Skip to content

Redeem Access Code

Login
Sign Up

About
- Testimonials
- Articles & News
Shop by Category
Compliance Training
- Live Online Webinars
- Online Training
Redeem Access Code
Resources
Catalogs
Contact

About
- Testimonials
- Articles & News
Shop by Category
Compliance Training
- Live Online Webinars
- Online Training
Redeem Access Code
Resources
Catalogs
Contact

Search for:

About
- Testimonials
- Articles & News
Shop by Category
Compliance Training
- Live Online Webinars
- Online Training
Redeem Access Code
Resources
Catalogs
Contact

About
- Testimonials
- Articles & News
Shop by Category
Compliance Training
- Live Online Webinars
- Online Training
Redeem Access Code
Resources
Catalogs
Contact

HIPAA
Audit Checklist

Note* This audit form is for record-keeping ONLY and does not score your compliance. If you would like a scored form, check out our Compliance App! Click here to learn more

HIPAA Audit Checklist

"*" indicates required fields

Step 1 of 10

10%

URL

This field is for validation purposes and should be left unchanged.

Name*

First Last

Email*

Practice Name*

Practice Phone Number*

Industry*

Marketing Disclaimer*

By completing this form, I agree to receive promotional marketing emails sent to this email address including webinars, product discounts, and sales.

GENERAL

The practice management software selected is HIPAA compliant and is the latest updated version.

Yes

No

The HIPAA Coordinator has been appointed. This person may also serve as the Privacy Officer and/or Security Officer.

Yes

No

A written training program has been developed for the training of all employees on all aspects of HIPAA as it relates to the office.

Yes

No

Training logs/contracts have been developed to document that training has occurred.

Yes

No

A competent and experienced IT organization that understands how to set up a secure system has been selected to set up and maintain the computer system.

Yes

No

Sanction policies have been implemented which outline disciplinary actions based on the severity of the HIPAA violation.

Yes

No

Any sanctions or actions imposed by the office on the employee have been documented, signed and dated. A copy is maintained in the employee file.

Yes

No

PRIVACY

The Privacy Officer has been appointed. The individual serves as the primary expert on all privacy matters and reports to the HIPAA Coordinator.

Yes

No

Privacy training has been provided and documented for all new employees.

Yes

No

A written Privacy Policy Plan exists and is reviewed/updated annually.

Yes

No

The Notice of Privacy contains the necessary information to meet the requirements of the Privacy Rule (use and disclosure, patient’s rights, covered entity’s responsibilities).

Yes

No

A written Notice of Privacy Policy is provided on or prior to the first delivery of service, prominently displayed and posted on the office’s website.

Yes

No

All patients have signed a written acknowledgment stating they have been offered a copy of the Notice of Privacy Policy.

Yes

No

Authorization forms are used to obtain approval to use or disclose PHI for all non-TPO (treatment, payment, health care operations) related purposes.

Yes

No

Employees are granted access to PHI based on their assigned job responsibility.

Yes

No

A process for confidential communication with patients has been implemented.

Yes

No

All employees have signed a Non-disclosure/Confidentiality Agreement.

Yes

No

Business Associate Agreements have been signed by all business associates as defined by HIPAA law and the office maintains a list of all business associates.

Yes

No

Business Associates and their subcontractors (should they utilize them) are aware of their “downstream” responsibility.

Yes

No

A policy exists for Breach Notification of the patient, should a breach of their PHI occur.

Yes

No

SECURITY Technical Safeguards

There are access control policies and procedures, which include:

Unique User Identification - assign a unique name and/or number for identifying and tracking user identity.

Yes

No

Emergency Access Procedure - establish and implement as needed, procedures for obtaining necessary E-PHI during an emergency.

Yes

No

Automatic Logoff - implement electronic procedures that terminate an electronic session after a predetermined time of inactivity.

Yes

No

Encryption and Decryption - implement a mechanism to encrypt and decrypt E-PHI.

Yes

No

There are audit controls which include: Hardware, software and/or procedural mechanisms that record and examine activity in information systems that contain or use E-PHI.

Yes

No

There are mechanisms to authenticate E-PHI and to corroborate that E-PHI has not been altered or destroyed in an unauthorized manner.

Yes

No

Authentication - there are procedures to verify that a person or entity seeking access to E-PHI is the one claimed.

