A HIPAA auditor starts with your risk analysis, then asks for the policies, training records, access controls and incident files that show you acted on it. The Security Rule makes a risk analysis a required item, so missing or stale analysis is the first thing to fix.
What does the rule require first?
The Security Rule's administrative safeguards require an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information. The implementation specification is labelled required (HHS guidance on risk analysis).
The HHS pages were not directly retrievable for us, and our search returned mostly practitioner commentary on audit protocols. Treat the list below as a working checklist and compare it with the current OCR audit protocol on hhs.gov.
The evidence list
Risk analysis. The document, its date, its scope and the systems it covered. Auditors check that it covers all places ePHI lives, not just the main application.
Risk management plan. What you decided to do about each risk, who owns it and whether it was done.
Policies and procedures. Written and approved, with version history.
Designated officials. Named security and privacy officials.
Workforce training. Who was trained, when and on what, and what happens to new hires.
Access controls. How access is granted and removed, unique user identification, and periodic review records.
Audit controls. Logs of access to ePHI and proof that someone reviews them.
Contingency planning. Backup, disaster recovery and emergency mode plans, and a test record.
Device and media handling. Inventory, disposal and reuse procedures.
Business associate agreements. A signed agreement with each vendor that handles ePHI, and a list of all of them.
Incident and breach records. The response procedure, incident logs, risk assessments for each event and notices where required.
Sanction policy. What happens when staff violate policy, with any applied sanctions.
One source reports that OCR's Phase 2 audit report found over 80 percent of audit ratings did not meet appropriate compliance activities for risk analysis and risk management. That is secondhand, so check it in the original OCR report before you quote it.
What do auditors check beyond documents?
They test whether the document matches practice. Expect to be asked how a new employee gets access, how an account is removed on departure, and where backups are kept. Answers should match the written procedure and the logs.
What makes evidence weak?
A risk analysis from years ago. Policies that nobody follows. Training records with no dates. Business associate agreements missing for a tool a team adopted quietly. Logs that exist but are never reviewed.
How far back does evidence need to go?
The Security Rule has its own documentation and retention requirements, which we did not retrieve, so check them with your compliance counsel. As a working habit, keep dated records for at least the period an auditor is likely to examine, and keep the previous version of any policy you replace.
What to do
- Date and re-run your risk analysis, and cover every system that holds ePHI.
- Turn each identified risk into an owned action with a due date.
- Gather policies in one place with version history.
- Export training completion with dates for the last year.
- Run and record an access review.
- List every business associate and confirm an agreement exists.
- Compare your pack to the current OCR audit protocol on hhs.gov.
Open the full walkthrough at /demos/framework-mapping.
Quick check
Is a risk analysis required by HIPAA?
Yes. The Security Rule lists it as a required implementation specification under the administrative safeguards.
Does a tool make us HIPAA compliant?
No. HIPAA compliance is about your policies, practices and records. Tools help produce evidence.
Sources
Last reviewed: 18 October 2026.
