Question 1

How long does a HIPAA audit take?

Accepted Answer

For a typical single-location practice, two to three weeks from kickoff to the deliverable presentation: discovery and document collection in week one, on-site technical review in week two, and the report walkthrough in week three. Multi-location groups usually run four to six weeks because each site needs its own technical review.

Question 2

How much of my staff's time does it take?

Accepted Answer

Less than practices expect. Budget around four to six hours total from the practice administrator, spread across the engagement, and roughly an hour each from a handful of staff for interviews. The technical work happens in the background. The part that consumes real time is remediation afterwards, not the audit itself.

Question 3

Do we have to close the practice or stop seeing patients?

Accepted Answer

No. Audits are designed around clinical operations. Passive network discovery does not interrupt anything, interviews are scheduled around clinic hours, and any work that carries a genuine risk of disruption — such as network segmentation cutover — is scheduled for evenings or weekends with a tested rollback plan.

Question 4

What does the audit actually cover?

Accepted Answer

A full engagement covers all three HIPAA rules plus Texas state law: the Privacy Rule (notice of privacy practices, patient rights, minimum necessary, workforce training), the Security Rule (all implementation specifications across administrative, physical, and technical safeguards), the Breach Notification Rule (incident response readiness and documentation), and Texas HB300's additional obligations.

Question 5

Will you need access to patient records?

Accepted Answer

We work from system configurations, logs, and metadata rather than record content, and we scope access to the minimum necessary. Where a control can only be verified by observing a record view, it is done alongside your staff. A Business Associate Agreement is executed before any access to systems containing ePHI.

Question 6

What do we get at the end?

Accepted Answer

An executive summary suitable for leadership and your board, a detailed findings register with each item mapped to its 45 CFR citation and scored for likelihood and impact, a prioritised remediation roadmap with cost estimates, and an evidence archive. The archive is the part that matters if OCR ever writes to you.

Question 7

How often should we repeat it?

Accepted Answer

Annually at minimum, and additionally whenever your environment materially changes — a new EHR, a new location, a merger, significant staff turnover, or any security incident. OCR expects the risk analysis to reflect your current environment, and a document describing a network you no longer run is worse than useless.

HIPAA Audit Scope and Timeline

7 questions on scope & timeline

Next steps

Other FAQ sections

How ready is your practice? Find out in 2 minutes.

Ready for a free HIPAA consultation?