HIPAA Documentation & Evidence Checklist

Instructions

How to use this workbook

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

What this list is. It is what the Rule and HHS guidance say should be written down, and what would show each readiness item. It is not a list of what any authority, customer or auditor will ask for; a request names what it wants.

EXAMPLE: Acme Corp (EXAMPLE), a US software-as-a-service provider with about 250 staff, whose hosted patient-messaging and appointment service is used by about 60 clinics and small hospital groups, as at 2026-09-30: 14 ready, 10 partly ready, 3 not ready and 3 not applicable (it has no group health plan, no hybrid entity and no annual log of smaller breaches). Each row not fully ready has a gap in the tracker.

This document helps a security team see what the HIPAA Security Rule and the breach notification rules ask of an organisation like yours, and what it could show. It is not legal advice. It does not say that you are compliant with HIPAA or that you are certified, and the Rules provide no certificate of compliance. Whether HIPAA applies to your organisation, in which role, and what a breach or a contract requires are for counsel to confirm. The notification deadlines are in P09 (RD-17 to RD-20) and P18, and are not repeated here.

Limits. Six years is the minimum for the documentation the Security Rule requires. State law, a contract, a legal hold or another Rule may set longer; counsel confirms. Records may contain protected health information, so keep them where access is controlled. The Privacy Rule's own documentation and the proposed Security Rule changes (90 FR 898, a proposal, not applied) are not covered here.

Tailoring. A small organisation can answer several rows with one document: name it against each row it answers. Where a group or a service provider holds a record, name it, say where your copy is, and put the right to it in the contract (P06-A07 clauses).

Evidence

The documents and records to keep ready. Yellow columns are yours; Keep until, About the date and Check calculate. Do not type over the white columns.

Addressable Decisions

One row for each of the 22 addressable implementation specifications. Assess each, then record what you decided and why (164.306(d)(3)). Yellow columns are yours.

Retention

How long to keep it

HR-13, with a calculator. The Security Rule sets 6 years for the documentation it requires. This sheet works out the last day of that period.

The rule

Documentation is kept in writing (electronic is allowed) for six years from the date it was created or the date it was last in effect, whichever is later. A policy that was replaced keeps its six years from the day it stopped being in effect. The paragraph is 45 CFR 164.316(b)(2)(i), "Time limit". It counts 6 years "from the date of its creation or the date when it last was in effect, whichever is later". It covers what 164.316(b)(1) requires: the written policies and procedures, and a written record of any action, activity or assessment the Rule requires to be documented.

Where the checklist lists a record only because it shows a readiness item (the basis "Shows the item (pack practice)"), 6 years is the pack's practice, not a paragraph's. Where another law, a contract or a legal hold sets a longer time, the longer time applies; counsel confirms. The date here is the last day you must keep the record; the earliest day you may dispose of it is the day after, and only if nothing else says to keep it.

Calculator

Worked examples

Points to remember

1. A document still in force has not started its six years. Its date counts from creation and moves later when it is replaced or withdrawn. Never dispose of anything still in force.

2. Each version is a document of its own. A replaced policy keeps six years from the day it stopped being in effect (row EV-02).

3. Disposal is a decision. Write down what was disposed of, when and on whose authority; that note is itself a record.

Counts

Counts

Calculated from the Evidence and Addressable Decisions sheets. Counts only: there is no score and no percentage.

EXAMPLE: the example organisation's checklist. Clear the EXAMPLE rows to use your own.

By status

By owner role

A row whose owner role is blank or not on the list is counted in no role. Use the Owner role list.

Rows that need attention

Addressable decisions

Row EV-23 on the Evidence sheet is Ready only when every addressable specification has a decision on record and no row is flagged.

If Someone Asks

If someone asks for it

Who produces what, and how to hand records over. The list is what the Rule and HHS guidance say should be written down; it is not a list of what anyone will ask for.

Before anything arrives

Know which records you can produce. The Status column on the Evidence sheet says: Ready rows can be handed over; Partly ready rows can be handed over in part, and you say which part is missing; Not ready rows cannot, and you do not make them to order. Describe a record as it is, with its real date. Never change a date, or write a record to look as if it had always been there.

The Rule makes documentation available to the people who carry out the procedures it describes (45 CFR 164.316(b)(2)(ii)). It sets no time for anything else, and this pack states none. A request names its own date; the letter, contract or order sets it, so read the deadline there. If you need more time, ask for it in writing and early. Background only, not a forecast: OCR's Risk Analysis Initiative focuses select investigations on the Risk Analysis provision, and its fifth action (HHS press release, 21 March 2025, Health Fitness Corporation) found a failure to conduct an accurate and thorough risk analysis. Have the signed analysis ready. Your own target for assembling a set of records is your decision: [[number]] working days, written in your procedure.

Who produces what

Where to start

When a request arrives

Not covered here: answering a breach notice, a complaint or a legal demand, which counsel leads; what the Privacy Rule gives an individual who asks for their own records; the contents of any one request.

Lists

HR lead

Facilities lead

Vendor owner

Legal counsel

Privacy lead

Definitions

Definitions

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Editions referenced: 45 CFR Parts 160 and 164 as the eCFR prints them (current to 6 October 2026); HITECH Act provisions at 42 U.S.C. 17931, 17934 and 17941; HHS Office for Civil Rights guidance on risk analysis, business associates and unsecured protected health information; NIST SP 800-66 Rev. 2 (informative); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); as published and read on 18 October 2026

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of the HIPAA Rules, or that your organisation holds a certificate.

The HIPAA Rules in 45 CFR Parts 160 and 164 apply to covered entities (health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with standard transactions) and, where the Rules provide, to business associates and their subcontractors. Whether your organisation is one of them is decided by what it does with protected health information, and counsel confirms it. The Security Rule (Subpart C) protects electronic protected health information. The Breach Notification Rule (Subpart D) applies to breaches of unsecured protected health information. This pack does not decide which applies to you.