HIPAA, the Health Insurance Portability and Accountability Act of 1996 and the rules issued under it, is the regulation every healthcare organization claims to comply with and the one whose enforcement record shows how often the claim is wrong. The Office for Civil Rights’ settlements and penalties turn, almost without exception, on three failures: a risk analysis of the organization’s electronic protected health information that was never performed enterprise-wide or never updated, access to records that was granted and never reviewed, and patients’ requests for copies of their own records that were not answered within the rule’s thirty days. None of the three requires sophisticated technology to find, which is why a HIPAA compliance audit is among the most productive engagements a healthcare internal audit function can run, and why its findings so often duplicate what a regulator would have written.
This guide gives the program: who and what HIPAA covers; the Privacy Rule’s uses, disclosures and patient rights; the Security Rule’s safeguards with the risk analysis at their center; the Breach Notification Rule’s clocks and assessment; business associates and the agreement inventory; how the Office for Civil Rights enforces and what its cases teach; the rule changes of 2025 and 2026 including the Security Rule proposal; the audit program by area; how internal audit divides the work with the compliance and privacy functions; and a worked example from Ashgrove Health System, the nonprofit hospital system used in the healthcare examples on this site. The internal audit in healthcare guide covers the wider environment, the data privacy audit guide the general privacy program HIPAA sits inside, and the auditing cybersecurity programs guide the security testing the Security Rule draws on.
In this guide
- Who is covered and what is protected
- The Privacy Rule: uses, disclosures and patient rights
- The Security Rule: safeguards and the risk analysis
- The Breach Notification Rule
- Business associates
- How OCR enforces and what the cases teach
- What changed in 2025 and 2026
- The audit program by area
- Internal audit, compliance and the privacy and security officers
- A worked example: Ashgrove Health System’s enterprise HIPAA audit
- Questions about HIPAA audits
- Related guides
Who is covered and what is protected
HIPAA’s administrative simplification rules, issued by the Department of Health and Human Services and enforced by its Office for Civil Rights (OCR), bind covered entities (health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions, which is nearly every provider) and, since the 2013 Omnibus Rule implementing the 2009 HITECH Act, business associates, the vendors and contractors that create, receive, maintain or transmit protected health information on a covered entity’s behalf (billing companies, IT hosts, consultants, record storage, claims processors, and their subcontractors). Protected health information (PHI) is individually identifiable health information held or transmitted by a covered entity or business associate in any form; electronic PHI (ePHI) is the subset the Security Rule protects. Information is de-identified, and outside the rules, when the eighteen identifiers listed in the Privacy Rule are removed (the safe harbor method) or a qualified expert determines re-identification risk is very small. The rules are the Privacy Rule (compliance required since 2003), the Security Rule (2005), the Breach Notification Rule (2009, amended 2013) and the Enforcement Rule, codified at 45 CFR Parts 160 and 164, with state laws that are more protective of patients surviving alongside. The scope question an audit asks first is whether the organization has correctly identified every covered component, every system and location that holds PHI, and every business associate, because every later test depends on that inventory.
The Privacy Rule: uses, disclosures and patient rights
The Privacy Rule permits uses and disclosures of PHI without authorization for treatment, payment and health care operations, for certain public interest purposes (public health, law enforcement under conditions, research under conditions, health oversight), and to the individual; it requires written authorization for most other uses, including marketing and the sale of PHI, and it requires that uses and disclosures other than for treatment be limited to the minimum necessary to accomplish the purpose, which obliges the organization to define role-based access and to limit routine disclosures. It requires a Notice of Privacy Practices, a designated privacy official, workforce training, sanctions for violations, a complaint process, and safeguards. It gives individuals rights: to access and obtain a copy of their records in the designated record set within 30 days (one 30-day extension with written notice), in the form and format requested if readily producible, for a reasonable cost-based fee; to request amendment; to an accounting of disclosures for the prior six years (excluding treatment, payment and operations); to request restrictions and confidential communications; and to be notified of breaches. The right of access is the Privacy Rule provision OCR has enforced most actively since 2019 (more than fifty settlements under its Right of Access initiative), because the cases are simple: a patient asked, the organization did not answer in time or charged too much, and the complaint reached OCR. The audit tests the policies, the training, the access request process end to end (sample requests from receipt to fulfillment with dates, fees and formats), the accounting of disclosures capability, the Notice’s currency and distribution, the complaint log and the sanction records, and the minimum necessary standard as implemented in role-based access.
