Common HIPAA Documentation Gaps

When an organization receives a request for compliance documentation, from a regulator, a payer, a hospital partner, or its own board, the question quickly becomes practical: what can we actually produce?

In our experience, the gaps that surface are usually not about intent. The organization did the training, hired the IT provider, and bought the policy manual. The problem is that the evidence is stale, scattered, or never existed. These are the gaps we see most often.

The risk analysis is out of date

A risk analysis completed years ago, before the current EHR, the new location, or the shift to remote work, may not describe the organization as it is today. Often there is also no record of what was done about the risks it identified. See What Is a Security Risk Analysis?

Policies exist but are not followed

Template policies frequently describe processes the organization does not use, roles it does not have, or systems it replaced. A policy that says one thing while staff do another can undermine an organization's position.

Close the gap: review policies against actual workflows, adopt them formally, and record review dates and revisions.

Training records are incomplete

Training happened, but attendance was not tracked, records are spread across managers, or new hires were missed. Training that cannot be shown is difficult to prove.

Close the gap: keep one training record with each workforce member, the training completed, and the date.

Business Associate Agreements are scattered or missing

Agreements sit in email, in individual departments, or with the vendor. Some vendors with PHI access have none at all.

Close the gap: maintain a vendor inventory that records PHI access and agreement status. See When Is a Business Associate Agreement Needed?

Incidents were handled but not recorded

Staff fixed a misdirected email or locked a compromised account, but nobody documented the incident, the assessment, or the outcome.

Close the gap: keep an incident log, including events that turned out not to be breaches.

Fixes were never documented

The IT provider enabled multi-factor authentication, or a manager restricted access, but there is no record of what changed or when. Without documentation, completed remediation looks the same as no remediation.

Access reviews do not happen

Former employees retain accounts, staff keep access from previous roles, and shared logins persist. Even where access is managed well, there is often no record of review.

Ownership is unclear

Compliance tasks fall between the administrator, the IT provider, and leadership. Each assumes another is handling it.

Close the gap: name an owner for each documentation area and a schedule for reviewing it.

Keep it for six years

HIPAA requires covered entities to retain required documentation for six years from the date of creation or the date it was last in effect, whichever is later (45 CFR 164.316(b)(2) and 164.530(j)). Replacing a policy does not mean discarding the old version.

A simple readiness record

Many of these gaps are prevented by one organized record listing each documentation area, its current version or status, its owner, and its next review date. Our HIPAA Readiness Checklist is a starting point.