Loading...
A 20-question, 100-point audit checklist practices can use to score their EMR vendor on HIPAA compliance — covering access controls, encryption, audit logging, business associate agreements, and breach response.
A 20-question, 100-point audit checklist practices can use to score their EMR vendor on HIPAA compliance — covering access controls, encryption, audit logging, business associate agreements, and breach response.
Most practice managers assume their EMR vendor handles HIPAA compliance. That assumption is expensive.
HIPAA places joint responsibility on covered entities — meaning your practice — and business associates, including your EHR vendor. If your vendor has a security gap and a breach occurs, OCR will investigate both parties. In 2024, HHS Office for Civil Rights resolved 44 investigation cases, collecting over $9.9 million in settlements and civil monetary penalties. Several of those cases involved vendors whose covered entity clients had never verified basic security configurations.
This post gives you a working audit tool: 20 questions, 100 points, five compliance domains. Run it against your current vendor or any vendor you are evaluating. The scoring thresholds at the end tell you what to do with the results.
For foundational background on what HIPAA actually requires from EHR systems, see our HIPAA compliance guide for EMR/EHR systems. This post assumes you have that context and focuses exclusively on the audit.
Each question is answered Yes (full points) or No (zero points). There is no partial credit — either the control exists and is documented, or it does not. That may feel harsh, but HIPAA enforcement does not award partial credit either.
What counts as evidence:
Do not accept verbal assurances. Document every answer with a source.
Access control failures are the single most common pathway to unauthorized PHI disclosure. The HIPAA Security Rule (45 CFR § 164.312(a)) requires covered entities and business associates to implement technical policies that allow only authorized persons to access ePHI.
Question 1 (5 pts): Does your EMR support role-based access control (RBAC) that can be configured at the user level?
You should be able to assign different permissions to physicians, nurses, billing staff, and front desk. A physician should not automatically have billing export rights. A front desk scheduler should not be able to view full clinical notes unless clinically necessary. Ask specifically: Can your administrator restrict which screens each role can access without opening a support ticket?
Question 2 (5 pts): Does the system enforce automatic session timeouts after a configurable period of inactivity?
HIPAA requires a mechanism to terminate electronic sessions after a defined period. Most auditors look for a timeout of 15 minutes or less for clinical environments. Confirm the timeout is configurable and that it is currently active in your production environment — not just available as a setting nobody turned on.
Question 3 (5 pts): Does the system support multi-factor authentication (MFA) for all user logins?
MFA is not explicitly named in HIPAA text. OCR has made clear in multiple resolution agreements that its absence is a contributing factor in negligence determinations. As of 2025, any EHR vendor that does not offer MFA should not be on your shortlist. Confirm MFA is available and that your organization has it enabled — not just provisioned.
Question 4 (5 pts): Does the vendor maintain a documented process for promptly revoking access when an employee is terminated?
Former employees represent a significant insider threat. Your BAA or vendor security documentation should specify a maximum time-to-revoke — ideally same-day — and confirm that access is revoked from all systems, including mobile applications and patient portal admin tools. "We handle it manually" is not an answer.
Question 5 (5 pts): Does the system support unique user identification — meaning no shared logins?
Shared credentials make audit trails meaningless. Every user who accesses the system must have a unique identifier. This is a required implementation specification under 45 CFR § 164.312(a)(2)(i). If your vendor allows shared login accounts for any reason, score zero and flag it as a critical gap.
HIPAA treats encryption as an "addressable" specification, which is frequently misread as optional. It is not optional — it means you must either implement it or document why an equivalent alternative protects the data. Any EHR vendor that does not encrypt data in transit and at rest in 2026 is not HIPAA compliant, full stop. The "addressable" language is not a loophole; OCR has closed that argument repeatedly in enforcement actions.
Question 6 (5 pts): Is all ePHI encrypted in transit using TLS 1.2 or higher?
Ask your vendor for written confirmation of the TLS version used for all data transmission. TLS 1.0 and 1.1 are deprecated and should not be accepted. HTTPS is necessary but not sufficient — confirm the protocol version explicitly.
Question 7 (5 pts): Is all ePHI encrypted at rest using AES-256 or equivalent?
