IT Compliance Audit Checklist for Healthcare

A HIPAA compliance audit can be triggered by an OCR investigation, a business associate request, a cyber insurance application, or your own internal governance requirements. Regardless of the trigger, the preparation is the same: you need to demonstrate that your IT infrastructure protects electronic protected health information through documented, verifiable controls.

This checklist walks through the specific IT artifacts, configurations, and documentation an auditor will expect to see. It's organized by audit phase so your team can work through it systematically.

Phase 1: Pre-Audit Inventory (2-4 Weeks Before)

Before an auditor arrives, you need a complete picture of your IT environment. Most audit failures start with incomplete inventories — you can't protect what you don't know about.

1.1 ePHI System Inventory

Document every system that stores, processes, or transmits electronic protected health information:

• EHR/EMR systems — Primary clinical system, version, hosting location (on-premise, cloud, hybrid)
• Practice management software — Scheduling, billing, patient demographics
• Email systems — Any email accounts that send or receive patient information
• File storage — Network drives, cloud storage, shared folders containing patient documents
• Imaging systems — PACS, X-ray, dental imaging that stores patient images
• Communication platforms — Fax, eFax, secure messaging, telehealth platforms
• Backup systems — Where backups are stored and whether they contain ePHI
• Mobile devices — Any phones, tablets, or laptops that access ePHI

For each system, document: system name, vendor, version, hosting location, data classification (ePHI yes/no), access method, number of users, and the business associate agreement status.

1.2 Network Diagram

Create or update a network diagram showing:

• All network segments (clinical, administrative, guest, IoT/medical devices)
• Firewall placement and rules summary
• VPN endpoints and remote access paths
• Internet connection points
• Wireless access points and SSID assignments
• Server locations (on-premise racks, cloud providers)

Auditors use the network diagram to trace data flows and identify potential exposure points. An outdated diagram is almost as bad as no diagram.

1.3 User Access Inventory

For each ePHI system, document:

• Complete list of users with access
• Access level (admin, read-write, read-only)
• Last login date
• Whether access is still appropriate for the user's current role
• Any shared or generic accounts (these should be eliminated)

This is where governed execution pays off — if your IT platform automatically logs every access provisioning and deprovisioning event, you have an audit-ready access history without manual documentation.

Phase 2: Technical Controls Verification (1-2 Weeks Before)

With your inventory complete, verify that each required control is in place and functioning.

2.1 Access Controls

• Verify unique user IDs — No shared accounts on any ePHI system. Every person has their own login.
• Test automatic logoff — Walk to each workstation type and verify it locks after the configured timeout (15 minutes or less for clinical workstations).
• Verify role-based access — Spot-check 5-10 users to ensure their access matches their job function. A billing clerk shouldn't have clinical note access.
• Test emergency access — Verify your break-glass procedure works. Can authorized personnel access critical systems during an outage?
• MFA verification — Confirm multi-factor authentication is enabled for remote access, admin accounts, and cloud services.

2.2 Audit Controls

• Verify logging is enabled — Check every ePHI system for active audit logging. Verify log entries include: who, what, when, where, and success/failure.
• Verify log retention — Confirm logs are retained for at least 6 years (HIPAA documentation retention requirement).
• Pull sample log reports — Generate audit log reports from each major system. An auditor will ask for these.
• Review log alert configuration — Verify alerts are configured for: failed login attempts, after-hours access, admin privilege escalation, and bulk data access.

2.3 Encryption

• Verify encryption at rest — Check BitLocker/FileVault status on all endpoints. Verify database encryption on servers. Check backup encryption.
• Verify encryption in transit — Test TLS configuration on web-facing services. Verify VPN encryption. Check email transport encryption.
• Document encryption standards — Record which encryption algorithms and key lengths are in use (AES-256 minimum for most purposes).

2.4 Network Security

• Firewall rule review — Document active firewall rules. Remove any rules that are no longer needed. Verify default-deny policies.
• Wireless security check — Verify WPA3 or WPA2-Enterprise on clinical networks. Confirm guest network isolation from clinical networks.
• Vulnerability scan — Run an internal vulnerability scan. Document findings and remediation plan for critical/high findings.
• Patch status — Generate a patch compliance report for all systems. Document any exceptions and compensating controls.

