Audit readiness is not a project you complete the week a letter arrives. It is the habit of keeping evidence current, organized, and retrievable, so that any request — from the HHS Office for Civil Rights, from a business partner, from your own internal review — can be answered from records that already exist.
This page covers readiness and evidence. For explanations of the rules and safeguards themselves, see the HIPAA-compliant dental IT guide. For the task-level controls you should be running, use the HIPAA compliance checklist.
Quick Answer
HIPAA audit preparation for a dental practice means maintaining a retrievable evidence inventory: designation of Privacy and Security Officials, current policies and procedures, the risk analysis and the risk management plan that follows from it, training records, signed Business Associate Agreements, access and audit logs, incident documentation, and a gap register showing what is being fixed and by whom. Review processes and document requests vary by situation, so build readiness around evidence you can produce at any time rather than around an assumed timeline.
What an OCR Review Can Look Like
HHS OCR conducts compliance reviews and investigations, and has run audit programs of covered entities and business associates. The scope, format, and documentation requested vary with the situation — a complaint investigation, a breach report follow-up, and a program audit are not the same exercise. Treat any published description as illustrative rather than as a fixed procedure your practice will experience.
Authoritative starting points:
Because requests are not uniform, the useful goal is retrievability: any document named in your policies should be produceable without an all-hands search.
Accountable Roles
Name these in writing before you need them:
- Privacy Official — policies, patient rights requests, disclosures, notice of privacy practices.
- Security Official — technical safeguards, access reviews, logs, incident handling.
- Practice owner or administrator — final accountability, funding, sign-off on the evidence set.
- IT provider contact — produces technical evidence such as access reports, patch status, backup and restore records, log exports.
- Privacy or security counsel — engaged for legal determinations, official correspondence, and breach analysis.
Write down who speaks for the practice in any official correspondence. Ad-hoc replies from whoever opened the mail are how inconsistencies get created.
Build an Evidence Inventory
An evidence inventory is a single index that says, for each document: what it is, who owns it, where it lives, when it was last updated, and how quickly it can be produced.
| Evidence | Typical owner | What "current" looks like |
|---|---|---|
| Privacy/Security Official designations | Owner | Signed, dated, reflects the people actually doing the work |
| Policies and procedures | Privacy Official | Versioned and dated; matches actual workflows |
| Risk analysis | Security Official | Covers all ePHI systems; prior versions retained |
| Risk management plan | Security Official | Risks mapped to owners, actions, dates |
| Training records | Privacy Official | Attendance logs with dates, topics, participants |
| Business Associate Agreements | Administrator | Signed, complete vendor coverage, retrievable |
| Access and audit logs | IT provider | Enabled, retained per policy, exportable |
| Incident documentation | Security Official | Security incident records, including the practice's assessment, response, and outcome |
| Backup and restore-test records | IT provider | Dated tests with outcomes, not just job success |
| Gap register | Owner | Open items with owners and target dates |
If an evidence item cannot be located reliably when requested, record that as a readiness gap.
Risk Analysis and Risk Management Evidence
These are two different artifacts and reviewers look for both.
The risk analysis identifies where ePHI lives across servers, workstations, imaging systems, cloud platforms, mobile devices, backups, and vendor connections, then assesses threats and vulnerabilities to that information.
The risk management plan shows what the practice decided to do about each identified risk: the control implemented, the owner, the date, or a documented reason for accepting the risk.
HHS guidance describes risk analysis as an ongoing process that should be reviewed and updated as circumstances change; it does not prescribe one universal interval that fits every practice. Define your own review cadence in policy, follow it, and re-run the analysis whenever systems, locations, staffing, or workflows change materially. Retaining prior versions is what demonstrates a program rather than a one-time exercise.
Policies, Training, and Agreements
Policies should describe what your office actually does. A policy requiring quarterly access reviews that have never been performed is worse than a policy matching your real cadence.
Training records should show who was trained, when, on what, and by whom. Onboarding training, recurring training, and any post-incident refreshers all belong in the same place.