Yes

No

Integrity Controls - there are security measures exist to ensure that electronically transmitted E-PHI is not improperly modified without detection until disposed of.

Yes

No

Encryption - mechanisms to encrypt E-PHI when sending it electronically have been implemented.

Yes

No

PHYSICAL SAFEGUARDS

There are Facility Access Controls, which include:

Contingency Operations - procedures that allow facility access in support of restoration of lost data in the event of an emergency.

Yes

No

Facility Security Plan - policies and procedures to safeguard the facility and the equipment from unauthorized physical access, tampering and theft.

Yes

No

Access Control and Validation - procedures to control and validate a person’s access to facilities based on their role or function (visitor control and control of access to software programs for testing).

Yes

No

Maintenance Records - policies and procedures to document repairs and modifications to the physical components of a facility which are related to security (hardware, walls, doors and locks).

Yes

No

Workstation Use - policies and procedures that specify the proper functions to be performed and the way those functions are to be performed.

Yes

No

Workstation Security - physical safeguards for all workstations that access E-PHI to restrict access to unauthorized users.

Yes

No

There are Device and Media Controls, which include:

Disposal - policies and procedures to address the final disposition of E-PHI and/or the hardware on which it was stored.

Yes

No

Media Re-Use - procedures for removal of E-PHI from electronic media before the media is made available for reuse.

Yes

No

Accountability - records of the movements of hardware and electronic media and any person responsible for the movement.

Yes

No

Data Backup and Storage - a retrievable, exact copy of E-PHI when needed.

Yes

No

ADMINISTRATIVE SAFEGUARDS

There are a Security Management Processes in place, which include:

The Security Officer has been appointed. This person serves as the primary expert on all security matters.

Yes

No

Risk Analysis was performed to see where PHI is being used and stored in order to determine all potential HIPAA violations.

Yes

No

Risk Management - sufficient measures exist to reduce these risks to an appropriate level.

Yes

No

Sanction Policy - a sanction policy exists for those employees who fail to comply.

Yes

No

Information Systems Activity Reviews - regular reviews of system activity, logs audit trails, etc.

Yes

No

Protection Against Malware - procedures for guarding against, detecting and reporting malicious software.

Yes

No

Login monitoring - monitoring of logins to systems and reporting of discrepancies is conducted.

Yes

No

Password Management - there are procedures for creating, changing and protecting passwords.

Yes

No

Response and Reporting - identification, documentation and response to security incidents is performed.

Yes

No

Contingency Plan - there are accessible backups of E-PHI and there are procedures in place to restore any lost data.

Yes

No

Emergency Mode - a system has been established to enable continuation of critical business processes for protection and security of E-PHI while operating in emergency mode.

Yes

No

MISCELLANEOUS

Off-site, encrypted backups are performed regularly.

Yes

No

Business class HIPAA compliant firewalls are installed and functioning properly.

Yes

No

The network is scanned for ports that should be blocked.

Yes

No

If a wireless system is used, it is business class and encrypted.

Yes

No

Server data is encrypted.

Yes

No

The operating system software is tested annually.

Yes

No

The server has been physically secured in a locked room, cabinet, or cage.

Yes

No

The firewall has been set to only allow access to websites needed for business operations.

Yes

No

Only the business owner has the “key” code for the computer system and separate wireless networks exist for patient and business use.

Yes

No

SECURITY ANALYST CHECKLIST

To be completed in conjunction with your IT professional.

ARE FIREWALL AND ROUTER CONFIGURATION STANDARDS ESTABLISHED AND IMPLEMENTED THROUGHOUT THE OFFICE TO INCLUDE THE FOLLOWING:

Is there a formal process for approving and testing all network connections and changes to the firewall and router configurations?

Yes

No

Notes

Is there a current network diagram that documents all connections in the office and other networks, including any wireless networks?

Yes

No

Notes

Is there a process to ensure the diagram is kept current and in a location that is easily accessible to all staff members?

Yes

No

Notes

Is there a firewall implemented at each internet connection in the office? i.e. between local networks and wireless networks?

Yes

No

Notes

Is the current network diagram up-to-date and consistent with HIPAA firewall configuration standards?

Yes

No

Notes

Do firewall and router configurations include a documented list of services, protocols and ports that are open or can be accessed?

