Build a HIPAA Evidence Register Your Team Can Maintain

Start with a defined service and information boundary

Write a short scope record with the service name, customers or business units involved, systems, locations, suppliers and responsible owners. Describe where information is created, received, stored, used and transferred. Include supporting systems such as backups and support workflows, then record the evidence used to check the inventory.

Keep the organization's legal role separate from a product label. HHS identifies covered entities and business associates by qualifying activities and relationships. Working in healthcare or holding health information does not, by itself, settle every applicability question. Record uncertain classifications for qualified review. HHS covered entities and business associates Identify whether each record concerns electronic PHI, other PHI, or information whose classification is unresolved. The Security Rule concerns ePHI; a security evidence pack does not settle the separate privacy questions associated with other uses or disclosures. HHS Security Rule summary

Make each entry answer a specific question

Use a row for each question requiring evidence. A useful structure is:

Make each entry answer a specific question
Field	What to record
Question and scope	The control or decision being examined and the systems it covers
Owner	The person responsible for the process and the person reviewing the evidence
Evidence	A controlled link, version, date and relevant period
Observation	What the record demonstrates and what it leaves uncertain
Next action	The gap, dependency, decision or additional record needed
Review trigger	An agreed review date or change that makes the record stale
Sharing decision	Intended recipient, approval owner and any redaction or access restriction

For example, a fictional access-review entry might say: “Application A workforce access; owned by IT operations; current user export and manager review available; contractor access still awaiting confirmation; follow up with the supplier owner before marking the review complete.” The missing confirmation remains visible. A policy saying access is reviewed is evidence of the intended process; the completed review records what happened.

Keep patient records out of this organizing exercise wherever possible. Use document references and synthetic examples to describe evidence needs. Before collecting or sharing material containing PHI, the responsible team must confirm the permitted purpose, recipient, safeguards and applicable agreements.

Connect risks to the work that changes them

Link the risk analysis to a treatment record. Carry forward the affected information and systems, the threat or vulnerability, the existing safeguards, the reasoning behind the risk evaluation and the action owner. HHS risk-analysis guidance addresses the risks to all ePHI within the regulated scope and does not prescribe one universal frequency for repeating the analysis. HHS risk-analysis guidance

Separate three states: a change has been proposed; a change has been made; evidence has been reviewed against the closure criteria. A completed engineering ticket may establish that a configuration changed while leaving training, operating coverage or follow-up verification unresolved. Record those dependencies instead of closing the whole risk because one task finished.

For an addressable Security Rule specification, retain the documented evaluation and resulting decision. “Addressable” does not mean optional. HHS explains how reasonable-and-appropriate implementation and, where appropriate, an equivalent alternative fit that decision. HHS Security Rule summary

Keep supplier agreements connected to the actual service

Create a supplier entry identifying the service used, information involved, downstream dependencies and the person responsible for the relationship. Link the agreement status to that entry, along with the evidence of what your team and the supplier each operate.

HHS describes qualifying business-associate relationships, required safeguards and exceptions to business-associate agreement requirements. A vendor name or generic “HIPAA-ready” statement does not resolve the classification or contract review. Send uncertain relationships and contract terms to counsel. HHS business-associate guidance

When the service changes, check the record again. A new support tool, analytics export or subcontractor can make an old service description incomplete. Ask who reviews that change before it enters the operating environment and who updates the supporting records.

Give privacy requests and incidents their own handoffs

A security register should point to the relevant privacy procedures and their owners. HHS describes rights involving access, amendments and certain disclosures, alongside rules for permitted uses, notices and minimum-necessary information. The conditions and exceptions matter; an access-control checklist cannot answer every privacy question. HHS Privacy Rule summary

For each applicable workflow, record how a request reaches the responsible person, how the deadline is established, which systems may hold relevant information, who approves the response and where completion is recorded. A business associate should understand the support its agreements require without assuming it makes the covered entity's decisions.

Use a separate incident handoff record for suspected unauthorized access or disclosure. Record the escalation contacts, known facts, affected systems, evidence preservation steps and decisions still needed. HHS breach guidance distinguishes incidents requiring evaluation, exceptions and the circumstances affecting notice. The responsible incident team and counsel should determine applicable duties, recipients and deadlines promptly. Do not use a readiness review as a reason to delay escalation. HHS Breach Notification Rule If the plan relies on de-identification, identify who evaluated the method and the supporting record. HHS describes Expert Determination and Safe Harbor, with conditions for each. Removing names alone is not a sufficient basis for declaring a dataset de-identified. HHS de-identification guidance

Review the register before making an assurance statement

Before answering a customer, check that the evidence is current, covers the requested service and supports the wording of the answer. Describe limitations and unresolved work. Confirm who approves external sharing and use the approved channel; a customer questionnaire is not permission to send underlying patient information.

Maintain a review calendar and change triggers for systems, suppliers, access, policies and identified risks. Apply the applicable retention rules to the specific records. For required Security Rule documentation, HHS describes retention for six years after creation or the last effective date, whichever is later. That is not a universal retention schedule for every medical or operational record. HHS Security Rule summary

Choose the next action from the evidence gap. An incomplete ePHI boundary needs scope work. A documented risk with no owner needs a management decision. An unclear use or disclosure needs privacy or legal review. A control requiring a technical change needs an operational owner and an agreed way to verify completion.

HIPAA Readiness Virtual CISO

For a scoped discussion, bring the customer request and an outline of your information environment. Do not upload patient records or ePHI through a booking or contact form.

Discuss HIPAA Readiness

Common questions

Should patient records be uploaded to begin a readiness discussion?

No. Describe the service and information environment at a high level. Agree any necessary evidence scope and a suitable sharing method separately; do not submit patient records or ePHI through a public booking or inquiry form.

Does a supplier agreement remove our own responsibilities?

Connect the agreement to the service and the parties’ roles. Keep the organization’s decisions, oversight and required evidence visible rather than assuming an outsourced provider owns every duty.

Does the six-year documentation rule cover every healthcare record?

The article’s cited HHS guidance concerns required Security Rule documentation and its stated retention conditions. Medical, operational and other records can have different applicable rules; establish the relevant schedule for each record type.