BAAs should exist for every vendor that creates, receives, stores, or transmits ePHI for you: practice management and imaging hosts, backup providers, email and cloud storage, billing services, shredding companies, and your IT provider. Keep a vendor register alongside the signed agreements so coverage gaps are visible.
System, Access, and Audit Logs
Logs are how you evidence that access controls exist in practice, not just on paper.
- Confirm audit logging is enabled in the practice management and imaging systems.
- Define and document a retention period, then verify it is actually applied.
- Keep a current user list with roles, and dated access review exports.
- Retain evidence that departing staff were removed from every system, including remote access, email, and door codes.
- Keep MFA enrollment and encryption status reports; both are commonly requested and easy to produce.
Incident Documentation
Log every security incident, including ones that turned out to be nothing. The record should capture how it was discovered, what was affected, what actions were taken and when, who was involved, and how it concluded.
Whether an incident is a reportable breach is a legal determination. Document the facts, then involve qualified counsel and, where relevant, your cyber insurance carrier before making or communicating a conclusion. The response mechanics are covered in the dental ransomware recovery playbook.
Responding to an Official Request Securely
If a formal request or inquiry arrives:
- Route it to the named practice contact and to counsel immediately; do not respond ad hoc.
- Record the date received, what was requested, and the response deadline stated.
- Produce exactly what is requested, from your existing evidence inventory. Do not create, backdate, or edit documents to fill a gap.
- Transmit responses securely and keep a copy of everything sent, with dates.
- Log the whole exchange as you would an incident.
Backdating documentation is the single most damaging thing a practice can do in this situation. An honest gap with a remediation plan is defensible; a fabricated record is not.
Running a Mock Audit
A mock audit is the cheapest way to find out whether your evidence inventory is real.
- Pick a reviewer who did not build the documentation — a partner, an administrator from another location, or your IT provider.
- Give them a list of ten to fifteen items drawn from your inventory and a fixed window to collect them.
- Watch what happens: what is missing, what is stale, what exists but nobody can find, and what contradicts a policy.
- Walk the office too. Screen visibility, locked cabinets, and unattended workstations are observable facts, not documents.
- Record every finding, even small ones.
Keep a Readiness Gap Register
Findings from mock audits, access reviews, restore tests, and incidents all go into one register:
| Gap | Risk | Owner | Action | Target date | Status |
|---|---|---|---|---|---|
| Two vendors without signed BAAs | ePHI shared without agreement | Administrator | Obtain and file signed BAAs | Date | Open |
The register is useful evidence in itself: it shows a practice that identifies problems and works them, which is the substance of an ongoing compliance program.
For remediation examples tied to specific failure patterns, see common HIPAA violations in dental practices. If you want the technical evidence — access reports, patch status, logs, backup and restore records — produced and maintained for you, that is part of our HIPAA compliance service.
Frequently Asked Questions
What is HIPAA audit preparation for a dental practice?
It is the ongoing work of keeping compliance evidence current and retrievable: designations, policies, risk analysis and risk management records, training logs, BAAs, access and audit logs, incident documentation, and a gap register.
What documents are typically requested?
Requests vary by situation, but commonly involve policies and procedures, the risk analysis and risk management plan, training records, Business Associate Agreements, access controls and logs, and incident documentation.
How often should a dental practice update its risk analysis?
HHS describes risk analysis as ongoing and expects it to be reviewed and updated as circumstances change. Set a documented cadence for your practice and additionally re-run it after material changes to systems, locations, staffing, or workflows.
What should we do if a formal request arrives?
Route it to your named practice contact and qualified counsel, record what was requested and when, produce existing documentation securely, and never create or backdate records to fill a gap.
Is a HIPAA audit the same as a security assessment?
No. A security assessment evaluates technical risk. An audit or compliance review examines whether the practice's documented program, safeguards, and evidence meet HIPAA requirements.
How can Legend Networking help with audit readiness?
We maintain and produce the technical evidence side — access and log reports, encryption and MFA status, patch records, backup and restore-test documentation — and help organize it into a retrievable inventory. We do not provide legal advice or compliance certification.