Phase 3: Documentation Review (1 Week Before)

HIPAA audits are as much about documentation as technical controls. You need written policies, procedures, and evidence of implementation.

3.1 Required Policies

Verify you have current, approved versions of:

• Information Security Policy (overarching policy covering all HIPAA requirements)
• Access Control Policy (who gets access, how it's granted and revoked)
• Acceptable Use Policy (how workforce members may use IT systems)
• Incident Response Plan (how security incidents are handled)
• Disaster Recovery / Business Continuity Plan
• Data Backup and Retention Policy
• Mobile Device and Remote Access Policy
• Password Policy (complexity, rotation, storage)
• Sanctions Policy (consequences for violations)
• Workforce Training Policy

Each policy should show: approval date, next review date, approving authority, version number. Policies should be reviewed annually at minimum.

3.2 Risk Analysis

The HIPAA risk analysis is the single most important document in an audit. You must have a current, comprehensive risk analysis that:

• Identifies all ePHI locations and flows
• Lists reasonably anticipated threats and vulnerabilities
• Assesses the likelihood and impact of each threat
• Documents current security measures
• Determines risk levels
• Documents risk treatment decisions (accept, mitigate, transfer, avoid)

A risk analysis should be updated annually and whenever significant changes occur (new systems, new locations, organizational changes, security incidents).

3.3 Evidence of Implementation

Policies without evidence of implementation are worthless in an audit. Gather:

• Training records — Sign-off sheets or LMS completion records for all workforce HIPAA training
• Access review records — Documentation of quarterly or semi-annual access reviews
• Incident response tests — Records of tabletop exercises or actual incident responses
• Backup test records — Evidence of backup restoration tests (quarterly recommended)
• Vulnerability scan results — Historical scan results showing remediation progress
• BAA inventory — Signed BAAs for all business associates, with contact information and review dates

Phase 4: Audit Day Preparation

4.1 Organize Your Evidence Binder

Create an organized repository (digital or physical) with:

1. ePHI system inventory with BAA status
2. Network diagram
3. Current risk analysis
4. All security policies (dated and approved)
5. Access control evidence (user lists, role definitions, review records)
6. Audit log samples from each ePHI system
7. Encryption verification reports
8. Training completion records
9. Incident response plan and test records
10. Business continuity plan and test records
11. Vulnerability scan results and remediation documentation
12. BAA inventory with signed copies

4.2 Designate Your Audit Team

• Primary contact — One person who coordinates all auditor requests
• IT technical lead — Can demonstrate technical controls and pull reports on demand
• Privacy officer — Can speak to administrative policies and training
• Management representative — Can authorize access to any system or document the auditor needs

Common Audit Failures and How to Avoid Them

1. Incomplete risk analysis — The number one finding. Don't use a generic template. Your risk analysis must be specific to your organization, your systems, and your threats.
2. Stale documentation — Policies dated 3 years ago with no evidence of review. Update dates and review annually.
3. Missing BAAs — Every cloud service, IT vendor, and contractor that touches ePHI needs one. Check your email provider, your backup service, your phone system vendor.
4. No evidence of access reviews — Saying "we review access quarterly" without documentation to prove it means you don't.
5. Shared accounts — Generic "front desk" or "billing" accounts that multiple people use. Every person needs their own unique login.
6. Unencrypted portable devices — Any laptop, USB drive, or phone that accesses ePHI must have full-device encryption.

How TechManager AI Simplifies Audit Preparation

TechManager AI's compliance dashboard provides real-time audit readiness scores across every HIPAA requirement. Every IT action flows through governed execution, creating automatic audit trails that satisfy documentation requirements without manual logging. Access provisioning and deprovisioning events are tracked automatically, access reviews can be generated on demand, and the knowledge base stores all your policies in a searchable, version-controlled repository.

For healthcare practices, the compliance package includes pre-built HIPAA policy templates, automated risk assessment workflows, and a signed BAA — giving you a significant head start on audit preparation.

Next Steps

Start with Phase 1 of this checklist at least 4 weeks before your audit. The inventory phase always takes longer than expected because it reveals systems and access you didn't know about. If you need a comprehensive HIPAA IT requirements reference, start with our HIPAA IT Requirements Checklist.

For healthcare organizations looking to automate compliance monitoring, book a demo to see TechManager AI's compliance dashboard and governed execution in action.