To be ready for a HIPAA audit or investigation by the HHS Office for Civil Rights, keep a dated evidence binder: a current risk analysis, a risk management plan, written policies, proof of access controls and log review, business associate agreements, training records and breach files, all retained for six years. There is no HIPAA certification to pass.
What will OCR actually ask for?
OCR's published audit protocol is a list of questions tied to regulation sections, such as whether the entity has policies and procedures to conduct a risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and a risk management process sufficient to reduce risks to a reasonable and appropriate level (164.308(a)(1)(ii)(B)). The auditor then asks for the documents and proof that show those things exist and are used. HHS says its Security Rule summary is not a comprehensive guide, and regulated entities must comply with all applicable requirements. Recent rulemaking proposals to change the Security Rule exist, so check HHS for the current text. This guide is general information, not legal advice.
What goes in the binder?
1. Risk analysis. The anchor document. HHS guidance says it must cover all ePHI the organisation creates, receives, maintains or transmits, identify where it lives, document threats and vulnerabilities, assess current controls, rate likelihood and impact, and assign risk levels. HHS says there is no single required method and that the analysis must be accurate and thorough. Keep it dated, signed off, and refreshed when your environment changes.
2. Risk management plan. What you decided to do about each risk, with owners, dates and status. A risk analysis with no follow through is a classic finding.
3. Policies and procedures. Written and current, matching practice. The Security Rule requires documentation to be retained for six years from creation or last effective date, whichever is later (164.316(b)(2)(i)).
4. Access control proof. User lists with roles, approval records, termination records, unique user IDs, emergency access procedure, and the review of information system activity such as audit logs and access reports (164.308(a)(1)(ii)(D), 164.312(b) on audit controls).
5. Evaluation. The Rule requires periodic technical and nontechnical evaluation in response to environmental or operational changes (164.308(a)(8)). Keep the record.
6. Contingency planning. Backup, disaster recovery and emergency mode plans, with test records where you carry out testing and revision.
7. Business associate agreements. A signed agreement with each vendor that handles ePHI for you, plus a list.
8. Workforce records. Training completion, sanction policy records, and onboarding and offboarding evidence.
9. Incident and breach files. The incident log and how each event was assessed. The Breach Notification Rule requires covered entities to notify without unreasonable delay and no later than 60 calendar days after discovery (164.404(b)).
How do you survive the review?
Name one person as the single contact. Respond only with what was asked, complete and on time. Make sure interviewees describe what they actually do. Where you find a gap, say so and show the plan. Hiding a gap is worse than admitting it. Keep an index so each requested item can be found fast.
Who owns what?
The security officer owns the risk analysis and plan. IT owns access, logging and backup proof. HR owns workforce records. Legal or procurement owns business associate agreements. Leadership approves the plan and funds the fixes.
What to do
- Run or refresh the risk analysis against HHS guidance.
- Turn findings into a dated risk management plan.
- Check each policy matches practice and retain versions for six years.
- Export access lists and log review records monthly.
- Record the periodic evaluation.
- Test contingency plans and keep results.
- List business associates and confirm signed agreements.
- Build an index and rehearse a mock request.
Quick check
Is there a HIPAA certification?
No government certification exists in the sources I read. OCR audits and investigates compliance, and private programs offer their own reports. Check what the program covers.
How long must HIPAA documentation be kept?
Six years from the date of creation or the date it was last in effect, whichever is later, under 164.316(b)(2)(i).
How Safeguard helps automate this
A binder is only as good as its dates. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between reviews, which suits the log review and evaluation items. Technical evidence comes from your real code and dependencies, using scans, SBOMs and reachability, supporting the vulnerability part of your risk analysis. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard helps prepare and keep evidence ready. OCR and independent assessors make the compliance call. Book a call to discuss.
Sources
- HHS, HIPAA Security Rule summary
- HHS, Guidance on risk analysis
- HHS, OCR audit protocol
- eCFR, 45 CFR Part 164 Subpart C
Last reviewed: 18 October 2026.
