HIPAA Security & Privacy Audit
September 2026

HIPAA Compliance Audit Report

Client: Riverside Medical Practice · Audit Period: Q3 2026 · Auditor: Sarah Kim, CPHIMS
45Controls Tested
43Compliant
2Findings
96%Compliance Rate

Administrative Safeguards

Security Management Process
100%
✓
Risk Analysis Completed
Annual risk analysis conducted June 2026; documented threats, vulnerabilities, and mitigation strategies
✓
Risk Management Plan
Formal risk management plan in place with assigned responsibilities and implementation timeline
✓
Sanction Policy
Written policy for disciplinary action against workforce members who violate HIPAA rules; three incidents documented in past year with appropriate follow-up
✓
Information System Activity Review
Monthly review of system logs and access reports; documentation maintained for required retention period
Workforce Security
100%
✓
Authorization and Supervision
All workforce members have documented authorization for system access; supervision procedures in place
✓
Workforce Clearance
Background checks completed for all staff with PHI access prior to granting access
✓
Termination Procedures
Process for removing system access upon termination; tested with 3 recent terminations - access removed within 24 hours

Physical Safeguards

Facility Access Controls
100%
✓
Facility Security Plan
Written plan addresses physical access to facilities containing PHI; badge access system logs maintained
✓
Access Control & Validation
Badge system requires PIN; visitor log maintained; quarterly access review performed
Workstation & Device Security
100%
✓
Workstation Security Policy
Policy addresses workstation placement, privacy screens, and automatic logout (10 min timeout)
✓
Device & Media Controls
Procedures for disposal, media reuse, and data destruction; certificate of destruction maintained for disposed devices

Technical Safeguards

Access Control
100%
✓
Unique User Identification
All users have unique login credentials; no shared accounts identified
✓
Emergency Access Procedures
Break-glass procedures documented and tested; access logged and reviewed
✓
Automatic Logoff
10-minute inactivity timeout configured on all systems
✓
Encryption & Decryption
Encryption in place for data at rest (AES-256) and in transit (TLS 1.3); tested and verified
Audit Controls
100%
✓
Audit Logging
System logs capture access, modifications, and deletions; logs retained for 7 years
✓
Log Review Process
Monthly review of access logs; anomalies investigated and documented

Policies & Procedures

Documentation & Training
100%
✓
HIPAA Training Program
Annual training completed by 100% of workforce; documentation maintained; training includes privacy and security rules
✓
Policy Review & Updates
Policies reviewed annually; last update March 2026; change log maintained
✓
Business Associate Agreements
BAAs in place for all vendors with PHI access (EHR vendor, billing service, shredding company); agreements reviewed and current

Findings Requiring Attention

Finding #1: Incident Response Testing (LOW PRIORITY)

While an incident response plan exists and has been updated within the past year, no tabletop exercise or simulation has been conducted to test the plan's effectiveness.

Recommendation: Conduct annual incident response tabletop exercise. This is a best practice rather than a strict requirement.

Timeline: Within 90 days (non-urgent)

Finding #2: Mobile Device Policy Gap (LOW PRIORITY)

Current mobile device policy does not explicitly address personal devices (BYOD). While practice currently does not allow PHI access from personal devices, the policy should formally document this restriction.

Recommendation: Update mobile device policy to explicitly address BYOD. Add this restriction to new hire onboarding checklist.

Timeline: Within 60 days (non-urgent documentation update)

Summary & Recommendations

Overall Compliance Status: COMPLIANT

Riverside Medical Practice demonstrates strong HIPAA compliance with comprehensive policies, effective technical controls, and consistent workforce training. The two identified findings are minor documentation gaps rather than active compliance violations.

Strengths:

Action Items:

Next Audit: Q3 2027 (annual schedule)