The Security Rule: safeguards and the risk analysis
The Security Rule (45 CFR 164.302 to 164.318) requires covered entities and business associates to ensure the confidentiality, integrity and availability of ePHI, protect against reasonably anticipated threats and impermissible uses, and ensure workforce compliance, through administrative, physical and technical safeguards. Each safeguard has implementation specifications that are either required or addressable; an addressable specification must be implemented if reasonable and appropriate, or the entity must document why it is not and implement an equivalent alternative, which is a decision to document, not an option to skip (the 2025 proposal would remove the distinction, as the changes section explains). At the center of the administrative safeguards is the risk analysis (164.308(a)(1)(ii)(A)): an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of all ePHI the entity creates, receives, maintains or transmits, followed by risk management to reduce the risks to a reasonable and appropriate level. OCR’s enforcement record and its 2025 audit program both center on the risk analysis, because it is the control from which every other security decision is supposed to flow, and because the common failure is a risk analysis that covers the electronic health record and misses the forty other systems, devices and vendors that hold ePHI. NIST SP 800-66 Revision 2 (February 2024) is HHS’s recommended guide to implementing the Security Rule, and the HHS 405(d) Health Industry Cybersecurity Practices and the 2024 Cybersecurity Performance Goals give the practical control baseline that examiners and insurers increasingly expect.
| Safeguard category | Standard (45 CFR 164.3xx) | Key implementation specifications | Audit tests |
|---|---|---|---|
| Administrative (164.308) | Security management process | Risk analysis (R); risk management (R); sanction policy (R); information system activity review (R) | Risk analysis covers every system, device and vendor holding ePHI, is current and drove a risk management plan with owners and dates; log review evidence; sanctions applied |
| Administrative | Assigned security responsibility | A named security official (R) | Designation, authority and resources |
| Administrative | Workforce security; information access management | Authorization and supervision (A); workforce clearance (A); termination procedures (A); access authorization, establishment and modification (A) | Access provisioning to role; terminated users disabled within policy; periodic access reviews with evidence |
| Administrative | Security awareness and training | Reminders, malware protection, log-in monitoring, password management (all A) | Training completion rates; phishing test results; content currency |
| Administrative | Security incident procedures | Response and reporting (R) | Incident log; response tests; link to breach assessment |
| Administrative | Contingency plan | Data backup (R); disaster recovery (R); emergency mode operation (R); testing and revision (A); applications and data criticality analysis (A) | Backup success and restore tests; recovery exercises; criticality analysis current |
| Administrative | Evaluation; business associate contracts | Periodic technical and non-technical evaluation (R); written contracts (R) | Evaluation performed after environmental changes; BAA inventory complete |
| Physical (164.310) | Facility access controls; workstation use and security; device and media controls | Contingency operations, facility security plan, access control and validation, maintenance records (A); workstation policies (R); disposal and media re-use (R); accountability and backup before movement (A) | Data center and records room access; workstation positioning and locking; media sanitization certificates; device inventory and tracking |
| Technical (164.312) | Access control | Unique user identification (R); emergency access procedure (R); automatic logoff (A); encryption and decryption (A) | Shared accounts; break-the-glass procedures and review; session timeouts; encryption of devices and databases confirmed by inventory, not policy |
| Technical | Audit controls | Mechanisms to record and examine activity (R) | Logging enabled on ePHI systems; logs reviewed; access to records of VIP patients and employees’ own records monitored |
| Technical | Integrity; authentication; transmission security | Mechanism to authenticate ePHI (A); person or entity authentication (R); integrity controls and encryption in transit (A) | Multifactor authentication coverage; email and file transfer encryption; interface security |
The Breach Notification Rule
