⚡ Promptolis Original · Healthcare & Medical
🔒 HIPAA Compliance Audit — Practical Assessment For Healthcare Organizations
The structured HIPAA audit covering Privacy + Security + Breach Notification Rules, the 5 administrative safeguards, physical safeguards, technical safeguards, risk assessment methodology, and the pragmatic compliance framework that keeps you audit-ready.
Why this is epic
HIPAA violations can result in fines from $100 to $1.5M per violation. Most organizations have compliance gaps they don't know about. This Original produces structured audit + remediation framework.
Names the 6 HIPAA compliance gaps (no risk assessment / outdated policies / weak BAAs / audit log gaps / training gaps / breach response unprepared).
Produces complete framework. NOT legal advice. HIPAA-specialized attorney for formal compliance.
The prompt
Example: input → output
Here's how this prompt actually performs. Real input below, real output from Claude Opus 4.
<organization-context>Mid-size specialty clinic. 45 employees including clinical staff. Handles PHI for 15,000 active patients. Uses Epic EHR.</organization-context> <current-compliance>Policies last updated 3 years ago. Annual training done but low engagement. BAAs with most vendors but unclear which ones.</current-compliance> <recent-incidents>One minor incident last year — fax sent to wrong number. Handled internally but didn't notify patient (potentially reportable).</recent-incidents> <technology-stack>Epic EHR, Microsoft 365, patient portal, billing system (Athenahealth), telehealth (Doxy.me).</technology-stack> <team>No dedicated compliance officer. Practice manager handles part-time.</team> <concerns>(1) BAA inventory unclear. (2) Training is check-the-box. (3) No formal incident response plan. (4) Technology controls unclear.</concerns> <timeline>Comprehensive review over 90 days.</timeline>
HIPAA Compliance Audit: Mid-Size Specialty Clinic, 45 Employees, 15K Patients
A HIPAA compliance audit produces systematic assessment across Administrative + Physical + Technical safeguards. NOT legal advice. Your situation — policies outdated, unclear BAAs, no compliance officer, recent (unhandled) incident — has multiple gaps requiring remediation. This 90-day plan addresses priority issues with attorney review for specific areas.
Administrative Safeguards (Required Standards)
1. Security Management Process
- Risk Analysis (required)
- Risk Management (required)
- Sanction Policy (required)
- Information System Activity Review (required)
Your status: partial — policies exist but outdated.
Action: update risk analysis + management + sanction policy.
2. Assigned Security Responsibility
- Designated Security Officer (required)
Your status: part-time role through practice manager. Insufficient for 45-employee practice.
Action: designate formal Security Officer (can be same person with formal designation + time allocation).
3. Workforce Security
- Authorization + supervision
- Workforce clearance procedures
- Termination procedures
Your status: informal. No documented procedures for access management.
Action: formalize + document. Particularly termination procedures (ending access promptly).
4. Information Access Management
- Isolating healthcare clearinghouse function (if applicable)
- Access authorization
- Access establishment + modification
Your status: Epic has role-based access. Good.
Action: document formal policies.
5. Security Awareness + Training
- Security reminders
- Protection from malicious software
- Log-in monitoring
- Password management
Your status: annual training done but 'check-the-box' nature = insufficient.
Action: revamp training with engagement + testing + quarterly reminders.
6. Security Incident Procedures
- Response + reporting (required)
Your status: last year's incident wasn't handled correctly — reportable but not reported.
Action: formal incident response plan + breach notification process.
7. Contingency Plan
- Data backup
- Disaster recovery
- Emergency mode operation
- Testing + revision
- Applications + data criticality analysis
Your status: Epic has backups. Formal plan absent.
Action: document + test contingency plan.
8. Evaluation
- Periodic evaluation of security safeguards
Your status: not done systematically.
Action: annual security evaluation + after major changes.
9. Business Associate Agreements
- Written contracts with all vendors handling PHI
Your status: unclear inventory + status.
Action: complete BAA audit + update missing.
Physical Safeguards
Required standards:
- Facility Access Controls: locked facility, access logs, contingency operations, maintenance records
- Workstation Use + Security: policies for PHI-accessing workstations, appropriate physical safeguards
- Device + Media Controls: disposal, re-use, accountability, data backup + storage
Your typical status (practices):
- Facility secured after hours
- Workstation positioning prevents casual viewing
- Laptop encryption for portable devices
- Paper records locked
Audit actions:
- Verify all PHI-accessing computers in appropriate locations
- Confirm laptop encryption
- Document disposal procedures (paper + electronic)
- Review maintenance access procedures
Technical Safeguards
1. Access Control
- Unique user identification (required)
- Emergency access procedure
- Automatic logoff
- Encryption + decryption
Your status: Epic has unique login + role-based access + automatic logoff. Encryption for EHR + Microsoft 365.
