A helpful guide to check your patient privacy compliance risk.
If the OCR requested documentation tomorrow, would you be ready?
Use this checklist to pressure-test your readiness before an audit begins. Download the PDF or check your risk below.
Continue reading below, or fill out this form for a downloadable PDF.
"*" indicates required fields
Use this checklist to assess whether your HIPAA documentation, safeguards, privacy workflows, access monitoring, vendor oversight, and breach response processes are ready to support a timely OCR audit response.
For each item, ask:
If a process exists but cannot be documented, score it as partial at best.
The process is in place, followed consistently, and evidence can be produced quickly.
The process exists, but documentation is incomplete, outdated, hard to locate, or inconsistently followed.
The process is missing, undocumented, or cannot be demonstrated with evidence.
Use when an item does not apply. For this checklist, N/A responses are treated as fully addressed for scoring purposes.
Disclaimer: This checklist is intended as an audit readiness tool, not legal advice. It should be customized based on your organization’s size, systems, workflows, risk profile, and applicable HIPAA obligations. Audit readiness depends not only on having policies in place, but also being able to prove those policies are followed in practice.
