Templates / HIPAA audit checklist: Free PDF template and guide

Practice Management Tips

HIPAA audit checklist: Free PDF template and guide

Free PDF • 3 pages, print-ready • Clinician-reviewed

Monika Lazarevska Last updated November 2, 2026 Reviewed by Dr. Vanja Kitanova

---

A HIPAA audit checklist is a self-review of your administrative, physical and technical safeguards, recording a named owner and dated evidence for each item. It also covers the Privacy Rule, breach notification and business associate agreements, so one pass tests the whole program.

Its job is to show you the weak points before an OCR document request, a patient complaint or a breach does. Work through it with the people who run each process, and log every failed item with an owner and a fix date. Then keep the signed copy with your policies for six years.

Template details

Template type

Checklist

Format

Printable PDF, 3 pages

Sections

8 sections

Best for

Practice Management Tips

Key takeaways

A HIPAA audit checklist tests your privacy, security and breach safeguards, with a named owner and dated evidence for each item.

HHS requires an ongoing security risk analysis but sets no fixed annual date for it.

In an OCR desk audit, you get 10 business days to upload the documents requested.

Business associates have been directly liable under HIPAA since the HITECH Act.

Beside every item, write the owner, the date checked and pass or fail, because the PDF itself has checkboxes only.

What does a HIPAA audit checklist test?

A HIPAA audit checklist is a list of verifiable items that show whether your safeguards exist, work and have a named owner. Each item maps to a rule, such as the HIPAA Security Rule requirement for access controls, or to a policy your team must follow.

Passing it does not make you certified. HHS does not certify practices as HIPAA compliant, and no checklist guarantees compliance. Its value is surfacing weak points before OCR, a patient complaint or a breach does.

The completed checklist is itself HIPAA documentation. You generally must keep it for six years from creation or its last effective date, under 45 CFR 164.316(b)(2) and 164.530(j).

Who needs one, and who owns each part

Any covered entity or business associate that handles protected health information must meet the Security Rule. A provider becomes a covered entity when it conducts standard electronic transactions, such as claims or eligibility checks, directly or through a billing service.

That test decides it for med spas. A cash-only med spa that never sends those transactions usually sits outside HIPAA, though state privacy law may still apply. One that bills insurers electronically for medical treatments is a covered entity, and the full checklist applies.

Size changes who does the work, not what gets checked. A four-clinician practice might split the checklist between a practice manager, an IT contractor and a clinical lead. A solo therapist may finish it in an afternoon, though the same items still apply.

How to work through the checklist in one sitting

Work through the checklist with the people who own each process, not alone at a desk. Five steps keep the review practical:

1. Assign one owner per safeguard category, so every item has a named person. The map further down shows which PDF sections each owner takes.
2. Review administrative safeguards first: Risk analysis, written policies, workforce training, business associate agreements, a security official, incident procedures and a contingency plan.
3. Check technical safeguards: Unique user IDs, role-based access, audit logging and transmission security. Encryption is an addressable specification, so either implement it or document an equivalent alternative and your reasoning.
4. Walk through physical safeguards: Facility access, workstation placement, and how devices and media are reused or disposed of.
5. Record a result for every item, then list each failure with an owner and a fix date.

The PDF gives each item a checkbox and nothing else, so add the detail an auditor looks for. Beside each item, write the owner’s initials, the date you checked it and where the evidence is kept.

Its action plan section is three checkboxes with no room for detail. List every failed item on a separate sheet with its owner and fix date, and keep that sheet with the signed checklist.

Match the PDF’s sections to your owners

The PDF follows the HIPAA rules in order, from Privacy to Omnibus, while the steps above work by safeguard group. Use this map to hand each section to the right owner.

Three required safeguards to add by hand

The PDF leaves out three administrative safeguards that 45 CFR 164.308 requires. Write them into Section II yourself, under Security Policies and Procedures:

• A designated security official. The PDF asks only for a HIPAA compliance officer, so name the person responsible for security too, even if it is the same person.
• Security incident procedures. They set out how staff identify, respond to and document an incident. Section V asks for incident records, not the procedure behind them.
• A contingency plan. It covers data backup, disaster recovery and emergency mode operation, so care can continue while systems are down.

Keep the completed checklist with your policies. Re-run it after a new vendor, a new EHR or a staffing change, since each one reshapes your risk.

Why a dated checklist beats a clean memory

Once the review is done, the paper trail it leaves is worth more than the review itself. A completed checklist does three jobs for your practice:

• It shows weak safeguards before an OCR inquiry or a patient complaint does.
• It assigns each safeguard to a named owner, so tasks do not drift.
• It creates dated evidence that your review happened.

That third job is the one auditors notice, and dating is a habit worth building from the first pass.

Three safeguard groups, plus the paperwork around them

The HIPAA Security Rule groups its standards into administrative, physical and technical safeguards, plus organizational requirements and documentation rules. Each safeguard group needs its own section of the checklist. The table shows what to check and what evidence to keep.

Encryption is the row most likely to change. In January 2025, HHS proposed a Security Rule update that would make encryption required and drop the split between required and addressable specifications.

