How to Prepare for a HIPAA Audit: A Step-by-Step Guide for Clinics

A HIPAA audit from the HHS Office for Civil Rights (OCR) can arrive in two ways: as a proactive audit selected by OCR, or as an investigation triggered by a complaint or reported breach. Either way, being unprepared is not an option.

What OCR Looks for in a HIPAA Audit

OCR audit protocols are published publicly. Auditors evaluate compliance in three primary areas: Privacy Rule compliance, Security Rule compliance, and Breach Notification Rule compliance.

Step 1: Complete Your Security Risk Analysis

The Security Risk Analysis (SRA) is the single most commonly cited deficiency in HIPAA enforcement actions. It is a required annual activity — not optional. An SRA must identify all systems where ePHI lives, assess threats and vulnerabilities, evaluate current controls, assign risk levels, and produce a Risk Management Plan.

Step 2: Audit Your Policy Library

• Information Access Management Policy
• Workforce Security Policy
• Security Incident Response Policy
• Contingency Plan (backup, disaster recovery, emergency access)
• Device and Media Controls Policy
• Workstation Use and Security Policy
• Sanction Policy for HIPAA violations
• Breach Notification Procedures
• Patient Rights Procedures

Step 3: Pull Your Training Records

Training documentation is one of the first things OCR requests. You must be able to produce, for every workforce member: the date they completed HIPAA training, what it covered, and their signature or acknowledgment.

Step 4: Audit Your BAA Inventory

Pull a list of every vendor with any access to PHI. For each one, verify that a signed BAA is on file and current. Common BAA gaps: EHR vendor, answering services, billing companies, IT managed services providers, and cloud storage providers.

Step 5: Organize Your Evidence Package

1. Most recent Security Risk Analysis with date
2. Current Risk Management Plan
3. Policy and procedure library with version dates
4. Training records for all workforce members
5. BAA inventory with copies of all executed BAAs
6. Breach log
7. Incident response records
8. List of designated Privacy and Security Officers

If You Receive an OCR Audit Notice

Do not respond without involving legal counsel experienced in HIPAA enforcement. Engage a healthcare attorney immediately. Compile your evidence package. Cooperate fully — but with counsel guiding every step of your response.