HIPAA Audit Process Questions
39 questions medical practices actually ask us, indexed across 6 sections. Open a section for the answers and the concrete next step.
Every question, indexed
Each question links straight to its answer. The answers live on the section pages, alongside the next steps that go with them.
HIPAA Audit Basics
- →What is a HIPAA audit?
- →Is a HIPAA audit legally required?
- →What is the difference between a HIPAA audit and a Security Risk Analysis?
- →Who has to comply with HIPAA?
- →Does a small practice really need this?
- →What is the difference between HIPAA compliance and HIPAA certification?
HIPAA Audit Scope and Timeline
- →How long does a HIPAA audit take?
- →How much of my staff's time does it take?
- →Do we have to close the practice or stop seeing patients?
- →What does the audit actually cover?
- →Will you need access to patient records?
- →What do we get at the end?
- →How often should we repeat it?
HIPAA Audit Cost and Pricing
- →How much does a HIPAA audit cost for a medical practice?
- →What drives the price up or down?
- →What does remediation cost on top of the audit?
- →Is it cheaper to do it ourselves?
- →How does the cost compare with the risk?
- →Will an audit lower our cyber liability premium?
OCR Investigations and Enforcement
- →What triggers an OCR HIPAA investigation?
- →How long do we have to respond to an OCR data request?
- →What does OCR ask for first?
- →What happens if we cannot produce a risk analysis?
- →Should we hire a lawyer?
- →Can we fix problems after the letter arrives?
- →How does an investigation usually end?
Remediation and What Happens After the Audit
- →We have the report and it is full of findings. Where do we start?
- →How long does remediation take?
- →What evidence do we need to keep as we close findings?
- →How do we stay compliant between audits?
- →What if we cannot afford to fix everything?
- →Do we need to tell anyone about the findings?
- →Should we re-audit after remediation?
Texas HB300 and State Requirements
- →What is Texas HB300?
- →How is HB300 different from federal HIPAA?
- →Do we have to notify the Texas Attorney General about a breach?
- →What are the penalties under HB300?
- →We are a small practice — does HB300 really apply to us?
- →How do we prove we meet the training requirement?
Still have a question?
The 30-minute scoping call is free and it is not a sales pitch — most of them end with us telling a practice which single thing to fix first.