Question 1

We have the report and it is full of findings. Where do we start?

Accepted Answer

Not at item one. Work the remediation roadmap in the order it is sequenced, which is by risk reduction per dollar rather than by ease or by page order. In practice that means a current risk analysis, missing Business Associate Agreements, MFA, and backups come before almost anything else, because those four account for most of the realistic exposure.

Question 2

How long does remediation take?

Accepted Answer

For a typical practice, the high-severity findings close within 90 days and the remainder run on a rolling 12-month plan. That split matters: attempting everything at once usually means nothing finishes, whereas closing the critical dozen in a quarter measurably changes your position.

Question 3

What evidence do we need to keep as we close findings?

Accepted Answer

Dated artefacts, not status columns. An encryption status report rather than a note saying encryption is done. A signed access review rather than a policy saying reviews happen. A witnessed restore test with elapsed times rather than a green dashboard. The rule of thumb: if it does not have a date and a name on it, it is not evidence.

Question 4

How do we stay compliant between audits?

Accepted Answer

A small recurring cadence beats an annual scramble. Monthly log review, quarterly access reviews, an annual reconciliation of vendors against accounts payable, training on the HB300 cycle, and an annual tested restore. Each is a modest commitment; together they produce the evidence trail that makes the next audit and any OCR request straightforward.

Question 5

What if we cannot afford to fix everything?

Accepted Answer

That is the normal situation and the regulation anticipates it. What is not defensible is doing nothing and documenting nothing. Where a specification cannot be met as written, implement and document a compensating control with your reasoning, and record the finding on a plan with a target date. A documented, risk-based decision is defensible; an undocumented gap is a finding.

Question 6

Do we need to tell anyone about the findings?

Accepted Answer

Findings from your own audit are internal work product and are not reportable in themselves. If the audit uncovers an actual impermissible use or disclosure of PHI, that is a separate matter and the Breach Notification Rule applies, including the four-factor risk assessment and its deadlines. Involve counsel as soon as an audit surfaces a possible incident rather than after you have decided what it was.

Question 7

Should we re-audit after remediation?

Accepted Answer

Re-test the specific controls you changed, particularly technical ones — a segmentation project should end with the same penetration test re-run to prove the paths are closed. A full re-audit is usually an annual event rather than a follow-up. The re-test evidence is what turns a claim into proof.

Remediation and What Happens After the Audit

7 questions on after the audit

Next steps

Other FAQ sections

How ready is your practice? Find out in 2 minutes.

Ready for a free HIPAA consultation?