This covers database storage, backup files, and any file attachments — lab results, imaging reports, scanned documents. Ask for their encryption standard in writing. AES-128 is technically acceptable; AES-256 is current best practice and what you should expect from any vendor charging enterprise rates.
Question 8 (5 pts): Are mobile applications (if offered) subject to the same encryption requirements, including remote wipe capability?
If your EMR offers a mobile app for physicians, the data cached on that device is ePHI. Confirm that the mobile app encrypts local storage and that your administrator can remotely wipe a lost or stolen device. If the vendor offers a mobile app but cannot confirm remote wipe, score zero.
Question 9 (5 pts): Does the vendor hold a current SOC 2 Type II report or HITRUST CSF certification that covers encryption controls?
A vendor's self-attestation about encryption is not evidence. SOC 2 Type II reports are the industry standard; HITRUST CSF certification is more specific to healthcare. Request the actual report — not a letter saying one exists — and check the report date. Anything older than 18 months requires a direct conversation about what has changed since.
The HIPAA Security Rule requires audit controls — hardware, software, and procedural mechanisms that record and examine activity in information systems containing ePHI. Audit logs are what OCR requests in the first days of any investigation. If you cannot produce them, the investigation goes badly fast.
Question 10 (5 pts): Does the system automatically log all access to patient records, including who accessed which record, at what time, and from which IP address?
This is non-negotiable. The logs must be automatic, not optional. Confirm that logging cannot be disabled by end users or administrators — because if it can be disabled, it will be.
Question 11 (5 pts): Are audit logs retained for a minimum of six years?
HIPAA requires documentation retention for six years from creation or last use. Audit logs are documentation. Some vendors retain logs for 90 days or one year. That is a compliance gap, not a configuration issue — it means critical breach evidence may not exist when you need it.
Question 12 (5 pts): Does the vendor provide you with a mechanism to actually access and review your audit logs?
Some vendors log activity but provide no way for the covered entity to retrieve those logs without a formal support ticket and a waiting period. You need on-demand access. During a breach investigation, waiting three days for a support team to pull logs is not acceptable.
A Business Associate Agreement is the legal foundation of your HIPAA compliance relationship with your EMR vendor. Without a properly executed BAA, your vendor relationship is itself a HIPAA violation. But not all BAAs are equal — the questions below distinguish between a form BAA filed and forgotten and a substantive agreement that actually protects you.
Question 13 (5 pts): Has your practice executed a current, signed BAA with your EMR vendor that explicitly covers all services you use (billing, patient portal, e-prescribing, etc.)?
Many practices have a BAA on file but only for the core EMR. If you added a patient portal or telehealth module later, confirm the BAA was updated or that the original BAA covers future services. Read the scope language — do not assume.
Question 14 (5 pts): Does the BAA identify all subcontractors (sub-BAs) the vendor uses who may access your ePHI, and confirm those subcontractors have signed BAAs with the vendor?
Cloud hosting providers, analytics vendors, and third-party billing clearinghouses are common sub-BAs. Your vendor's BAA should acknowledge these relationships and confirm they are covered. A vendor who cannot identify their sub-BAs is carrying risk directly into your practice.
Question 15 (5 pts): Does the BAA specify breach notification timelines that meet or exceed the HIPAA requirement of 60 days?
The HIPAA Breach Notification Rule requires notification within 60 calendar days of discovery. A strong BAA specifies vendor notification to you within 24–72 hours of discovery — because you need time to meet your own notification obligations before the 60-day clock expires.
Question 16 (5 pts): Does the BAA address what happens to your PHI upon contract termination — including a data return or secure destruction requirement?
When you switch vendors, your former vendor still holds years of your patients' data. The BAA must specify either secure return of that data in a usable format or documented destruction with written confirmation. A BAA that is silent on termination is not protecting you. For more on data security practices, see our EHR security guide.
The question is not whether your vendor will experience a security incident — it is whether they are prepared to detect and respond to one in a way that protects your practice and your patients. Every EHR vendor has had an incident. What separates an acceptable vendor from a liability is how prepared they are before it happens.
Question 17 (5 pts): Does the vendor have a documented Incident Response Plan that includes healthcare-specific breach scenarios?