As of November 2026 it is still a proposal, and the federal regulatory agenda estimates final action for July 2027. Until a final rule is published, encryption stays addressable.

Security risk analysis: The required starting point

A security risk analysis is required under the HIPAA Security Rule, and it sets priorities for the rest of the checklist. Its job is to identify where electronic PHI could be exposed, how likely that is and how much harm it would cause.

HHS does not set a fixed annual date for the analysis. It expects an ongoing process, so revisit the analysis when systems, vendors or locations change. Our guide to the HIPAA risk assessment walks through scoring threats and likelihood in more detail.

Audit logs: What to record and keep

An audit log records who accessed or changed electronic PHI, when they did it and what they did. Logs only help if someone reviews them, so the checklist should ask for a review schedule as well as proof the logs exist.

Ask whether logins, record views, record changes and exports are captured, and who reviews them. HIPAA requires you to keep documentation of required actions and assessments for six years. It sets no retention period for log review records, so filing them with that documentation for six years is good practice.

How an OCR audit runs, step by step

OCR’s published audit program guidance describes a short, document-driven process. The clock starts with the first email, which is why the checklist has to exist before an audit does.

1. OCR emails the selected practice, introduces the audit team and sends an initial document request.
2. You upload the requested documents through OCR’s secure portal within 10 business days of the request date.
3. Auditors review the file and share draft findings, and you can respond to them in writing.
4. OCR issues a final audit report that includes your written response. It may also run onsite audits.

Breach notification runs on its own clock. Affected patients must be notified without unreasonable delay, and no later than 60 days after you discover the breach, under 45 CFR 164.404.

A breach affecting more than 500 residents of a state or jurisdiction also needs notice to prominent media outlets serving that area, under 164.406.

Notice to HHS for a breach affecting 500 or more individuals is due within 60 days of discovery. For smaller breaches, notice to HHS is due within 60 days of the end of the calendar year in which you discovered them.

Read the breach notification rules before you need them, because state law can add stricter requirements, such as California’s CMIA. If you do find a violation, our guide to handling a HIPAA violation covers the immediate actions.

Before the auditor arrives

Ten business days is enough time to upload a file, not to build one. Have these ready in one folder before any request lands:

• A signed, dated risk analysis and the risk management plan that answers it.
• Current policies and procedures, each with a version date.
• Workforce training records with names and completion dates.
• A list of business associates, with a signed agreement for each one.
• Your notice of privacy practices and the patient acknowledgments that go with it.
• A breach log, plus copies of any notification letters you sent.
• Records of each audit log review, with the reviewer’s name.
• One named contact who can upload to OCR’s portal before the deadline.

Practices with several sites should keep one folder per location and a shared index. Our guide to HIPAA for medical offices covers how multi-site teams split that work.

What trips practices up in an audit

The same handful of problems turns up again and again, and most come down to ownership rather than technology. Training is a common one, because sessions happen but nobody records who attended.

Our guide to HIPAA training for employees covers what to log.

A worked example

Take an illustrative three-room med spa that bills insurers electronically. The practice manager owns the administrative items, an IT contractor owns the technical ones and the lead clinician owns physical safeguards.

The first pass turns up three failures. The risk analysis predates the move to a new EHR, two receptionists share a login and the cloud backup vendor has no signed agreement.

Each failure gets an owner and a date. The manager books a fresh risk analysis within 30 days, and the contractor issues individual logins that week. The backup vendor signs before the next scheduled backup, and the next full review goes in the calendar.

How Pabau keeps your audit evidence in one place

In many practices the evidence an auditor wants is scattered. Training sign-offs sit in email, consent forms in a filing cabinet and access lists in a spreadsheet last updated two hires ago.

Pabau, the practice management platform we build, keeps much of that evidence in one system. Its compliance management software keeps a traceable audit trail, and role-based permissions control who can view, edit or export each part of a record.

Signed consent and intake forms land in the patient record through digital forms, time-stamped and ready to show. Pabau does not make a practice HIPAA compliant on its own, but it shortens the hunt for proof when a document request arrives.

Keep your HIPAA audit evidence organized

Book a demo to see how Pabau’s audit trail, role-based permissions and digital forms keep your safeguard evidence organized in one place.

Book a demo

Conclusion

Run the checklist before anyone asks for it. The first pass will surface items with no owner and evidence that lives only in someone’s memory. Both are cheaper to fix now than inside a 10-business-day request window.

Date every result, pass or fail, and book the next review before you close this one. A new EHR, vendor or location is reason enough to run it early.

The trade-off is a few hours of staff time against an audit file you can hand over calmly. Book a demo to see how Pabau keeps your safeguard evidence ready for the next review.

Continue your research

Choosing software that handles PHI? HIPAA compliance software covers the vendor and safeguard questions to ask before you buy.

Vetting a new vendor? HIPAA compliant software checklist turns those questions into a form you can score.

Want to know what a violation costs? HIPAA violation penalties explains the penalty tiers and what moves a case between them.

Need an up-to-date privacy notice? Notice of privacy practices template gives you a starting draft for the document OCR often asks for.

Not sure how long to keep records? How long to keep medical records sets out retention periods for clinical records alongside HIPAA documentation.

Frequently asked questions