Action: verify compliance + document.
2. Audit Controls
- Mechanism to record + examine activity
Your status: Epic has audit logs. Review practices unclear.
Action: regular audit log review + suspicious activity investigation.
3. Integrity Controls
- PHI not improperly altered or destroyed
Your status: Epic has change tracking.
Action: document + verify backup integrity.
4. Transmission Security
- Integrity controls
- Encryption
Your status: Epic + patient portal encrypted. Email potentially unencrypted PHI (?)
Action: secure email solution for PHI transmission. Verify all transmission encryption.
Privacy Rule Compliance
Key elements:
Notice of Privacy Practices (NPP)
- Provided to patients
- Posted in facility
- Available on website
- Updated as practices change
Patient Rights
- Access to records
- Amendment requests
- Accounting of disclosures
- Restriction requests
- Confidential communications
- Complaint filing
Your status: NPP exists. Patient rights process unclear.
Action: document patient rights process + ensure staff trained to handle requests.
Uses + Disclosures
- Treatment, Payment, Operations (TPO) — allowed
- Other uses require authorization
- Minimum necessary standard
Your status: generally compliant but documentation gaps.
Action: review disclosure log + ensure authorization where needed.
Authorization Requirements
- Written authorization for disclosures beyond TPO
- Specific elements required
- Revocable by patient
Your status: unknown detail.
Action: review authorization form + process.
Breach Notification Readiness
Required procedures:
Breach Definition
- Acquisition, access, use, or disclosure of PHI that compromises privacy or security
- Presumed unless demonstrated low probability of compromise
Notification Requirements
To affected individuals:
- Within 60 days of discovery
- Plain language description
- Specific information (what data, what steps taken)
To OCR (HHS Office for Civil Rights):
- <500 affected: annual report
- 500+ affected: within 60 days
To Media:
- 500+ affected in specific state: within 60 days
Your Recent Incident (Wrong-Fax)
Likely a reportable breach:
- PHI disclosed to unintended recipient
- Not handled correctly
- Probably needed notification + OCR report
Recommended: consult HIPAA attorney about remediation. Late notification better than none, but may trigger OCR investigation.
Breach Response Plan (Missing — Create)
Required elements:
1. Incident detection + reporting (who, how, when)
2. Initial containment
3. Breach assessment (is it a breach?)
4. Investigation + documentation
5. Notifications (individuals, OCR, media if applicable)
6. Mitigation + prevention
7. Documentation retention
Business Associate Agreements
BAA needed for ALL vendors handling PHI:
Audit Your Vendor List
Obvious vendors (BAA critical):
- Epic (EHR) ✓
- Athenahealth (billing) ✓ likely
- Doxy.me (telehealth) ✓ likely
- Microsoft 365 ✓ likely
Potentially missed vendors:
- Cloud backup services
- Email encryption services
- Fax services
- Transcription services
- Dictation software
- Document management systems
- IT support services (if access PHI)
- Shredding companies
- Cleaning services (access to facilities)
BAA Requirements
Must include:
- PHI uses + disclosures
- Safeguards
- Breach notification
- Return + destruction at termination
- Subcontractor handling
- Termination rights
Action Steps:
1. Complete vendor inventory
2. Identify each vendor's PHI access
3. Collect signed BAAs
4. Replace vendors without BAA capability
5. Document BAA library + renewal tracking
Risk Assessment Framework
Annual minimum (HIPAA required):
Scope Assessment
- All PHI locations (physical + electronic)
- All systems
- All workforce roles
- All business associates
Threat Identification
- External (cyberattacks, natural disasters)
- Internal (workforce errors, malicious)
- Environmental (equipment failure, human error)
Vulnerability Identification
- Technical (unpatched systems, weak encryption)
- Physical (unlocked files, visible screens)
- Administrative (insufficient training, weak policies)
Risk Determination
- Likelihood × Impact = Risk level
- Prioritize by risk level
Risk Mitigation
- High risk: immediate action
- Medium risk: planned remediation
- Low risk: accept or monitor
Documentation
- Risk assessment report
- Mitigation plan
- Implementation status
- Residual risk accepted
Training Program
Current state: annual check-the-box training = insufficient.
