A HIPAA security audit checklist for a small medical practice should do more than collect policy documents. A reviewer may also want evidence that the practice has identified risks to electronic protected health information (ePHI), acted on those risks, and followed its own procedures.
Use this checklist to organize your records before a review. The exact requests can vary, so treat it as a preparation guide, not a substitute for advice about your practice’s specific obligations. Keep documents current, easy to locate, and consistent with the way your team actually works.
Start with the risk analysis and its follow-through
The security risk analysis is a useful organizing document because it connects your practice’s systems and workflows to the safeguards you choose. It should cover ePHI the practice creates, receives, maintains, or transmits, rather than focusing only on the electronic health record. Consider where information is stored, how staff access it, how it moves between systems, and which service providers may handle it.
Be prepared to show:
- A written risk analysis describing the scope, systems, information flows, identified risks, and how risks were assessed.
- A risk management record linking identified risks to mitigation steps, responsible owners, target dates, and current status.
- Evidence of follow-through, such as completed work records, configuration changes, updated procedures, or documented decisions about risks that remain open.
- Updates and evaluations showing that the practice revisits its security approach when systems, workflows, or risks change.
A list of risks without evidence of what happened next may not tell the full story. Keep a clear trail from finding to decision to action, including an explanation when work is still underway. Avoid describing a planned safeguard as completed if it has not been implemented.
Gather policies and proof that staff follow them
Written policies and procedures are important, but they are only part of the record. Pair each relevant policy with examples that show how it is applied. A practice may be asked to explain who is responsible for security, how workforce access is managed, and how staff learn the procedures that apply to their work.
Organize records for areas such as:
- Security responsibility: documentation identifying who oversees the practice’s security program and how responsibilities are assigned.
- Workforce security: procedures and records for granting, changing, and removing workforce access when roles or employment change.
- Security awareness: training materials, attendance or completion records, and any follow-up for staff who need additional instruction.
- Sanctions and reporting: procedures for addressing violations and records showing how security concerns are routed and handled.
Make sure the written process reflects what staff are expected to do in practice. If your procedures refer to a role, system, or workflow that has changed, update the document and retain appropriate records of the change.
Prepare access-control and activity-review evidence
Access records can help explain who is authorized to use systems containing ePHI and whether access remains appropriate. Keep records that show the basis for granting access, relevant approvals, role or permission changes, and removal of access when it is no longer needed. A current user list can be useful, but it is stronger when paired with information about how the practice checked and acted on it.
Also organize records of system activity reviews. Depending on your environment, supporting evidence may include review notes, alerts, tickets, or documented follow-up on unusual activity. Keep enough context to show what was reviewed, what required attention, and how the practice responded. Do not assume that collecting system logs alone demonstrates that anyone reviewed them.
Your access-control documentation should align with the systems and accounts staff actually use, including relevant remote access and services handled by business associates. If a vendor supports a system, clarify who is responsible for providing records and responding to identified concerns.
Keep incident records from discovery through resolution
Security incident procedures should explain how staff report suspected or confirmed incidents and how the practice responds. A useful incident log can capture when an issue was identified, what systems or information may be involved, who handled the response, what steps were taken, and the outcome. Include follow-up actions and their status so the record does not stop at the initial response.
Keep supporting records where appropriate, such as investigation notes, relevant alerts, response tickets, recovery actions, and documented decisions. An incident that did not result in a confirmed compromise may still warrant a record of what was reviewed and why the practice reached its conclusion. Handle sensitive investigation material carefully and limit access to people with a business need.
For a practical overview of response planning, see how to improve IT security incident response. The goal is to make your written process, staff actions, and retained records tell a consistent story.
Document backup, recovery, and continuity work
A contingency plan should be supported by records showing how the practice prepares to maintain or restore access to ePHI during a disruption. Gather the applicable plan documents and evidence that the procedures are tested, reviewed, and updated. The records may include:
- Data backup procedures and records showing that backup jobs are monitored and exceptions are addressed.
- Disaster recovery procedures describing how relevant systems and information are restored.
- Emergency mode procedures explaining how the practice can continue essential operations during a disruption.
- Test and revision records showing what was exercised, what issues were found, and what changes followed.
- Data and system prioritization that helps the practice identify what needs attention first during recovery.
A backup report by itself does not show that recovery will work. Keep records of restore tests or other recovery exercises, including problems found and corrective actions. Connect those records to business continuity planning so the practice can explain how patient-care operations and information needs are considered during disruption.
Include agreements and supporting records
Where outside providers create, receive, maintain, or transmit ePHI on the practice’s behalf, keep the relevant business associate documentation and records of how responsibilities are coordinated. Also gather supporting evidence that helps explain safeguards in use, such as security-related procedures, system changes, remediation tickets, and records of communications with service providers.
These supporting materials are not all the same kind of document, and not every record is a specifically named Security Rule document. Their value is that they can help show how the practice applies its policies and manages identified risks. Keep the distinction clear between formal policies, required documentation, and operational evidence.
When IT and security responsibilities are split among providers, make sure the practice can identify who owns each action and where records are kept. Zevonix describes an integrated approach in which security implications are considered during IT support work and infrastructure knowledge informs threat response. Learn more about its healthcare IT services.
Retention, scope, and keeping the checklist current
HIPAA Security Rule documentation must generally be retained for six years from its creation or the date it was last in effect, whichever is later. Apply a retention process to the relevant policies, procedures, and required documentation, and make sure records remain retrievable. Other obligations or organizational policies may affect how particular records are handled, so confirm your retention approach with an appropriate compliance professional.
A small practice can tailor safeguards to its size, complexity, capabilities, and risks; being small does not remove the need to meet applicable Security Rule requirements. Focus on whether your chosen safeguards address the practice’s actual environment, and document the reasoning behind decisions. Review the checklist when systems, staff responsibilities, vendors, or workflows change.
Proposed rule changes should not be treated as current requirements merely because they have been announced. Before changing your checklist, verify whether a particular proposal has been finalized and whether its effective date applies. Keep your working documents aligned with the requirements currently in effect.
Frequently asked questions
Does HIPAA require a written security risk analysis?
Yes. The Security Rule calls for a documented risk analysis. It should address ePHI across the practice’s relevant systems and workflows, not just the EHR.
What evidence shows that the practice addressed risks?
Keep a risk management record that connects each finding to an action, owner, target date, and status. Add evidence of completed work and document decisions about risks that remain open.
What access-review records might a reviewer request?
Be ready to explain how users receive and lose access, how permissions are checked for continued appropriateness, and how activity requiring follow-up is handled. Retain the review results and related actions.
What should a security incident log include?
Record when an incident was identified, the systems or information involved, the response steps, the outcome, and any follow-up actions. Keep supporting records consistent with your incident procedures.
Do small practices have the same requirements as larger organizations?
The Security Rule applies to small practices too, though safeguards can be tailored to the practice’s circumstances and risks. Size alone does not remove the obligation to address applicable requirements.
Make your records tell a clear story
An audit-ready file connects written procedures to real evidence: risks identified, access reviewed, incidents handled, and recovery plans exercised. Start with the risk analysis, assign owners to gaps, and keep supporting records together. If your practice needs help coordinating its IT and security documentation, you can explore Zevonix’s integrated IT security and support approach.