Yes

No

Notes

Is there a justification and approval for each listed above?

Yes

No

Notes

Does the office review firewall and router configurations at least every six months?

Yes

No

Notes

Is the office or technician for the office verifying that all available updates and patches to the router and firewall are being installed monthly, quarterly or annually?

Yes

No

Notes

Are firewall and router rules reviewed at least every six months?

Yes

No

Notes

Do firewall and router configurations restrict connections between untrusted networks and trusted network systems protecting databases in the network?

Yes

No

Notes

Is direct public access prohibited between the Internet and the internal networks holding patient data?

Yes

No

Notes

Are anti-spoofing methods implemented to detect and block forged sourced IP addresses from entering the network?

Yes

No

Notes

Are only established connections permitted into the network?

Yes

No

Notes

Are measures in place to prevent the disclosure of private IP addresses and routing information to the Internet?

Yes

No

Notes

Are all disclosures of private IP addresses and routing information to external entities authorized?

Yes

No

Notes

Are security policies and operational procedures for managing firewalls documented?

Yes

No

Notes

COMPUTER SYSTEMS AND NETWORK COMPONENTS

Are vendor-supplied defaults always changed before installing a system on the network?

Yes

No

Notes

Are default or guest accounts removed or disabled before installing a system on the network?

Yes

No

Notes

Are encryption keys changed from default at installation and changed when an employee with access to the private keys leave the company?

Yes

No

Notes

Are administrative passwords to network devices changed when an employee with access to that information leaves the company?

Yes

No

Notes

Are default passwords on routers or access points from third parties changed at installation?

Yes

No

Notes

Is firmware on the router and wireless devices updated to support security from hacking, encryption viruses etc.

Yes

No

Notes

Are there proper anti-virus systems in place on each device that is on the network?

Yes

No

Notes

Are anti-virus systems checked for updates?

Yes

No

Notes

Are anti-virus programs capable of detecting, removing, and protecting against all known types of malicious software (i.e. viruses, trojans, spyware, adware, rootkits and encryption viruses installed) on the computer system?

Yes

No

Notes

STORED DATA

Is the data storage amount and retention time compliant with legal, regulatory and business requirements?

Yes

No

Notes

Are there defined processes in place for securely deleting data when no longer needed for legal, regulatory, and or business reasons?

Yes

No

Notes

Are there specific retention requirements for the data that is held in your industry?

Yes

No

Notes

Does the office have written documentation to support retention requirements?

Yes

No

Notes

Is there a backup of the data?

Yes

No

Notes

Is the backup properly managed?

Yes

No

Notes

Who is responsible for daily follow-up of the backups?

Yes

No

Notes

Is there a policy in place for hourly, daily, weekly or monthly backups?

Yes

No

Notes

Are the backups held on site?

Yes

No

Notes

If stored on removable media, is the removable media encrypted?

Yes

No

Notes

Are all backups encrypted?

Yes

No

Notes

Is the office utilizing cloud-based backups?

Yes

No

Notes

Are cloud-based solutions HIPAA compliant and did the cloud company sign a BAA?

Yes

No

Notes

Does the office have access to the passwords or encryption keys for these backups?

Yes

No

Notes

Does the office have a plan for obtaining backups in a timely manner?

Yes

No

Notes

Is there a policy in place for a data breach?

Yes

No

Notes

Are appropriate facility entry controls in place to limit and monitor physical access to the network devices including routers, firewalls, servers and workstations?

Yes

No

Notes

Are there video cameras or access-control mechanisms in place to monitor physical access?

Yes

No

Notes

Are physical and/or logical controls in place to restrict access to publicly accessible networks jacks (i.e. waiting rooms etc.)?

Yes

No

Notes

Is media or data sent outside the office encrypted to protect the sensitive patient information?

Yes

No

Notes

Is the office using encrypted emails or a service to send sensitive patient information?

Yes

No

Notes

About
Shop
Compliance Training
Contact
Login/Sign Up

888.388.4782
1919 Federal Blvd
Ann Arbor, MI 48103
Email Us
Monday - Friday 8AM - 4:30PM EST

Your Account

Disclaimer
Privacy & Terms & Conditions
Copyrights 2026 Complaince Training Partners
Powered by Verasoni

Scroll to Top