HIPAA audit preparation: what OCR asks for and how automated systems should answer

HHS says the Phase 2 HIPAA Audit Program reviews the policies and procedures that covered entities and business associates have adopted. It checks them against selected standards and implementation specifications of the Privacy, Security, and Breach Notification Rules. The protocol is organized by rule and regulatory provision and treats privacy, security, and breach notification separately. Audits assess selected requirements and can vary with the type of entity chosen (HHS audit protocol). HHS labels the protocol version we read as updated July 2018, so confirm OCR’s current audit activity before you plan around it.

The protocol’s general instructions set practical rules that shape how you should store evidence:

HHS’s Security Rule summary lists five technical safeguards (HHS Security Rule summary). Access control means only authorized persons reach ePHI. Audit controls are mechanisms that record and examine activity in systems that contain or use ePHI. Integrity means ePHI is not improperly altered or destroyed. Authentication verifies that a person seeking access is who they claim to be. Transmission security guards ePHI sent over a network.

The summary also says an “addressable” implementation specification is not optional. An entity must adopt it where it is reasonable and appropriate. HHS’s page notes that OCR has proposed modifications to the Security Rule. The summary describes the rule currently in effect, so check the current status before you rely on it.

In our reading, a bot or integration that uses ePHI falls under the audit-control safeguard, so its logs are the evidence.

These practices follow from the protocol’s instructions. Each one makes a specific request easy to answer.

Keep one document per topic. Because the auditor wants only the specified document, write the access policy, the logging policy, and the incident procedure as separate files. A single binder forces you to guess which page the request meant.

Version everything with dates. A request covers the version in use on the notification date, so keep prior versions and the date each took effect.

Keep a register of automated systems. For each one, record the PHI it touches, its owner, the BAA on file, and its subcontractors. The register answers the business associate questions in one place.

Log who, what, and when. Record each access and action with an identity and a timestamp, and keep the logs for the period your policy sets. Keep PHI out of the log text so the log itself carries less risk.

Save evidence of implementation. The protocol asks for samples that show a policy operates. Record recurring activities, such as a quarterly access review, with a dated output you can hand over.

Keep the BAA available for review. HHS says the business associate contract must make the vendor’s internal practices, books, and records available to HHS.

We write these artifacts during the engagement so they exist before an auditor asks: data flow diagrams, a PHI inventory, the access model, and a subprocessor register. The full list is on our HIPAA and compliance page, and we run monitoring and quarterly reviews under managed automation. Our BAA guide covers the contract side.