A HIPAA compliance audit checks whether a covered entity or business associate meets the HIPAA Privacy, Security and Breach Notification Rules. The HHS Office for Civil Rights (OCR) audits organizations using its HIPAA Audit Protocol. Auditors look for a current risk analysis, written policies, training records, business associate agreements and six years of documentation.
This guide explains how OCR’s audit program works, what auditors ask for, how to run your own HIPAA compliance audit step by step, and a HIPAA audit checklist you can work through. It also covers the part many audit guides skip: proving that every workforce member read and accepted the current version of each HIPAA policy, and keeping that proof for as long as HIPAA requires.
What is a HIPAA compliance audit?
A HIPAA compliance audit is a structured review of how an organization protects protected health information (PHI). It tests your program against three sets of federal rules:
- The Privacy Rule, which controls how PHI can be used and disclosed and gives patients rights over their information.
- The Security Rule, which requires administrative, physical and technical safeguards for electronic PHI (ePHI).
- The Breach Notification Rule, which sets out how and when breaches of unsecured PHI must be reported.
There are two kinds of HIPAA audit. An OCR audit is run by the federal regulator. An internal or third-party audit is one you commission yourself, usually to find and fix gaps before a regulator, a customer or a breach does it for you.
How OCR’s HIPAA audit program works
According to HHS, “OCR uses the audit program to assess the HIPAA compliance efforts of a range of entities covered by HIPAA regulations.” The HITECH Act requires HHS to periodically audit covered entities and business associates.
- Phase 1 (2012): a pilot audit program.
- Phase 2 (2016–2017): desk audits of 166 covered entities and 41 business associates, reported in OCR’s 2016–2017 HIPAA Audits Industry Report.
- 2024–2025: OCR says its current audits “will review 50 covered entities’ and business associates’ compliance with selected provisions of the HIPAA Security Rule,” focusing on the provisions most relevant to hacking and ransomware attacks. OCR has said it will publish an industry report once these audits are complete.
OCR’s auditors work from the HIPAA Audit Protocol, which is organized by rule and regulatory provision. For each requirement it lists the established performance criteria and the audit inquiry, such as asking management to show the policy or obtaining and reviewing documentation. Because it’s public, the protocol is the best template for your own internal audit.
What OCR audits have found
OCR’s 2016–2017 industry report is the most detailed public picture of where organizations fall short. Among its findings:
- Most covered entities and business associates “failed to implement the HIPAA Security Rule requirements.”
- Covered entities “still struggle to implement the Security Rule’s requirements of risk analysis and risk management.”
- For Notices of Privacy Practices, “only 2% of covered entities fully met the requirements.”
- “Almost all covered entities audited (89%) failed to show they were correctly implementing the individual right of access.”
Those findings tell you where to spend your audit time first: risk analysis, risk management, your Notice of Privacy Practices and how you handle patients’ requests for their records.
How to conduct a HIPAA compliance audit in 9 steps
- Set the scope. Confirm whether you’re a covered entity, a business associate or both, and list every system, location, vendor and workflow that creates, receives, stores or sends PHI.
- Name the owners. HIPAA requires a designated privacy official and a security official. Make them responsible for the audit and for fixing what it finds.
- Review your risk analysis. The Security Rule requires “an accurate and thorough assessment of the potential risks and vulnerabilities” to ePHI under 45 CFR 164.308. Check it’s current, covers every ePHI system and is backed by a risk management plan.
- Map your policies to the protocol. Work through the OCR audit protocol provision by provision and confirm you have a written, approved policy or procedure for each one, with an owner and a review date.
- Check training and acknowledgment records. HIPAA requires you to train all workforce members on your policies and procedures and to document that the training was provided (45 CFR 164.530(b)). Pull completion records for every current employee, contractor and volunteer.
- Review business associate agreements. Confirm every vendor that handles PHI has a signed business associate agreement on file.
- Test technical safeguards. Review access controls, encryption, backups and contingency plans, and confirm someone regularly reviews audit logs, access reports and security incident reports, as §164.308(a)(1)(ii)(D) requires.
- Test patient-facing processes. Check your Notice of Privacy Practices against the required content, and sample recent right-of-access requests to confirm they were handled correctly and on time.
- Document findings and fix them. Record each gap, the owner and the deadline, then track remediation. Keep the audit report and evidence with your HIPAA documentation.
HIPAA audit checklist
Use this HIPAA audit checklist to gather the evidence an auditor is likely to request. The citations point to the regulations the OCR protocol tests.
| Area | What an auditor asks to see | Rule |
|---|---|---|
| Privacy and security officials | Named privacy official and security official, with written responsibilities | §164.530(a), §164.308(a)(2) |
| Risk analysis | A current, accurate and thorough risk analysis covering all ePHI | §164.308(a)(1)(ii)(A) |
| Risk management | A plan showing how identified risks are reduced to a reasonable level | §164.308(a)(1)(ii)(B) |
| Policies and procedures | Written Privacy and Security Rule policies, dated, approved and reviewed | §164.316, §164.530(i) |
| Workforce training | Training content, attendance and completion records for all workforce members | §164.530(b), §164.308(a)(5) |
| Sanctions | A sanctions policy and records of sanctions applied | §164.530(e), §164.308(a)(1)(ii)(C) |
| Activity review | Evidence that audit logs, access reports and security incident reports are reviewed regularly | §164.308(a)(1)(ii)(D) |
| Business associates | Signed business associate agreements for every vendor handling PHI | §164.308(b), §164.504(e) |
| Notice of Privacy Practices | A current NPP with all required content, posted and provided | §164.520 |
| Right of access | Records showing patients’ access requests were handled correctly and on time | §164.524 |
| Breach notification | Breach policies, risk assessments of incidents and notification records | §164.400–414 |
| Documentation retention | Required documents kept for six years from creation or last effective date | §164.316(b)(2), §164.530(j) |
The evidence gap: proving staff read the current policy
Most HIPAA audit guides tell you to “have policies” and “train staff.” Auditors go further: they ask you to show that each person was given the right policy, that it was the version in force at the time, and when they acknowledged it. HIPAA’s documentation rules in 45 CFR 164.316(b) make this harder than it sounds. You must:
- retain required documentation “for 6 years from the date of its creation or the date when it last was in effect, whichever is later”;
- “make documentation available to those persons responsible for implementing the procedures”; and
- “review documentation periodically, and update as needed.”