A breach is an impermissible acquisition, access, use or disclosure of unsecured PHI (PHI not rendered unusable through encryption or destruction per HHS guidance) that compromises its security or privacy. Since 2013 an impermissible use or disclosure is presumed to be a breach unless the entity demonstrates a low probability that the PHI has been compromised through a documented four-factor risk assessment: the nature and extent of the PHI involved (identifiers, likelihood of re-identification), the unauthorized person who used or received it, whether it was actually acquired or viewed, and the extent to which the risk has been mitigated. Three exceptions cover certain unintentional workforce access, inadvertent disclosures between authorized persons, and recipients who could not reasonably have retained the information. The clocks run from discovery (the first day the breach is known, or by reasonable diligence would have been known, to anyone in the entity other than the person who committed it): individuals must be notified without unreasonable delay and within 60 days; HHS must be notified within 60 days for breaches affecting 500 or more individuals and within 60 days after the end of the calendar year for smaller ones through an annual log; prominent media must be notified for breaches affecting more than 500 residents of a state or jurisdiction; and business associates must notify the covered entity within 60 days (contracts usually require far less). State breach laws run their own, often shorter, clocks. The audit tests the incident-to-breach assessment process (every security incident and privacy complaint evaluated against the presumption, with four-factor documentation where notification was not made), the notification timeliness for breaches in the period, the content of notifications, the annual log, the encryption status that determines whether lost devices were breaches at all, and the business associate notification terms and performance. The incident response audit guide covers the response capability the rule depends on.
Business associates
Business associates are directly liable under the Security Rule and parts of the Privacy Rule, and covered entities must have a business associate agreement with each one that establishes permitted uses, requires safeguards, requires breach reporting, flows the obligations down to subcontractors, and provides for return or destruction of PHI at termination. The audit’s first test is the inventory: a reconciliation of the vendor master and the contracts database to the list of vendors that receive PHI (identified from data flows, accounts payable categories, system interfaces and interviews), which routinely finds vendors with PHI and no agreement (the imaging service, the transcription contractor, the analytics startup the research department engaged) and agreements with vendors that no longer receive PHI. The second test is substance: whether the organization assesses business associates’ security proportionately to the PHI they hold (a cloud EHR host and a shredding company need different diligence), whether assurance (SOC 2 reports, HITRUST certifications, questionnaires) is obtained and read, whether breach notification terms are shorter than the rule’s 60 days, and whether termination and data return are enforced. The 2024 Change Healthcare ransomware attack, which exposed the records of about 190 million people through a single business associate serving much of the US health system, made business associate concentration and resilience a board-level question; the third-party risk management program and fourth-party and vendor concentration guides cover the program, and the SOC 2 report review guide the assurance reading.
How OCR enforces and what the cases teach
OCR enforces through complaint investigations (it receives tens of thousands of complaints a year), compliance reviews triggered by breach reports (every breach of 500 or more individuals is investigated), and a periodic audit program, revived in 2025 with a third phase that began with 50 covered entities and business associates and focuses on the risk analysis and risk management requirements. Most investigations end in technical assistance or voluntary corrective action; the serious ones end in resolution agreements with monetary settlements and multi-year corrective action plans, or in civil monetary penalties imposed in four tiers according to culpability (from lack of knowledge to willful neglect not corrected), adjusted annually for inflation, with the top tier’s annual cap per provision exceeding $2 million. State attorneys general may also enforce. Breach reporting has risen every year: the OCR breach portal listed a record 772 large breaches in 2025, hacking and ransomware the dominant cause and business associates an increasing share. The lessons of the enforcement record are consistent enough to be a checklist, and the table gives them.