Revamped program:
Annual Training
- Comprehensive 60-90 min course
- Role-specific modules
- Practical scenarios
- Testing with passing threshold (80%+)
Quarterly Reminders
- 10-15 min refresher topics
- Current threats (phishing, social engineering)
- Recent incident lessons
- Policy updates
New Hire Training
- Within 30 days of employment
- Before PHI access granted
- Documentation of completion
Role-Specific Training
- Clinical staff: patient interaction + records
- Billing: payment data handling
- IT: security operations
- Leadership: oversight + governance
Documentation
- Training completion records
- Test scores
- 6-year retention
Gap Analysis + Remediation Plan (90 Days)
Week 1-2: Assessment + Foundation
- Risk assessment kicked off
- Compliance officer formally designated
- BAA inventory started
- HIPAA attorney consultation for recent incident
Week 3-6: Documentation + Policy
- Updated policies + procedures
- Incident response plan drafted
- Contingency plan documented
- BAA gaps identified
Week 7-10: Technology + Training
- Technical safeguards verified
- Secure email solution if needed
- Training program redesigned
- Audit logging review
Week 11-12: Validation + Handoff
- Risk assessment complete
- Gap remediation plan
- Ongoing compliance calendar
- Leadership sign-off
Budget estimate:
- HIPAA attorney: $5-15K for review + incident advice
- Compliance consultant: $10-20K for comprehensive audit + remediation
- Technology upgrades (if needed): $5-15K
- Training program: $3-5K
- Total: $25-55K for 90-day remediation
Ongoing annual cost:
- $15-25K for annual compliance activities (attorney + consultant + training + risk assessment)
Key Takeaways
- Significant gaps identified: outdated policies, unclear BAAs, no formal Security Officer, 'check-the-box' training, unhandled prior incident. 90-day remediation required.
- Prior fax incident likely reportable breach. Consult HIPAA attorney about remediation + OCR notification. Late notification better than none.
- BAA audit critical: complete inventory of ALL vendors handling PHI + ensure signed BAAs. Miss one = compliance gap + potential liability.
- Training program overhaul: annual + quarterly + role-specific. Testing with 80%+ passing threshold. Currently 'check-the-box' = inadequate.
- Budget $25-55K for 90-day remediation + $15-25K annual ongoing. HIPAA fines $100-1.5M/violation. Compliance investment 10-100x less than breach costs.
Common use cases
- Healthcare practices preparing for HIPAA audit
- Post-incident compliance review
- New practice establishing compliance
- Technology vendors serving healthcare (BAA requirements)
- Telehealth platforms
Best AI model for this
Claude Opus 4 or Sonnet 4.5. HIPAA compliance requires regulatory + security + operations understanding. Top-tier reasoning matters. NOT legal advice.
Pro tips
- NOT legal advice. Specialized HIPAA attorney + consultant for formal compliance.
- Risk assessment is annual minimum + event-driven.
- Business Associate Agreements (BAAs) for all vendors handling PHI.
- Audit logs retained 6 years.
- Employee training annual.
- Breach notification 60 days (notification to OCR within 60 days; to affected individuals within 60 days; some states tighter).
- Physical safeguards (locked files, clean desk, etc.) still matter.
- Technical safeguards (encryption, access control) increasingly critical.
Customization tips
- HIPAA compliance is ongoing, not point-in-time. Annual risk assessment + continuous monitoring.
- Document everything. OCR audits review documentation first.
- Incident response drills quarterly. Staff readiness matters when incident happens.
- BAA template + tracking system. New vendors automatically require BAA review.
- State laws may be stricter than HIPAA. California CCPA/CMIA + others. Compliance must address all applicable.
Variants
Small Practice Audit
<10 employees.
Mid-Size Healthcare Org
50-500 employees.
Enterprise Health System
Large systems.
Healthcare Tech Vendor
Business associate.
Frequently asked questions
How do I use the HIPAA Compliance Audit — Practical Assessment For Healthcare Organizations prompt?
Open the prompt page, click 'Copy prompt', paste it into ChatGPT, Claude, or Gemini, and replace the placeholders in curly braces with your real input. The prompt is also launchable directly in each model with one click.
Which AI model works best with HIPAA Compliance Audit — Practical Assessment For Healthcare Organizations?
Claude Opus 4 or Sonnet 4.5. HIPAA compliance requires regulatory + security + operations understanding. Top-tier reasoning matters. NOT legal advice.
Can I customize the HIPAA Compliance Audit — Practical Assessment For Healthcare Organizations prompt for my use case?
Yes — every Promptolis Original is designed to be customized. Key levers: NOT legal advice. Specialized HIPAA attorney + consultant for formal compliance.; Risk assessment is annual minimum + event-driven.
Explore more Originals
Hand-crafted 2026-grade prompts that actually change how you work.
← All Promptolis Originals