Generic IT incident response plans are not sufficient. Ask to see a summary of their IRP. It should address ransomware scenarios, insider threats, and third-party vendor breaches. Confirm the plan is reviewed and updated at least annually — a plan written in 2019 and never revised is not a plan.
Question 18 (5 pts): Has the vendor conducted a HIPAA-specific risk analysis within the past 12 months and will they share a summary of findings?
The Security Rule requires periodic risk analysis. Many breaches stem from known vulnerabilities that were identified in risk assessments but never remediated. Ask for the date of their last risk analysis and what material findings they identified. A vendor that refuses to share even a high-level summary is telling you something important.
Question 19 (5 pts): Does the vendor provide breach response support to your practice — including notification drafting assistance and contact with legal counsel — if their system is involved in a breach?
Some vendors treat breach response as solely your problem even when the breach originated in their infrastructure. Your BAA should specify vendor obligations during a breach. Ask your account manager directly and get the answer in writing before you need it.
Question 20 (5 pts): Does the vendor carry cyber liability insurance with coverage limits adequate for a healthcare breach scenario?
Cyber liability insurance is not a HIPAA requirement, but it is a practical expectation for any business associate handling healthcare data at scale. Ask for a certificate of insurance. Coverage limits below $5 million are generally considered inadequate for mid-size healthcare organizations — and that number should be higher if you are in a multi-location group practice.
Add up your points across all five domains.
| Score | Risk Level | Recommended Action |
|---|---|---|
| 0 - 40 | High Risk | Do not renew. Begin vendor evaluation immediately. Consult healthcare counsel. |
| 41 - 70 | Moderate Risk | Address specific gaps within 90 days. Document remediation plan. Consider alternatives. |
| 71 - 85 | Acceptable | Address remaining gaps. Schedule re-audit in 12 months. |
| 86 - 100 | Strong | Continue monitoring. Schedule re-audit annually. |
A low score does not automatically mean you should switch vendors — but it does mean you have immediate obligations, not a to-do list.
Step 1: Identify the non-negotiables. Any "No" on Questions 1, 3, 6, 7, or 13 is a critical gap requiring remediation now, regardless of overall score. These are foundational controls, not enhancements.
Step 2: Issue a formal gap remediation request. Put your concerns in writing. Ask the vendor to provide a written remediation plan with timelines. This creates documentation that you identified the gap and took action — directly relevant if OCR investigates your practice.
Step 3: Consult your healthcare attorney. If your BAA is deficient on any Domain 4 question, your legal exposure may already be active. Have counsel review the existing BAA and advise on whether you need a new agreement before continuing operations.
Step 4: Evaluate alternatives. If the vendor cannot remediate critical gaps within a defined timeframe, the math is straightforward: the average cost of a healthcare data breach reached $10.9 million in 2024. A formal vendor evaluation is cheap by comparison. The EMR directory allows you to filter by compliance and security capabilities.
Step 5: Schedule annual re-audits. Vendors update systems, change subcontractors, and modify their security posture continuously. This scorecard should be revisited annually and whenever you add a new module or service.
Here is the most important thing this scorecard cannot do: it cannot protect you if you accept vendor claims at face value. "HIPAA compliant" is a marketing phrase, not a certification. There is no federal HIPAA compliance certificate. Any vendor can say it.
The only HIPAA compliance claims worth anything are ones backed by independent third-party verification — a current SOC 2 Type II report, an active HITRUST CSF certification, or ONC Health IT certification. Everything else is a vendor telling you they follow the rules they set for themselves. That is not how you protect your patients or your practice.
When evaluating vendors in the EMR directory, prioritize those who produce current third-party audit documentation without being asked. If a vendor responds to your audit questions with delays, deflection, or vague language about their "strong security posture," you have your answer.
Run this scorecard against your current vendor this quarter. If you score below 85, issue a formal remediation request and document it. If your BAA has not been reviewed since you added any new service module, have counsel look at it before your next contract renewal.
The practices that get caught in OCR investigations are not always the ones with the worst vendors. They are the ones that never checked.
Browse the EMR directory to compare vendors on compliance and security criteria, or review our HIPAA compliance guide for the regulatory foundation behind each audit question.
This information is educational and does not replace professional medical or legal advice.
Use our comparison tool to evaluate EMR systems side-by-side based on your specialty, practice size, and budget.