|
| Risk Assessment Template | Document threats, vulnerabilities, impact, likelihood and risk scores | Asset ID, data classification, threat description, vulnerability, existing controls, risk score, remediation plan |
| Access and Audit Log Review Form | Verify access controls and evidence that logs are reviewed | System name, reviewer, date, sample size, findings, actions taken |
| Incident Response Documentation | Record incident details, the four-factor breach determination and actions | Incident ID, date and time, affected systems, description, root cause, containment actions, notifications, lessons learned |
| PHI Inventory Tracker | Catalogue where PHI resides, including the stores audits usually miss | System name, location, owner, data flow, storage media, sensitivity classification |
| Training Compliance Tracker | Track workforce training by person and role | Employee name, role, training date, type of training, quiz score, follow-up required |
These templates can be maintained in spreadsheets or integrated into a governance, risk, and compliance (GRC) platform. Konfirmity provides ready-to-use templates and automated evidence workflows as part of its managed service.
What the Downloadable Request List Contains
The free request list packages the tables on this page into one document your evidence owners can work from. Each part maps back to a section above:
| Part of the file | Maps to on this page | What it holds |
|---|---|---|
| Request tracker | The request table in "Every Request, and What Closes It" | All 15 requests as rows, with rule citation, evidence owner, evidence location, last-refreshed date and status |
| Failure modes | The last column of the same table | The failure mode per request, with the corrective action to take this quarter |
| Risk analysis worksheet | Templates table, row 1 | The fields listed in that row, one row per asset, with eight worked examples |
| PHI inventory | Templates table, row 4 | The fields listed in that row, one row per system, including the stores audits usually miss |
| Training tracker | Templates table, row 5 | The fields listed in that row, one row per person and role |
| Log review log | Templates table, row 2 | One row per review, so the review itself is evidenced and not just the retention |
| Addressable specifications register | The "addressable is not optional" rule above | Each addressable specification, whether it is implemented, and the rationale plus alternative where it is not |
The companion workbook takes the other direction: rather than your evidence, it lays out the protocol's own Privacy, Security and Breach Notification modules with the required-or-addressable flag per specification and a sign-off column per module.
Free workbook
The OCR Audit Protocol Workbook
The Privacy, Security and Breach Notification modules an auditor works from — every specification with its citation, its required-or-addressable flag, the inquiry the auditor makes, and a sign-off sheet per module. Enter your work email and we'll send the PDF.
How to Keep Your Organization Audit-Ready
Compliance is not a one-time project. Maintaining audit readiness requires continuous monitoring and disciplined operations:
-
Continuous monitoring – implement tools to monitor security controls, logs, and configurations in real time. Automate alerts for anomalies and integrate them with incident management workflows.
-
Quarterly internal checks – conduct mini-audits every quarter. Review access logs, patch status, vendor compliance, and training records. Test a sample of controls to catch drift early. Our HIPAA internal audit guide covers how to structure these mini-audits so they hold up as real evidence.
-
Periodic policy reviews – review and update policies at least annually or whenever there is a significant change in the environment. Document approvals and communicate changes to the workforce.
-
Training refreshers – deliver security awareness refreshers at least annually, with targeted modules for specific roles. Track completion and adjust content based on incident data.
-
Vendor compliance checks – evaluate vendors for security compliance. Review their SOC 2 or ISO 27001 reports, request updated BAAs, and validate that they meet your security requirements. Include vendors in your risk assessment.
By embedding these activities into your operating rhythm and keeping the request list current, you build security habits. Over time, evidence generation becomes an ongoing process rather than a scramble before an audit.
See your real HIPAA audit checklist gap, not a guess
Book a demo and we'll map your controls against the Security Rule requirements, self-serve or with our CISO-led team running it for you.
Book a demo
Conclusion
A HIPAA audit checklist is not just a compliance task; it is an operational tool that keeps healthcare enterprises honest about how they handle PHI. The Privacy, Security, Breach Notification, and Enforcement rules provide structure, but they require disciplined implementation. Administrative safeguards like risk assessments and workforce training protect against human error, physical safeguards protect facilities and devices, and technical safeguards like encryption and logging prevent unauthorized access. Incident response and contingency planning ensure that when something goes wrong — as it eventually will — the organization can respond swiftly and transparently.
Experience shows that real security yields compliance as a natural by-product. Organizations that view audits as annual events often scramble to produce evidence and find that policies don't match operations. Those that embed security into daily operations — through continuous monitoring, regular training, and vendor oversight — reduce findings, shorten sales cycles, and protect patient trust.
Konfirmity is a security-driven compliance platform for HIPAA and the frameworks around it, covering SOC 2 Type II, ISO 27001:2022 and GDPR alongside it: run it self-serve, or add the fully-managed service and our team implements the controls inside your stack and collects the evidence continuously. Teams working with us typically reach readiness in four to five months rather than the nine to twelve a self-managed effort takes, at under 70 hours of internal effort a year against 550 to 600 hours in-house. Security that looks good in documents but fails under pressure is a liability. Build controls that stand up to buyers, auditors, and attackers, and let compliance follow.
FAQs
A HIPAA audit assesses compliance with the Privacy, Security, and Breach Notification rules. It examines how PHI is used and disclosed, evaluates administrative, physical, and technical safeguards, and reviews risk assessments and incident response plans. Auditors also review documentation and training records to ensure policies are followed in practice.
There is no separate set of audit requirements: an audit tests the requirements already in the Privacy, Security and Breach Notification Rules, using OCR's published protocol. In practice that means a current risk analysis and evidence that its findings were remediated, workforce training records by person and role, signed BAAs for every vendor touching ePHI, unique user IDs with dated access reviews, audit logging with evidence of review, a tested contingency plan, policies retained for six years, and documented four-factor risk assessments for any incident. Addressable specifications you have not implemented require a written rationale and the alternative you used instead.
OCR does not audit every covered entity on a routine basis. However, internal audits are an expected part of a mature compliance program, and OCR may initiate a compliance review in response to a complaint, breach, or random selection. Entities that conduct regular internal audits, maintain evidence, and fix gaps will fare better in external reviews.
Preparation begins long before an audit. Conduct a thorough risk assessment, build and maintain your audit request list, and document all training and policies. Implement administrative, physical, and technical safeguards, and test them regularly. Maintain incident and breach records, review vendor agreements, and perform periodic internal audits.
It is the document OCR audits against, published by HHS and organized into modules for the Privacy, Security and Breach Notification Rules. Each entry names a regulatory citation, quotes the established performance criteria, states the audit inquiry the auditor will make, and flags whether the specification is required or addressable. Because the inquiries are public, you can test yourself against the exact wording before anyone contacts you.
The same thing as a HIPAA audit checklist. The HITECH Act of 2009 is what obliges OCR to audit covered entities and business associates periodically, so the two names describe one exercise: preparing for the audit programme HITECH mandates and OCR runs against its published protocol. HITECH also extended direct HIPAA liability to business associates, which is why vendor BAAs and vendor evidence sit inside the same request list rather than beside it.
