What HHS asks to see about access control in a HIPAA audit

HHS doesn’t inspect every medical practice on a fixed schedule. Its Office for Civil Rights (OCR) reviews a practice’s access controls through periodic audits, through complaint investigations, and through reviews after a reported breach. OCR’s published audit protocol lists the questions and documents its auditors use, so it is a good guide to what a review of your access controls may look at. For each access control rule, it asks for the written policy and for records showing you follow it. Those records include access approvals, unique user IDs, lists of privileged (admin-level) and shared accounts, offboarding records, and reviewed activity logs.

When OCR looks at your access controls

The HITECH Act requires HHS to audit covered entities and business associates from time to time. OCR’s audit program page says its 2024–2025 round reviews 50 of them. It covers the Security Rule provisions most relevant to hacking and ransomware. Audits are only one route. OCR also investigates complaints and can open its own compliance reviews. Its 2024 breach report says it opens a compliance review into every reported breach affecting 500 or more people.

The duty to answer is in 45 CFR 160.310. You keep the records HHS needs to check compliance, and you cooperate with investigations and reviews. You also give HHS access to your books, records, and other information during normal business hours. Under 164.316(b), you keep your security policies and required records in writing, which may be electronic. You keep them for 6 years from the date they were created or last in effect, whichever is later.

The protocol’s general instructions set the format. Send only the documents asked for, not a binder of every policy, because auditors won’t search through compilations. Unless stated otherwise, send the versions in use on the date of the audit notice. If you can’t produce the number of samples requested, provide examples from earlier periods or a statement saying none exist.

What the protocol asks for, item by item

The protocol is a table with one row per rule. Each row has audit questions and a list of what to obtain and review. The rule itself labels only its detailed steps (implementation specifications) as required or addressable. Broader standards such as audit controls carry no label, but every covered entity must meet them. The protocol marks them “R”.

A few rows ask for more than a document. For activity review, auditors check that reviews were timely and done by the right people. They also check whether key systems can generate activity records and whether that logging is turned on. For termination, they look at how quickly access ends, whether contractors’ access ends too, and whether exit interviews cover privacy and security.

Shared and generic accounts are on the list

Under the access control standard, 164.312(a)(1), auditors ask for several lists. The first covers users with privileged access, and auditors check that each one fits your access policy. Another covers “default, generic/shared, and service accounts,” with their access levels and whether they are in use and approved. Service accounts are the ones software uses rather than a person. A third lists people who left or transferred, with records of their access being removed or changed.

OCR’s 2024 breach report shows why shared accounts get this attention. In some breaches it investigated, generic shared accounts had admin rights. Once an attacker took over one of them, they could get around the controls protecting patient data. A shared login also weakens other rows of the table. Activity logs show the account’s name, not the person’s, so a log review can’t tell who opened a record.

Addressable still needs a record

For every addressable item, the protocol asks the same follow-up: has the practice chosen an alternative measure? If so, auditors want your documentation of why the item isn’t reasonable and appropriate for you. They also want to know what equivalent measure you use instead and whether it gives the same protection, so a skipped item with no record shows up as a gap.

Getting your records ready

You can prepare for an audit or an investigation with the same work. For each row above, keep the current policy and a few recent examples showing it in use. Useful examples include approved access requests for recent hires and offboarding tickets that match departure dates. Add dated records of log reviews that show who reviewed them, and the current list of shared and service accounts with an approval for each.

If some systems can’t give each person their own login, write down who uses each shared login and how you record who used it. What records to keep for privileged account audits covers similar records for admin accounts.