HIPAA Compliance Checklist: How to Prepare for a HIPAA Audit

A HIPAA audit rarely fails on encryption. It fails on evidence: a risk analysis that is two years old, access reviews nobody signed off, or a business associate agreement that was never filed. This checklist helps covered entities and business associates check those gaps before the Office for Civil Rights or a customer’s security team does.

Who it is for: clinics, health systems, HealthTech and SaaS companies that store or process protected health information (PHI), and the engineering teams that run their infrastructure.

What the checklist helps you review

• Risk analysis: a current, documented assessment of where PHI lives and what threatens it, as the HIPAA Security Rule requires.
• Administrative safeguards: security officer, workforce training, access management and incident procedures.
• Physical safeguards: facility access, workstation use and device and media controls.
• Technical safeguards: unique user IDs, access controls, audit logs, integrity controls and encryption in transit and at rest.
• Business associates: signed BAAs with every vendor that touches PHI, including cloud and monitoring providers.
• Breach readiness: a tested process for breach notification and documented incident history.

How to use it: run it as an internal self-assessment, hand it to your infrastructure provider, or use it to brief leadership before an audit. For a deeper walkthrough, read our guide on how to prepare for a HIPAA audit. If you want an independent review, our compliance audit team checks your cloud environment against the Security Rule and gives you a remediation plan.

Frequently Asked Questions

Who has to comply with HIPAA?

Covered entities (healthcare providers, health plans and clearinghouses) and their business associates, including cloud, SaaS and IT providers that handle PHI on their behalf.

What does a HIPAA audit check?

Whether you have a current risk analysis, the safeguards the Security Rule requires, signed business associate agreements, and documented policies and evidence that you follow them.

*This checklist is provided for informational purposes only and does not constitute legal advice or a comprehensive HIPAA compliance solution.