Every review creates a new version, and every new version needs to reach the right people again. If you run your HIPAA policies in SharePoint and Microsoft 365, here’s what the built-in tools cover and where the gaps are:
| Tool | What it does | What it doesn’t do |
|---|---|---|
| SharePoint version history | Keeps major and minor versions of each policy, so you can show what the document said on a given date | Doesn’t record who was asked to read a version or whether they accepted it |
| Microsoft Entra ID groups | Defines who belongs to which role, department or site | Doesn’t assign reading tasks or chase people who haven’t read a policy |
| Microsoft Purview Audit | Logs activity such as file views; Audit (Standard) retains records for 180 days | Doesn’t capture a confirmation that the reader understood and accepts the policy, and standard retention is far shorter than HIPAA’s six years |
| Power Automate | Can send approval or notification flows | Needs building and maintaining, and doesn’t produce audit-ready acknowledgment reports by itself |
DocRead fills that gap inside SharePoint. It assigns each policy to Microsoft Entra ID or SharePoint groups, sets reading deadlines, sends reminders, escalates overdue readers to managers and records a time-stamped acknowledgment of the exact version each person read. Reports export for auditors, so you can answer “who read this policy, which version, and when?” without chasing paper sign-off sheets. For the wider picture, see how to prove policy compliance in Microsoft 365 audits and how Microsoft Purview compares with policy acknowledgment software.
Who needs a HIPAA compliance audit?
- Covered entities: health plans, health care clearinghouses and health care providers that conduct certain transactions electronically.
- Business associates: vendors and contractors that create, receive, maintain or transmit PHI for a covered entity, such as IT, billing, cloud and consulting firms.
Both were included in OCR’s 2016–2017 audits and its 2024–2025 audits. If you’re a business associate, expect your covered entity customers to ask for your own audit results too.
How often should you audit HIPAA compliance?
HIPAA doesn’t set a single audit frequency, but several requirements are ongoing. The Security Rule requires periodic technical and nontechnical evaluations of your safeguards and regular review of information system activity, and your documentation must be reviewed periodically and updated after environmental or operational changes. Many organizations run a full internal HIPAA compliance audit every year and repeat the risk analysis whenever systems, vendors or locations change.
Frequently asked questions about HIPAA compliance audits
What is a HIPAA compliance audit?
A HIPAA compliance audit is a review of whether a covered entity or business associate meets the HIPAA Privacy, Security and Breach Notification Rules. The HHS Office for Civil Rights (OCR) runs a formal audit program, and organizations also run internal or third-party audits to check their policies, risk analysis, safeguards, training records and documentation.
Does HIPAA compliance require an audit?
HIPAA doesn’t require you to hire an outside auditor or hold a certification. The Security Rule does require an accurate and thorough risk analysis, regular review of information system activity and periodic evaluations of your safeguards, which work like built-in internal audits. OCR can also select any covered entity or business associate for an audit.
Who audits for HIPAA compliance?
The HHS Office for Civil Rights (OCR) runs the federal HIPAA audit program, because the HITECH Act requires HHS to periodically audit covered entities and business associates. Organizations also use their own privacy and security officers, internal audit teams or independent assessors to audit HIPAA compliance before OCR does.
What can trigger a HIPAA compliance audit?
OCR has selected audit participants from pools of covered entities and business associates; in its 2016–2017 audits it used sampling criteria including size, affiliations, location and public or private status. Separately, OCR investigates complaints and reported breaches, and those investigations ask for many of the same documents an audit does.
What is an example of HIPAA compliance?
A common example is workforce training: HIPAA requires a covered entity to train all workforce members on its policies and procedures and to document that the training was provided. Others include a current risk analysis, a compliant Notice of Privacy Practices, signed business associate agreements and timely responses to patients’ requests for their records.
How long must HIPAA documentation be kept?
HIPAA requires covered entities and business associates to retain required documentation, including policies and procedures, for six years from the date it was created or the date it was last in effect, whichever is later.
What is a HIPAA compliance auditor?
A HIPAA compliance auditor is the person or team that reviews your HIPAA program. In an OCR audit, that’s OCR or its contractor using the HIPAA Audit Protocol. Internally, it’s often your privacy or security officer, an internal audit team, or an outside firm hired to assess your program and test your safeguards.
Make your HIPAA policies audit-ready
DocRead gives HIPAA compliance teams a time-stamped record of who read and accepted each policy version, inside the SharePoint libraries you already use. It also supports wider healthcare compliance programs, from annual privacy training to procedure updates. Book a demo to see DocRead with your own policies, request a quote, or start the 30-day DocRead for SharePoint Server trial.
This article is general information, not legal advice. Check your obligations with your privacy officer or legal counsel.