A HIPAA program is stronger when the practice can show current, organized evidence. Documents should prove what was reviewed, what controls exist, who owns them, and what remediation remains.
Audit readiness is not the size of a folder. It is the ability to retrieve a reliable record, connect it to a requirement or risk decision, distinguish intended design from actual operation, and explain exceptions or incomplete work.
Index evidence to a safeguard, policy statement, risk, corrective action, contract duty, incident decision, or management objective. Avoid a folder structure made only of vendor names and years; it forces the reviewer to infer relevance.
Record owner, reviewer, approver, system source, collection date, covered period, and version. A screenshot with no account context or date is weak. A policy without approval or effective date may not prove management adoption.
A policy, diagram, configuration standard, and contract describe design. A user review, log sample, restore test, training completion, alert ticket, terminated-account record, and incident exercise show operation. Mature evidence sets contain both and explain differences.
Test whether an authorized person can locate the current version, open it without a departed employee’s account, understand the scope, trace the decision, and identify follow-up actions. Protect the evidence repository itself with appropriate access, retention, backup, and logging.
Record gaps, the risk created by the gap, interim safeguards, responsible owner, due date, and validation method. A transparent remediation record is more defensible than relabeling incomplete evidence as complete.
Ask a reviewer who did not build the repository to retrieve the current risk analysis, latest access review, a terminated-user example, last restore test, current vendor list and BAAs, training completion, one incident decision, and the remediation register. Track missing items, wrong versions, access failures, and interpretation questions.
Can the organization identify the source system, author or collector, date, covered period, and method? Preserve native exports or system records when practical rather than relying only on pasted screenshots.
Does the evidence cover the relevant location, workforce, system, vendor, data, account population, and time period? A successful backup report for one server does not prove recovery of the complete clinical workflow.
Is the record current for the environment and requirement? Note material changes after collection. Retain historical evidence when it explains the state at the time of an incident, assessment, or management decision.
Include exceptions, failures, unresolved items, exclusions, and follow-up. A user review showing only approved accounts but omitting the source population cannot prove that every account was evaluated.
Connect evidence to requirement, policy, risk, control owner, corrective action, and approval. Use stable identifiers so a finding can be followed from discovery through remediation, validation, and residual-risk acceptance.
The evidence repository may contain sensitive configurations, vulnerabilities, incident details, employee information, and PHI. Apply appropriate access, encryption, backup, retention, legal hold, secure sharing, logging, and disposal.
Include a new hire, role change, urgent termination, failed backup, restored system, policy exception, vendor incident, misdirected message, privileged account, inactive user, unsupported device, and overdue remediation. These samples show whether governance works when the process is stressed.
Collect HIPAA security officer assignment, privacy officer assignment, leadership approval, policy review records, risk acceptance notes, sanctions documentation, training completion reports, incident-response roles, and remediation ownership.
Leadership evidence matters because HIPAA compliance is not only an IT task. Budget, staffing, vendor decisions, and risk acceptance require executive oversight.
Collect asset inventory, PHI inventory, network diagram, firewall configuration summary, Microsoft 365 security settings, MFA evidence, endpoint encryption proof, EDR or antivirus status, vulnerability scan results, backup job history, restore-test evidence, audit-log review notes, admin account review, and remote-access review.
For dental and medical practices, include imaging systems, EHR or dental software, lab portals, scanners, fax systems, and cloud storage.
Collect Business Associate Agreements, vendor contact list, vendor remote-access methods, cloud service documentation, backup vendor details, EHR vendor security documentation, shredding certificates, support access logs where available, and incident notification commitments.
A vendor list without BAA status and access review is incomplete. The practice should know which vendors can access PHI and how that access is controlled.
Collect incident-response plan, breach-risk assessment process, cyber insurance contacts, legal contacts, forensic escalation process, patient notification template, media/regulator decision process, backup restoration procedure, and tabletop exercise notes.
This tool is for initial guidance only and does not replace a professional cybersecurity audit, compliance assessment, penetration test, or legal/compliance review.
Use this scrollable worksheet as a starting structure for PHI mapping. It is not a substitute for a full assessment, but it helps teams collect the right evidence.
| Area | PHI or ePHI Risk | Evidence to Review |
|---|---|---|
| Practice management / EHR | Charts, demographics, insurance, treatment, billing | Users, roles, MFA, audit logs, backup scope, BAA |
| Imaging / X-ray / scanner | Images, scans, referrals, exports | Local folders, exports, retention, workstation encryption |
| Email and cloud storage | Attachments, referrals, patient communication | Sharing controls, MFA, retention, DLP, training |
| Billing and clearinghouse | Claims, insurance, payment records | BAA, access, transmission security, reports |
| Backups | Databases, file shares, images, mailboxes | Restore tests, isolation, encryption, retention |
| Remote access | Vendor support paths, admin access | MFA, approval, logging, termination |
| Workstations and laptops | Cached reports, downloads, scans | Encryption, EDR, patching, timeout, disposal |
| Paper and scanned records | Intake, consents, insurance cards | Scanning workflow, disposal, storage, retention |
Dated and attributable records tied to a defined control: exported configuration, system-generated log, approved ticket, signed review, restore-test result, training completion, executed BAA, incident timeline, or management decision with scope and exceptions.
Undated screenshots, blank templates, vendor brochures, statements without proof, policies that do not match configuration, incomplete user lists, successful backup alerts without restoration, and spreadsheets with no owner or review history.
Use a controlled index with requirement, control, system, owner, evidence description, period covered, collection date, reviewer, exception, remediation link, and retention date. Restrict access because the evidence room may itself contain sensitive security information or PHI. Preserve chain of custody for incident evidence and avoid collecting more patient data than the review needs.
Use the Security Rule and implementation guidance to define the record; legal and contractual requirements may add retention or production duties.
HHS describes documentation expectations alongside administrative, physical, and technical safeguards. Review current Security Rule guidance
OCR’s enforcement information shows the continuing importance of risk analysis, safeguards, and corrective action. Review enforcement highlights
The security risk analysis is one of the most important documents because it identifies threats, vulnerabilities, likelihood, impact, and remediation priorities for ePHI.
Screenshots can help, but they should be dated, organized, and tied to a control, owner, and review record.
Yes. OC Security Audit can help identify missing evidence, structure an audit-ready evidence map, and prioritize remediation.
OC Security Audit can grade evidence reliability, identify missing operating records, organize a defensible repository, and tie remediation to accountable owners and validation.
IT Perfection can help produce and maintain technical operating evidence for identities, Microsoft 365, endpoints, backup, servers, networks, monitoring, patching, and support processes.