Define your HIPAA Audit Scope

Overview

Define your HIPAA Audit Scope to set the boundaries of the audit and identify the object in focus.

The object can include the people, data, system, or product in review. The scope definition allows the auditors to focus on an aspect of the organization rather than the whole. It is important to clearly define the scope of review for your given audit.

Determining your HIPAA audit scope requires your organization to specify the product, the data, the systems, vendors, and type of scope.

This article guides you on how to determine each scope item. A table listing each item is provided below to use as a template for this exercise.

Learn more about TrustCloud’s TrustOps for HIPAA!

Product(s) in scope

For a Software as a Service (SaaS) provider, the scope is typically the software application(s) offered to clients. Some organizations have multiple products, and it is important to define what product is in focus and what product isn’t for your HIPAA.

When conducting a HIPAA audit, it is essential to identify the products that fall within the scope of the audit. These products refer to any technology or software that stores, processes, or transmits electronic protected health information (ePHI). This includes electronic health record systems, health information exchanges, email systems, mobile devices, and cloud storage platforms.

Additionally, any third-party applications or vendors that have access to ePHI should also be included in the scope of the audit. By accurately delineating the products in HIPAA audit scope, organizations can ensure comprehensive compliance with HIPAA regulations and protect the privacy and security of patient data.

Data in scope

In order to identify the data in HIPAA audit scope, the ideal step is to focus on the type of data and people that flow through the product or service identified. For a SaaS provider, it’s typically all the data held in it (i.e., customer data, etc.) and the people that support it, such as vendors and employees.

Systems in scope

To identify all your systems in HIPAA audit scope, take an inventory of all the various systems and internal controls that are critical to delivering your service or product in scope. This can include email and Slack. The key is to focus on the systems and tools that are essential to delivering your service / product. Production systems have a direct impact on your product or service in lieu of non-production systems.

For HR systems, focus on systems that manage employee onboarding and training processes. Everything else, such as time off requests and benefits, is out of HIPAA audit scope since it is not critical to delivering a service or product.

For a SaaS provider, it’s typically all the infrastructure that hosts it and the procedures that support it, such as AWS, Github, JIRA, etc.

Vendors in HIPAA audit scope

In order to identify the vendors in HIPAA audit scope, focus on the critical vendors, such as cloud hosting and production-related organizations used to support the product or service in scope.

Are you a business associate or a covered entity?

Scoping changes drastically based on whether you qualify as a covered entity or a business associate.

Covered entities include:

1. Healthcare providers such as hospitals, clinics, doctors offices, pharmacies, and home health agencies.
2. Health plans such as government programs that pay for healthcare, health insurance companies, health maintenance programs, and military and veterans’ health programs.
3. Healthcare clearinghouses, i.e., organizations that act as the go-betweens for healthcare providers and insurance providers.

Business Associates perform services on behalf of covered entities and include, but are not limited to:

1. Third-party administrators
2. Billing companies
3. Transcriptionists
4. Cloud service providers
5. Data storage firms: electronic and physical records
6. EHR providers
7. Consultants
8. Pharmacy benefits managers
9. Claims processors
10. Collections agencies
11. Medical device manufacturers

Use the HHS question and answer decision tool to determine whether your organization is a Business Associate or a Covered Entity. This is a determination that must occur with your Legal department.

HIPAA Rule in scope

The HIPAA regulation is composed of three rules: Privacy, Security, and Breach notification.

1. The security rule is mandatory for both covered entities and business associates
2. The privacy rule is mandatory for covered entity only
3. The breach notification rule is mandatory for covered entity and optional for business associates

HIPAA Audit Scope guidance template

Read our GRC Launchpad articles on compliance to learn more.