Quick answer: A medical office should be able to produce its current security risk analysis, risk management records, written policies, evidence that safeguards operate, access and training records, contingency and incident documentation, and business associate agreements where required. It also needs records relevant to the Privacy and Breach Notification Rules. The exact request depends on the scope of the audit or review. A folder of policies alone cannot show that the practice follows them. 

If someone asks your practice to show how it protects patient information, could you find the evidence without asking three vendors and searching a shared drive named “Compliance Final FINAL”? 

That is a useful way to think about audit readiness. The practice needs to know where protected health information lives, who can access it, what safeguards it chose, and how it checks that they work. The HHS Office for Civil Rights (OCR) audit program can examine selected requirements under the HIPAA Privacy, Security, and Breach Notification Rules. An audit request has a defined scope; there is no single packet that answers every possible request. 

Here is what a medical office should be ready to find and explain. 

The HIPAA Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to electronic protected health information, or ePHI. That means looking across the systems and vendors that create, receive, maintain, or transmit it. The analysis should consider threats, existing safeguards, and the possible effect on the confidentiality, integrity, and availability of the information. HHS calls risk analysis foundational. 

Keep the analysis alongside the decisions it prompted. Which risks will the practice reduce first? Who owns the work? What has been completed, and which exceptions remain? Update the analysis when changes to systems, vendors, locations, or operations affect ePHI. HIPAA does not prescribe one risk analysis template or a universal annual completion date. 

The practice should be able to locate its security and privacy policies and show who maintains them. For the Security Rule, that may include access authorization, workstation use, device and media handling, incident response, and contingency procedures. Privacy documentation may cover uses and disclosures, patient rights, complaints, and workforce responsibilities. 

Check the policy against the actual workflow. If it says managers approve access changes, can you show a recent approval and removal? If it describes a recovery process, do the people named in it still work there? HHS requires periodic review and updates to Security Rule documentation when relevant circumstances change. Required Security Rule documentation generally must be retained for six years after its creation or last effective date, whichever is later. 

Start with the electronic health record (EHR), email, billing platform, file storage, remote access, and any other system that contains or can reach ePHI. The practice should know who approves access, what each role needs, how accounts are created and removed, and how privileged and vendor accounts are controlled. 

Evidence may include account lists, access approval records, offboarding tickets, audit log settings, and records of periodic access reviews. HHS requires access control, audit controls, and authentication under the Security Rule. Other protections, such as multi-factor authentication, endpoint protection, and encryption, deserve evaluation in light of the practice’s risks. Do not describe every product on that list as a separate, universally mandated HIPAA setting. The rule is technology neutral, and some implementation specifications require a documented assessment of whether a measure is reasonable and appropriate. See HHS’s Security Rule summary. 

Your IT provider can explain how the configured controls work and provide records from systems it manages. Practice leadership owns the access decisions and should understand any gaps the evidence reveals. 

The Security Rule requires procedures for responding to events that damage systems containing ePHI. Its contingency standard includes data backup, disaster recovery, and emergency-mode operation plans. A medical office should know which systems and records it needs first to continue care and essential operations. HHS describes these requirements here. 

Gather backup scope, monitoring records, recovery responsibilities, and results from restore or downtime exercises where available. A green backup status does not establish that the EHR, scheduling system, or phones can return within the time the practice needs. Document what a test proved, what failed, and who will fix it. Clinical leaders should approve the patient-care workflow during an outage; the IT provider can test the technical portions it supports. 

An inventory helps a practice identify laptops, desktops, tablets, servers, and other devices that store or access ePHI. Pair it with records for patching, device protection, encryption decisions, physical safeguards, and secure disposal. An old workstation under the front desk still counts if it can reach patient information. 

Keep a vendor list that identifies the service provided, the systems each vendor can access, and the person who approves that access. Determine which vendors are business associates because they create, receive, maintain, or transmit PHI on the practice’s behalf. Obtain an appropriate business associate agreement (BAA) when required and review whether the technical access still matches the service. A BAA sets obligations; it does not replace oversight or access controls. HHS explains the business associate requirement. 

The practice should be able to show how it trains staff on applicable privacy and security policies, records completion, and updates instruction when its systems or procedures change. Include the process staff use to report a suspicious email, lost device, or possible improper disclosure. HIPAA does not set a single annual training schedule for every practice; training must fit the rules and the workforce’s responsibilities. HHS explains the flexibility in training programs. 

Keep a written process for identifying, responding to, and documenting security incidents. For an incident that may involve a breach of unsecured PHI, practice leadership and counsel should assess notification duties under the Breach Notification Rule. The record should show what happened, who made the decisions, and why notification was or was not required. HHS explains the documentation expectation for breach decisions. 

Practice leadership and its designated privacy and security officials own the policies, risk decisions, workforce process, vendor relationships, and response to an audit. Legal or compliance advisors can help interpret the request and the practice’s obligations. The IT provider can supply evidence and explain the safeguards for the systems it actually manages, including account administration, device protection, backups, logs, and recovery testing as covered by its agreement. 

Ask each party for the evidence it owns before a deadline lands. Record missing items as gaps with owners and dates. Do not create a policy that describes controls you have not implemented or claim a restore was tested because backups ran successfully. 

Start with the risk analysis and an inventory of systems that handle ePHI. Then identify the person responsible for each policy, safeguard, vendor, and evidence source. Check a few recent examples: a new employee’s access, a departed employee’s offboarding, a backup alert, and an incident report. Those examples reveal whether the documented process works in practice. 

If an audit request arrives, read its scope and deadline carefully, preserve the relevant records, and coordinate the response with the practice’s privacy and security officials and counsel. The strongest preparation is a maintained process that can produce accurate evidence when someone asks for it.