HIPAA compliance checklist for Charlotte healthcare practices: A guide

Under the Health Insurance Portability and Accountability Act (HIPAA), organizations handling patient information must follow federal privacy and security standards and demonstrate reasonable efforts to protect sensitive records. Failure to meet these obligations can result in significant consequences, including federal civil penalties reaching $2,190,294 for certain violations under the 2026 penalty schedule, potential lawsuits under applicable state laws, and lasting reputational damage.

To help Charlotte healthcare practices identify gaps before they become costly problems, we’ve created a practical HIPAA compliance audit checklist covering the most important regulatory requirements.

HIPAA compliance audit checklist: 7 areas every healthcare practice should review

A thorough HIPAA compliance checklist should address three fundamental federal standards: the Privacy Rule, Security Rule, and Breach Notification Rule. Each standard serves a different purpose, but together they establish how healthcare organizations should handle sensitive information, protect electronic records, and respond when something goes wrong.

The steps below serve as a guide for reviewing your practice’s HIPAA compliance program and identifying gaps before they become costly violations.

1. Assess your organization’s HIPAA compliance obligations

Before conducting a compliance audit, determine which HIPAA requirements apply to your organization.

HIPAA generally regulates two categories of organizations:

• Covered entities: Healthcare providers that conduct certain electronic transactions, health plans, and healthcare clearinghouses. A health plan may cover a health insurance company, Medicare, Medicaid, or a qualifying group health plan.
• Business associates: Third-party organizations that create, receive, maintain, or transmit patient information while performing services for covered entities. Examples include medical billing companies, cloud hosting providers, and IT support vendors with access to patient records.

Your responsibilities depend on your role as a covered entity or business associate. Covered entities must address applicable privacy, security, and patient rights obligations, while business associates have direct responsibilities under certain HIPAA provisions. Identifying your classification provides a starting point for evaluating your HIPAA compliance status and developing an appropriate action plan.

2. Assign responsibility for HIPAA compliance

A successful HIPAA compliance program needs clear leadership and accountability. Many healthcare practices appoint a HIPAA compliance officer to coordinate compliance activities, monitor regulatory requirements, and oversee the organization’s overall compliance efforts.

HIPAA also requires organizations to designate officials responsible for privacy and security. Depending on the practice’s size and structure, the compliance officer may fill one or both roles, or these responsibilities may be assigned to separate individuals.

• HIPAA privacy officers oversee how the organization handles patient information, including disclosure practices, patient complaints, and privacy-related procedures.
• HIPAA security officers manage safeguards protecting electronic records, monitor security risks, and coordinate responses to potential threats.

Together, these officials should develop, implement, and periodically review documented policies and procedures. These HIPAA-compliant policies should explain how employees handle patient information, request access, report suspected violations, and securely dispose of records

3. Conduct HIPAA Privacy Rule audits

The HIPAA Privacy Rule establishes how organizations may use and disclose protected health information (PHI). It also grants patients important rights concerning their medical information.

Your privacy audit should examine these four areas.

• Notice of Privacy Practices (NPP): Verify that your NPP accurately explains how patient information may be used, the organization’s legal obligations, and patients’ rights. Most covered healthcare providers must make this notice available to patients and display it prominently at their facilities and on applicable websites.
• PHI inventory: Identify where patient information is collected, stored, shared, and disposed of. Include paper records, electronic health record systems, email platforms, billing applications, and third-party storage services. A complete inventory makes it easier to recognize unnecessary exposure and apply appropriate safeguards.
• Patient rights: Review procedures for handling requests to access, amend, or obtain an accounting of certain disclosures of medical records. Under HIPAA, a covered organization typically has 30 calendar days to respond to a patient’s request for access to their records. A qualifying extension of up to 30 additional days is permitted with timely written notice.
• Permissible uses and disclosures: Evaluate when staff members may disclose protected health information without patient authorization, including for treatment, payment, and healthcare operations. Other disclosures may require written authorization. Verify that employees understand these distinctions and follow the minimum necessary standard where applicable.

4. Review business associate agreements

HIPAA requires covered entities to establish written business associate agreements (BAAs) with vendors handling PHI on their behalf before sharing the information. These agreements define permitted uses and disclosures, establish security responsibilities, outline breach reporting requirements, and specify how patient information must be handled when the business relationship ends.

As part of your compliance audit:

• Review your vendor list to identify all third parties that handle PHI on your behalf.
• Verify existing agreements to confirm you have established business associate agreements with every applicable vendor.
• Check agreement details to confirm they are current and accurately reflect the services being provided.
• Evaluate vendor security practices periodically, particularly for providers with access to large volumes of patient information. Although HIPAA does not require formal audits of every vendor, ongoing oversight helps identify potential security weaknesses.

5. Audit HIPAA Security Rule safeguards

The HIPAA Security Rule requires healthcare organizations to protect ePHI against unauthorized access, alteration, and loss. Meeting these requirements involves a combination of administrative, technical, and physical security measures that address how patient information is handled, how systems are protected, and who can access sensitive records.

Review the following safeguards to identify potential security gaps and determine where additional protections may be needed.

