AuditsCompliance-in-a-Box: The Startup Guide to Audit-Ready DocsSVSid Varma · 12 min readFor privacy and security officers at covered entities and business associates who must produce policies, training and sanctions records when OCR asks.
30-day trialUnlimited free viewersNo credit card required
Checked against primary sources on 18 October 2026.
Health plans, health care clearinghouses and health care providers that conduct standard electronic transactions, plus the business associates that handle protected health information for them.
HHS Office for Civil Rights, through complaint investigations, breach reviews, compliance reviews and audits; state attorneys general can also bring HIPAA actions.
No fixed audit cycle; Security Rule documentation is reviewed periodically and all required documentation is kept six years
45 CFR Parts 160 and 164 (Subparts C, D and E), last amended by 89 FR 32976, 2024-04-26 (a federal court vacated most of that rule on 2025-06-18, in Purl v. HHS; the notice of privacy practices changes it left in place applied from 2026-02-16). Free to read.
| Date | What happens | Status |
|---|---|---|
| 2026-02-16 | Compliance date for the notice of privacy practices changes to 45 CFR 164.520 that the court left in place | Done |
| 2027-07 | HIPAA Security Rule final rule, estimated in the latest Unified Agenda (listed under long-term actions) | Expected |
Each one needs an owner, an approval, and proof it reached the people it covers.
45 CFR 164.316(a)-(b)
Covered entities and business associates keep Security Rule policies and procedures in written or electronic form, available to those who apply them, reviewed periodically and updated as needed.
45 CFR 164.530(i)-(j)
Privacy policies and procedures are documented, changed promptly when law changes, and retained six years from creation or last effective date.
45 CFR 164.308(a)(5)
A security awareness and training program covers all workforce members, including management, with periodic security reminders.
45 CFR 164.530(b)
All workforce members are trained on PHI policies as needed for their functions, new members within a reasonable time, with training documented.
45 CFR 164.308(a)(1)(ii)(C) and 164.530(e)
Appropriate sanctions apply to workforce members who fail to follow security or privacy policies, and privacy sanctions applied are documented.
45 CFR 164.308(a)(6)-(7)
Policies and procedures address security incidents and emergencies, including data backup, disaster recovery and emergency mode operation plans.
Citations are to the standard or regulation; wording is ours.
What reviewers sample about these documents and the people they cover.
OCR requests usually start with current Privacy and Security Rule policies and procedures, with effective dates and earlier versions inside the six-year window.
Expect requests for the accurate and thorough risk analysis under 164.308(a)(1)(ii)(A) and the risk management measures that followed it.
Investigators ask for training materials and completion records showing when each workforce member was trained and on what.
They ask for the sanction policy and records of sanctions applied to workforce members who violated policies.
Write each policy, send it through approval, and send it to the people it covers. Each acknowledgment is recorded by name, with the version, the date and the time.
When a policy changes, the new version is approved, its Editor sends it out again, and everyone it applies to is asked again. Export the record as a PDF or CSV, or give a reviewer Viewer access to the documents their tags allow.
Need help with the rest of HIPAA? Find a consultant for your standard (opens in a new tab).
Your region’s laws, the standards your customers ask for, and your own house rules. Write each one as a policy, approve it, and send it to the people it covers.
The proposed rule published on 6 January 2025 has not been finalized. The latest Unified Agenda entry estimates final action in July 2027 and lists it under long-term actions, so the current Security Rule remains in force.
Covered entities had until 16 February 2026 to revise notices of privacy practices under the 2024 amendments to 45 CFR 164.520. The revisions include content on records protected under 42 CFR Part 2.
Six years from the date of creation or the date it was last in effect, whichever is later, under both the Security Rule and the Privacy Rule. That includes superseded policy versions and documented training.
Yes. The Security Rule's administrative safeguards and documentation requirements apply directly to business associates, alongside the terms of their business associate agreements.
The rules require training and documentation of it without prescribing a signature, so dated, version-specific records are a common way to show who was trained on which policy. Separately, direct treatment providers make a good faith effort to get each patient's written acknowledgment of the notice of privacy practices.
free for 30 days