Question 1

What is a HIPAA audit?

Accepted Answer

A HIPAA audit is a structured review of whether your practice's administrative, physical, and technical safeguards actually meet the requirements of the HIPAA Privacy, Security, and Breach Notification Rules. A thorough audit tests operating effectiveness rather than the existence of paperwork: it asks not whether you have an encryption policy, but whether every device is actually encrypted and whether you can prove it on a given date.

Question 2

Is a HIPAA audit legally required?

Accepted Answer

An external audit is not itself mandated. What is mandated, under 45 CFR 164.308(a)(1)(ii)(A), is a Security Risk Analysis, along with ongoing evaluation of your safeguards. Most practices meet those obligations through an annual audit and risk analysis because doing it internally requires expertise and independence that a small practice rarely has in-house.

Question 3

What is the difference between a HIPAA audit and a Security Risk Analysis?

Accepted Answer

A Security Risk Analysis identifies threats and vulnerabilities to your ePHI and scores them for likelihood and impact. It is the legal requirement and it is the first document OCR asks for. An audit tests whether the controls you claim to have are actually operating, usually against the HHS OCR Audit Protocol. The risk analysis tells you what could go wrong; the audit tells you whether your defences work. Practices generally need both, and the risk analysis comes first.

Question 4

Who has to comply with HIPAA?

Accepted Answer

Covered Entities — health plans, healthcare clearing houses, and any provider who transmits health information electronically in connection with a covered transaction — and their Business Associates. In practice that means essentially every medical, dental, and behavioral health practice that bills electronically, along with the vendors who handle their data. In Texas, HB300 casts an even wider net.

Question 5

Does a small practice really need this?

Accepted Answer

Yes, and small practices are not too small to be noticed. OCR enforcement actions include solo and two-provider practices, and complaint-driven investigations — the most common kind — are usually triggered by a patient or a former employee rather than by practice size. Small practices also carry more risk per incident, because they rarely have the reserves to absorb a settlement plus a remediation programme.

Question 6

What is the difference between HIPAA compliance and HIPAA certification?

Accepted Answer

There is no such thing as official HIPAA certification. HHS does not certify anyone, and no private body can confer compliance on your behalf. Any vendor selling a HIPAA certificate is selling a document with no regulatory standing. What has standing is your own evidence: a current risk analysis, operating controls, and documentation showing both.

HIPAA Audit Basics

6 questions on audit basics

Next steps

Other FAQ sections

How ready is your practice? Find out in 2 minutes.

Ready for a free HIPAA consultation?