Administrative safeguards

• Assigned responsibility: Appoint a HIPAA security officer to create and carry out your organization’s security policies.
• Security risk assessments: Conduct a comprehensive assessment to identify risks and vulnerabilities affecting ePHI. Perform periodic risk assessments, preferably annually and after significant operational changes.
• Risk management: Document identified weaknesses and implement corrective security measures to reduce risks to reasonable levels.
• Workforce security: Establish procedures for authorizing, supervising, and removing employee access to sensitive records.
• HIPAA training: Provide ongoing security awareness training covering phishing, malware, password protection, and employee responsibilities.
• Security incident procedures: Establish documented procedures for identifying, responding to, and reporting security incidents.
• Contingency planning: Maintain a contingency plan covering data backups, disaster recovery, emergency operations, and required testing and revision procedures.

Technical safeguards

• Access controls: Restrict ePHI access using unique user IDs, role-based permissions, emergency access procedures, and appropriate session controls.
• User authentication: Verify user identities using secure login credentials and evaluate multifactor authentication (MFA) for stronger protection.
• Network security: Protect healthcare networks through firewalls, intrusion detection, secure Wi-Fi, and network segmentation where appropriate.
• Endpoint protection: Install anti-malware software, maintain security updates, and implement endpoint detection tools on devices accessing patient records.
• Data encryption: Verify that ePHI is encrypted at rest and in transit where appropriate, document the measures in place, and address any identified gaps based on your security risk assessment.
• Audit controls and monitoring: Maintain system activity logs and regularly review them for unusual activity, unauthorized access, or suspicious changes.
• Vulnerability management: Conduct vulnerability scans, address security weaknesses, and apply software patches to reduce exposure to cyberattacks.
• Backup and recovery systems: Maintain secure, regularly tested backups and appropriate recovery capabilities to restore critical patient information after system failures or cyberattacks.

Physical safeguards

• Facility access controls: Install electronic keycard systems, keypad locks, or biometric scanners to restrict entry to areas containing sensitive patient information.
• Surveillance and monitoring: Use security cameras, intrusion alarms, and visitor sign-in logs to monitor access to restricted areas.
• Server and equipment security: Store servers, backup drives, and networking equipment in locked rooms or cabinets accessible only to authorized personnel.
• Workstation protection: Position computer monitors away from public view, install privacy screens, and use physical locks or secure storage for laptops and portable devices.
• Environmental protection: Install smoke detectors, fire suppression systems, temperature monitoring, and uninterruptible power supplies (UPS) to protect critical IT equipment against physical damage.
• Device and media disposal: Securely wipe or physically destroy hard drives, USB devices, and other storage media containing ePHI before disposal or reuse.
• Equipment tracking: Maintain an inventory of devices containing ePHI and record their movement, assignment, maintenance, and disposal.

6. Examine audit logs and documentation

Under HIPAA, organizations must keep tabs on activity within their systems and hold onto documentation that proves they are meeting the rule’s requirements. During your HIPAA audit, review system logs for suspicious activity, such as unauthorized access attempts, unusual login patterns, or unexpected changes to user permissions.

Also, verify that relevant policies, risk assessments, training records, and other required compliance documentation are properly maintained. HIPAA requires these records to be retained for six years from their creation or last effective date, whichever is later. 

Keep in mind that medical record retention requirements vary by state, facility type, and patient population. In North Carolina, hospitals must retain adult patient records for 11 years. Records for minors generally must be kept until the patient reaches age 30, and different timelines may apply to physician practices, long-term care facilities, and mental health providers. Because these rules may change, make sure to regularly review the current requirements with the North Carolina Department of Health and Human Services or your legal counsel.

7. Verify HIPAA breach notification procedures

A data breach can expose sensitive patient records, making a prompt and organized response essential. Under the HIPAA Breach Notification Rule, healthcare organizations must investigate suspected breaches of unsecured protected health information and notify the appropriate parties when reporting is required.

Your breach notification procedures should clearly identify who handles investigations, how affected individuals are contacted, and which reporting deadlines apply. Federal breach notification rules establish the following requirements:

• Notify affected individuals: Send written notices by first-class mail or email if patients have agreed to electronic notifications. Notices must be sent without unreasonable delay and within 60 calendar days of discovering a reportable breach, regardless of how many people are affected.
• Report the breach to HHS: Submit an electronic report through the HHS website within 60 days if 500 or more individuals are affected. Smaller breaches must be documented and reported within 60 days after the end of the calendar year in which they were discovered.
• Notify the media: If a breach affects more than 500 residents of a particular state or jurisdiction, inform prominent media outlets serving that area, typically through a press release, within 60 days of discovery.

If contact information is unavailable for 10 or more affected individuals, HIPAA also requires alternative notification methods, such as a prominent website announcement or notice through major media outlets.

Strengthen your HIPAA compliance with Refresh Technologies

Maintaining HIPAA compliance requires ongoing attention to security, documentation, employee practices, and changing business risks.

For Charlotte healthcare practices, Refresh Technologies offers HIPAA-focused IT support, compliance gap assessments, cybersecurity solutions, and practical guidance to strengthen patient data protection.

Our team can audit your IT infrastructure and implement the right measures to meet compliance standards. Contact us today to discuss your HIPAA compliance needs and build a stronger foundation for protecting patient information.