| Pattern in OCR enforcement | What went wrong | What the audit tests |
|---|---|---|
| No enterprise-wide risk analysis | Risk analysis covered the EHR only, or was a vendor’s security scan, or was years old; cited in the majority of settlements following breaches | Scope of the risk analysis against the ePHI inventory; currency; the risk management plan that followed |
| Right of access failures | Requests unanswered for months; fees above cost; records withheld; more than fifty settlements since 2019 | End-to-end sample of access requests with dates and fees |
| Unreviewed access and snooping | Workforce members viewed records of celebrities, colleagues or family for years without detection | Audit log monitoring, including same-name and VIP flags; access reviews |
| Unencrypted devices | Lost or stolen laptops and drives with ePHI, unencrypted, becoming reportable breaches | Device inventory with encryption status confirmed by tooling |
| Business associates without agreements | PHI shared with vendors under no agreement, or breached at vendors never assessed | BAA inventory reconciliation; vendor assessment evidence |
| Late or absent breach notification | Discovery dates misjudged; notification after 60 days; media notice omitted | Breach log with discovery, assessment and notification dates |
| Improper disposal | Paper records in dumpsters; devices resold with data | Media sanitization and disposal evidence |
| Ransomware without contingency | Backups encrypted with production; restoration took weeks; care disrupted | Backup isolation and restore tests; emergency mode procedures exercised |
| Online tracking technologies | Pixels and analytics on patient portals and scheduling pages disclosing PHI to vendors (an area of OCR guidance that has been litigated) | Web property inventory of third-party scripts on authenticated pages; legal review |
What changed in 2025 and 2026
Four developments change what an auditor measures against. First, the Security Rule proposal: HHS published a notice of proposed rulemaking in the Federal Register on 6 January 2025 (announced in late December 2024) that would make the first substantive revision of the Security Rule since 2013. Its main proposals: remove the distinction between required and addressable specifications so that all become required with limited exceptions; require a written technology asset inventory and network map showing ePHI flows, updated annually; require multifactor authentication for access to ePHI systems; require encryption of ePHI at rest and in transit, with limited exceptions; require network segmentation, anti-malware, and removal of unnecessary software; require vulnerability scanning at least every six months and penetration testing at least annually; require restoration of critical systems within 72 hours and a written analysis of system criticality; require an annual compliance audit against the rule’s requirements; and require covered entities to obtain annual written verification from business associates that their safeguards are in place. Comments closed in March 2025, the rule had not been finalized at the time of writing, and the government’s regulatory agenda now projects a final rule in 2027; the proposals nonetheless describe the control baseline OCR, insurers and plaintiffs’ counsel already treat as reasonable, and a prudent audit tests against them while reporting the rule’s status accurately. Second, the reproductive health care privacy rule of 2024, which had required attestations before certain disclosures, was vacated nationwide by a federal court in June 2025, so its attestation and definition requirements no longer apply. Third, the revised 42 CFR Part 2 rule aligning substance use disorder treatment records with HIPAA (published February 2024) reached its compliance date on 16 February 2026, changing consent, redisclosure and breach notification for Part 2 programs. Fourth, OCR’s audit program resumed in 2025 with the risk analysis as its focus, and HHS continued to signal a Privacy Rule update (proposed in December 2020, with changes to the access timeline among its contents) without finalizing it. The NIST CSF 2.0 assessment guide gives the control framework many health systems use to organize against both the current rule and the proposal.
