Oct 26, 2026

HIPAA Compliance Checklist: Steps to Stay Audit-Ready

If you handle protected health information, HIPAA requires you to safeguard it. HHS's Office for Civil Rights (OCR) enforces that requirement with real financial consequences. For instance, it settled with Montefiore Medical Center for $4.75 million in February 2024 over a malicious-insider cybersecurity investigation. It settled with Solara Medical Supplies for $3 million in January 2025 over a phishing attack. Weeks later, it settled with Warby Parker for $1.5 million over a separate hacking case.

Audit-readiness means catching these kinds of gaps before OCR does. This HIPAA compliance audit checklist covers the three required safeguards, the six required audits, and the documentation habits your program needs, along with how Effivity's compliance software supports each step.

HIPAA Compliance Rests on Three Required Safeguards

HIPAA's Security Rule organizes every protection you need into three safeguard categories. The table here breaks down what each one actually covers.

Safeguard	What It Covers	Examples
Administrative	The policies and procedures that govern how you manage PHI security	Risk assessments, workforce training, incident response plans, BAAs
Physical	Protection for the facilities and hardware that house ePHI	Restricted data center access, workstation security, device disposal procedures
Technical	The technologies that protect ePHI directly	Encryption, multi-factor authentication, audit logging, automatic session logoff

You need documented measures in all three categories to be considered compliant. A strong technical setup doesn't make up for missing administrative policies, and neither substitutes for physical access controls.

An Annual Risk Assessment Is the Most Cited Reason for OCR Fines

You need to run a Security Risk Assessment at least annually, and again after any significant change to your systems or workforce. Failing to conduct and document one is the single most common gap OCR cites in enforcement actions. A risk assessment alone doesn't satisfy HIPAA, though. You need to complete six separate audits to be genuinely audit-ready:

An Annual Risk Assessment Is the Most Cited Reason for OCR Fines

Security Risk Assessment identifies risks to the confidentiality, integrity, and availability of ePHI.
Privacy Standards Audit checks whether you comply with the Privacy Rule.
HITECH Subtitle D Privacy Audit reviews privacy requirements related to electronic health records.
Security Standards Audit checks whether the required Security Rule safeguards are in place.
Asset and Device Audit identifies all devices and media that store or access ePHI.
Physical Site Audit checks physical security and access controls at facilities where ePHI is stored or accessed.

For each audit, you need to document the threats identified, your current controls, the likelihood and impact of each risk, and your remediation plan.

Every Vendor Touching PHI Needs a Signed Business Associate Agreement

You must have a signed Business Associate Agreement with any vendor that handles PHI on your behalf. This includes cloud providers, billing services, EHR vendors, IT support, and shredding companies.

A vendor doesn't need direct access to patient records to qualify. Handling PHI in any capacity makes them a business associate. Your business associates must also have their own agreements with any subcontractors who touch that PHI. You're responsible for verifying these agreements exist. Review every BAA annually, and perform due diligence on each vendor's HIPAA compliance before you sign.

Your Breach Response Plan Has to Be Tested

A written security breach notification plan sitting in a drawer doesn't satisfy HIPAA. You need to notify affected individuals within 60 days of discovering a breach, and HHS within that same window if 500 or more people are affected. During an audit, OCR checks if you've actually tested your response process. Run through your plan at least annually so your team knows who investigates, who notifies, and who documents the outcome when a real incident happens.

Documentation Is What Actually Proves You're Audit-Ready

If you don't have documentation, you may not be able to prove it happened. Keep records of risk assessments, BAAs, privacy and security training, and incident responses. Auditors need evidence, not just verbal assurances. You must retain this documentation for a minimum of six years from the date it was created or last in effect, whichever is later. That includes security policies, risk assessments, training completion records, breach notifications, and disaster recovery plans. When OCR opens an investigation, you typically have a short window to produce this evidence. Waiting until that point to organize your records puts you behind before the review even starts.

HIPAA Compliance Checklist: Steps to Stay Audit-Ready

Work through these HIPAA compliance steps to build a compliance program that holds up under an actual OCR review.

HIPAA Compliance Checklist: Steps to Stay Audit-Ready

Have a designated Privacy Officer and Security Officer, even if both roles are held by the same person
Run your Security Risk Assessment annually, and again after any major system or staffing change
Complete all six required audits, SRA, Privacy Standards, HITECH Subtitle D, Security Standards, Asset and Device, and Physical Site
Identify every vendor that touches PHI and confirm a signed BAA exists for each one
Write and test your incident response plan against the 60-day breach notification clock
Train every workforce member on HIPAA policies annually, and document who completed it
Put basic security safeguards in place, including unique user IDs, MFA, encryption, and audit logs
Keep all risk assessments, BAAs, training records, and incident reports for at least six years

HIPAA Penalties Scale Across Four Culpability Tiers

OCR sets your penalty based on how culpable you were.

This table here breaks down the fine range for each tier.

Tier	Culpability	Fine Range Per Violation
Tier 1	You had no way of knowing about the violation	$141 – $35,581
Tier 2	Reasonable cause existed, but it wasn't willful neglect	$1,424 – $71,162
Tier 3	Willful neglect, corrected within 30 days	$14,232 – $71,162
Tier 4	Willful neglect, not corrected within 30 days	Up to $2,134,831

These figures are adjusted annually for inflation. State Attorneys General can pursue separate fines on top of OCR's penalties. Criminal violations involving personal gain or malicious intent can bring Department of Justice charges and fines up to $250,000.

Effivity's ISMS Keeps Your HIPAA Documentation Audit-Ready

Effivity's Information Security Management Software runs the six required HIPAA audits as a continuous cycle. Its Risk Management module keeps your Security Risk Assessment current year-round. Its Statement of Applicability maps which controls apply to which safeguard category, giving your Security Standards Audit a built-in reference point.

The Incident Management module helps track breach responses and the 60-day notification deadline. BAAs, training records, and audit results stay in one repository and are automatically retained for six years. This keeps your compliance evidence organized and ready for an OCR investigation.

For more information, visit Effivity’s website now!

Frequently Asked Questions

What triggers a HIPAA compliance audit?

OCR opens most investigations after a complaint, a reported breach, or a media report of a potential violation. HHS has run two rounds of proactive compliance audits in the past, though the program hasn't been continuous. A breach affecting 500 or more people almost always draws an OCR review, even when you handled the notification correctly.

How often should a risk assessment be performed?

Run your Security Risk Assessment at least once a year. Run one again after any major change. Like a new system, a staffing change, a vendor switch, or an incident. Treating it as a one-time task is the single most common gap OCR cites in enforcement actions.

What does "audit-ready" mean for a small practice specifically?

HIPAA compliance requirements apply to you the same way they apply to a hospital system, just scaled to your size and resources. Small practices aren't exempt from any of them. The documentation burden is proportionate, but the obligation itself isn't smaller.

Shanker

Co-Founder & CEO at Effivity Technologies Pvt. Ltd.

Shanker brings over 20+ years of tech experience, including senior roles at Intel. At Effivity, he built the IT team from Scratch, managed budgets, and improved the product based on customer feedback. Shanker's leadership keeps Effivity at the forefront of the tech industry.

View All Posts

Improve Workflow & Profitability with Superior Integrated Management System Software free-demo

Schedule a Free Demo