| Area | Current Security Rule | January 2025 proposal (not final) | Audit stance |
|---|---|---|---|
| Required vs addressable | Addressable specifications may be met by documented alternatives | All specifications required with limited exceptions | Test addressable decisions for documentation now; flag those the proposal would make mandatory |
| Asset inventory and network map | Implied by the risk analysis | Written inventory and ePHI flow map, annual update | Test the ePHI inventory’s completeness as the risk analysis’s foundation |
| Multifactor authentication | Not specified (authentication required) | Required for ePHI systems with limited exceptions | Measure MFA coverage; report gaps as risk findings |
| Encryption | Addressable at rest and in transit | Required at rest and in transit with exceptions | Confirm encryption by inventory and tooling, not policy |
| Vulnerability management | Within the evaluation standard | Scans every six months; penetration test annually | Test the vulnerability program’s cadence and remediation |
| Contingency | Backup, DR and emergency mode required; testing addressable | 72-hour restoration of critical systems; criticality analysis; testing required | Test restore times against 72 hours as a benchmark |
| Compliance audit | Periodic evaluation required | Annual compliance audit | Internal audit’s HIPAA engagement cadence |
| Business associates | Agreements; reasonable assurance | Annual written verification of safeguards | Test the assurance process now |
The audit program by area
| Area | Tests | Evidence | Finding that recurs |
|---|---|---|---|
| Governance and scope | Privacy and security officials designated with authority; covered components defined; ePHI inventory of systems, devices, locations and vendors complete (reconcile to the application inventory, device management, data flows and accounts payable); policies current and approved | Designations, inventory, reconciliations, policy register | ePHI inventory covers major systems only; departmental applications and research data missing |
| Risk analysis and risk management | Risk analysis covers every ePHI asset, assesses threats and vulnerabilities, rates risk, is updated after changes; risk management plan with owners and dates; residual risk accepted at the right level | Risk analysis, plan, acceptance records | Analysis scoped to the EHR; plan undated; risks “accepted” by the security team |
| Privacy: uses, disclosures and minimum necessary | Role-based access aligned to minimum necessary; authorizations valid for marketing, sale and research uses; accounting of disclosures capability; Notice of Privacy Practices current and acknowledged | Role matrix, authorization samples, disclosure logs, Notice | Roles grant broad clinical access to non-clinical staff |
| Patient rights | Access requests fulfilled within 30 days (sample of 40 to 60 across request channels), in requested format, at cost-based fees; amendment and restriction requests handled; complaint log and resolutions | Request log with dates, fee schedule, complaint log | Requests through portals and release-of-information vendors untracked; turnaround beyond 30 days |
| Workforce | Training at hire and annually with completion evidence; sanctions applied consistently; terminations disable access within policy; background checks for PHI roles | LMS records, sanction log, termination samples against access logs | Contractors and students untrained; terminated users active for weeks |
| Access control and monitoring | Unique IDs; MFA coverage; break-the-glass reviewed; periodic access reviews with evidence of removals; audit logs enabled and monitored with same-name, VIP and employee-patient flags; privileged access governed | Identity system reports, log monitoring alerts and dispositions, review evidence | Logs collected and never reviewed; shared clinical workstation accounts |
| Encryption and devices | Inventory of laptops, mobile devices, removable media and biomedical devices with encryption status from tooling; email and file transfer encryption; media sanitization | MDM and encryption reports, disposal certificates | Encryption assumed from policy; 5 to 15 percent of devices unconfirmed |
| Physical safeguards | Facility and data center access; paper record storage; workstation security in clinical areas; disposal bins | Site observations, access logs | Records rooms left open; screens visible to the public |
| Contingency and resilience | Backups isolated and tested by restore; disaster recovery and emergency mode procedures exercised; criticality analysis; restore times against the 72-hour benchmark | Backup reports, restore tests, exercise records | Backups on the same network as production; last full restore test years ago |
| Incident and breach management | Incidents evaluated against the breach presumption with four-factor documentation; notifications timely and complete; annual log filed; state law clocks met; business associate notifications received and acted on | Incident and breach logs, assessments, notification letters, HHS portal submissions | Discovery date set at the end of the investigation rather than its start |
| Business associates | BAA inventory reconciled to vendors with PHI; agreements current with required terms; assessments proportionate to risk; assurance reviewed; termination handled | Inventory reconciliation, agreements, assessment files | Vendors with PHI and no agreement; assurance collected and unread |
| Web and tracking technologies | Third-party scripts on authenticated and health-related pages inventoried and assessed with legal | Script inventory, legal review | Analytics pixels on the patient portal login page |
Internal audit, compliance and the privacy and security officers
Healthcare organizations have a compliance function that HHS’s Office of Inspector General expects (its General Compliance Program Guidance of November 2023 describes it), a privacy officer the Privacy Rule requires and a security officer the Security Rule requires, and internal audit’s HIPAA engagement must be designed around them rather than duplicating them. The privacy and security officers own the program and its first-line controls; compliance monitors and tests on a schedule and investigates complaints; internal audit provides independent assurance over all three, testing whether the program they run exists in practice, and relies on compliance’s testing where it has assessed that testing’s reliability, as Standard 9.5 requires and the assurance mapping guide describes. The division that works: internal audit audits the HIPAA program at the enterprise level every two to three years (scope and inventory, risk analysis, governance, business associates, breach process) with deeper technical testing co-sourced where needed, audits specific high-risk areas in between (access monitoring, device encryption, release of information), and reports to the audit committee, while the compliance committee receives the compliance function’s monitoring. The internal audit vs SOX vs compliance vs ERM guide covers the general division and the compliance risk assessment guide the assessment the compliance function should be running.
A worked example: Ashgrove Health System’s enterprise HIPAA audit
Ashgrove Health System, the nonprofit hospital system used in the healthcare examples on this site, operates five hospitals and about 190 clinics with $2.1 billion of revenue and 14,000 employees; its chief compliance officer reports to the board’s compliance and audit committee, it has a privacy officer in compliance and a chief information security officer in IT, and its twelve-person internal audit function reports to the same committee. After a lost laptop became a reportable breach of 3,400 patients’ records in 2025, the committee asked for an enterprise HIPAA audit in the FY26 plan: 520 hours, with 120 hours of co-sourced technical testing, criteria being the Privacy, Security and Breach Notification Rules as in force, the organization’s policies, and the January 2025 Security Rule proposal as a benchmark reported separately.
| Area | What the audit found | Rating and action |
|---|---|---|
| ePHI inventory and risk analysis | The 2024 risk analysis, performed by a consulting firm, covered 41 applications; reconciliation to the application inventory, device management and accounts payable identified 68 applications and services holding ePHI, plus 2,100 biomedical devices on the network that no analysis had covered; the risk management plan listed 23 items, 9 past due with no owner | High; enterprise-wide risk analysis re-performed over two quarters with the biomedical device inventory; plan re-based with owners; quarterly reporting to the committee |
| Right of access | Sample of 60 requests across the portal, the release-of-information vendor and the clinics: 44 fulfilled within 30 days; 9 between 31 and 45 days; 7 untracked because clinic requests were logged locally; fees within the schedule; two requests for electronic copies fulfilled on paper | High; single request log across channels; clinic intake routed to the central team; 30-day tracking with escalation at day 20 |
| Access monitoring | EHR audit logs collected; the monitoring tool’s same-name and VIP rules were active but 61 percent of alerts from the prior year remained open; one employee had viewed a colleague’s record 14 times without detection until a complaint | High; alert triage staffed and measured; sanctions applied; monthly metrics to compliance |
| Encryption and devices | Policy required full-disk encryption; the management tool confirmed encryption on 91 percent of 9,400 laptops and workstations; 9 percent were unconfirmed (offline devices, legacy images); the lost laptop had been among them | High; unconfirmed devices located or wiped within the quarter; encryption status reported monthly |
| Business associates | 1,140 business associate agreements on file; the reconciliation identified 1,460 vendors receiving PHI, 320 without an agreement (imaging, transcription, two research collaborators, dozens of small clinic vendors); of 48 high-risk associates, 19 had assurance reports on file and 11 of those had been reviewed | High; agreements executed or PHI flows stopped over six months; tiered assessment program adopted |
| Breach assessment | Breach log complete for the period; four-factor assessments documented for 31 incidents not notified; one incident’s discovery date had been set at the investigation’s conclusion, 19 days after the first report, which had not caused a late notification but would have under a longer investigation | Medium; discovery date defined in the procedure as the first report |
| Contingency | Backups isolated in an immutable repository since 2024; EHR restore tested at 31 hours against a 72-hour internal target and the proposal’s benchmark; two departmental systems holding ePHI had never been restore-tested | Medium; restore testing extended to all ePHI systems on a schedule |
| Training and sanctions | Training completion 96 percent for employees, 71 percent for contractors and students; sanction policy applied in 12 of 14 substantiated privacy violations in the period | Medium; contractor and student training enforced through access provisioning |
| Web tracking | Two analytics scripts active on the patient portal’s authenticated pages, transmitting page URLs that identified appointment types; legal had not reviewed them | Medium; scripts removed from authenticated pages; legal review process for web properties |
| Multifactor authentication (proposal benchmark) | MFA on remote access and email; not on 14 internal ePHI applications | Reported as a benchmark gap rather than a rule finding; roadmap item |
The report rated the program Needs Improvement with five High findings and a roadmap for the proposal’s benchmarks, and the committee’s first question was the one OCR would have asked: how a risk analysis could have covered 60 percent of the systems holding patient data. The answer, that the consulting firm had analyzed the systems IT listed and nobody had reconciled that list to what the organization actually used, became the audit’s first recommendation, and the re-performed analysis found the biomedical devices, the research collaborators and the imaging vendor that the original had not. When OCR’s compliance review of the laptop breach concluded the following year with technical assistance rather than a settlement, the chief compliance officer attributed the outcome to the corrective actions the audit had put in motion before the regulator asked. The internal audit in healthcare guide tells the rest of Ashgrove’s story and the third-party risk management guide the program the business associate findings led to.
Questions about HIPAA audits
What does a HIPAA compliance audit cover?
Governance and the inventory of protected health information; the Security Rule’s risk analysis and administrative, physical and technical safeguards; the Privacy Rule’s uses, disclosures, minimum necessary standard and patient rights (especially the right of access); the Breach Notification Rule’s assessment and clocks; business associate agreements and oversight; training and sanctions; and, increasingly, web tracking technologies.
What is the most common HIPAA finding?
A risk analysis that does not cover every system, device and vendor holding electronic protected health information, or that has not been updated. It is the failure cited most often in OCR settlements and the focus of OCR’s 2025 audit program, and the fix starts with reconciling the ePHI inventory to the application inventory, device management and accounts payable.
What are the HIPAA breach notification deadlines?
Individuals within 60 days of discovery; HHS within 60 days for breaches affecting 500 or more people (and within 60 days after year-end for smaller breaches); prominent media for breaches affecting more than 500 residents of a state; business associates to covered entities within 60 days (contracts usually require less). Discovery is the first day anyone in the organization knew or should have known, not the end of the investigation.
Has the HIPAA Security Rule changed?
Not yet. HHS proposed a major revision in January 2025 (mandatory multifactor authentication and encryption, an asset inventory and network map, vulnerability scans and penetration tests, 72-hour restoration, annual compliance audits, business associate verification), comments closed in March 2025, and the rule had not been finalized at the time of writing, with the regulatory agenda projecting 2027. Auditors test the current rule and report the proposal’s benchmarks separately.
What is a business associate agreement?
The contract HIPAA requires between a covered entity and each vendor that creates, receives, maintains or transmits protected health information on its behalf, establishing permitted uses, safeguards, breach reporting, subcontractor flow-down and return or destruction of the information. The audit reconciles the agreements on file to the vendors that actually hold PHI.
How does internal audit work with the compliance and privacy functions on HIPAA?
The privacy and security officers own the program, compliance monitors and investigates, and internal audit provides independent assurance over all of them, relying on compliance’s testing only after assessing its reliability. Internal audit audits the enterprise program every two to three years and high-risk areas in between, reporting to the audit committee.
Related guides
- Internal audit in healthcare — the wider environment and Ashgrove’s universe.
- Data privacy audit — the general privacy program HIPAA sits inside.
- Auditing cybersecurity programs — the security testing the Security Rule draws on.
- NIST CSF 2.0 assessment method — organizing controls against the rule and the proposal.
- Incident response audit — the response capability behind breach notification.
- Backup and recovery audit — the contingency plan’s core.
- User access review — the access reviews the rule expects.
- Privileged access audit — administrators of ePHI systems.
- Third-party risk management program — business associates as a program.
- Fourth-party risk and vendor concentration — the Change Healthcare lesson.
- SOC 2 report review — reading business associates’ assurance.
- Compliance risk assessment — the compliance function’s assessment.
- Internal audit vs SOX vs compliance vs ERM — the division of roles.
- Assurance mapping — relying on compliance’s testing.
- Hospital revenue cycle controls — the other healthcare audit staple.
Leave a Reply