HIPAA documentation requirements: what you need, what you do not, and what to keep for six years

What documentation does HIPAA require?

HIPAA requires less paper than template vendors suggest, but what it asks for is specific. The Privacy Rule's administrative requirements (45 CFR 164.530) call for privacy policies and procedures, and for documentation of what the rule requires to be recorded. The Security Rule's documentation standard (164.316) requires the policies and procedures you adopt to protect electronic PHI to be kept in written form, together with a written record of the actions, activities and assessments the rule demands. The Breach Notification Rule (164.400 to 164.414) places the burden of proof on you: if you say notice was given, or that an incident was not a breach, you must be able to show it.

Put simply, the regulator and your customers' auditors expect three things on file: the rules you have set for your organisation, the evidence that you follow them, and the reasoning behind the decisions the regulation leaves to you. The rules themselves are covered in HIPAA requirements explained, rule by rule.

Documents and records: the difference that matters

• Documents state intent and method: the privacy policy set, the security policies, the incident response procedure, the contingency plan, the sanction policy. They change when your systems, services or contracts change and leave the old version archived.
• Records prove that something happened: a completed risk analysis, an access review, a training attendance list, a signed business associate agreement, a four-factor breach assessment, a backup restoration test. A record is fixed once made; an edited log or a back-dated training sheet stops being evidence.

The distinction matters most for addressable specifications. Where you decide that an addressable specification is not reasonable and appropriate for you, the decision and its reasoning are themselves a record, as is the alternative measure you put in place. An undocumented "we decided not to" reads to an auditor as "we never looked".

The documented items each rule expects

The table lists what the rules in force expect in writing, grouped by rule and section title. Items marked for covered entities are ones a business associate supports through its agreement rather than holds.

The Security Rule update proposed in January 2025 would add written documentation of every policy, procedure, plan and analysis, a technology asset inventory and a network map. It is still a proposal; the proposed Security Rule update, explained sets out what would change.

What you do not need

Much of the paper in a bought HIPAA kit has no basis in the rules:

• A HIPAA certificate or seal. HHS does not recognise private certifications of Security Rule compliance, so a framed certificate proves nothing and belongs in no evidence file.
• A compliance manual that restates the regulation. Paraphrasing 45 CFR Part 164 adds pages, not protection.
• One policy per implementation specification. The rules set standards, not a document count.
• Covered-entity documents in a business associate's file. A billing company or contact centre does not publish a notice of privacy practices or collect patient authorisations; its agreements oblige it to support the client's own processes, such as returning records for an access request.
• A single fixed risk analysis template. HHS guidance says no one method guarantees compliance. What matters is coverage of all ePHI, threats and vulnerabilities, current measures, likelihood, impact and risk level; the Security Rule risk analysis guide walks through one method.

A minimal document set for a small business associate

Take a medical billing firm with forty staff, one office and a handful of vendors. A right-sized programme holds roughly this:

• A PHI data-flow map showing where PHI enters, where it is stored and where it leaves, which also fixes the scope of the risk analysis.
• The risk analysis and the risk management plan.
• A privacy and security policy set of around ten to fifteen policies: access control, acceptable use, workstation and clean-desk rules, device and media handling, logging and review, incident response, contingency, vendor management, training, sanctions, and permitted uses of PHI under the client agreements.
• An incident and breach procedure with the four-factor assessment form and notification templates addressed to the covered entity.
• Signed agreements: one with each client, and one with every subcontractor that touches PHI, such as a cloud backup provider or an offshore coding partner.
• Records that grow over time: training attendance, access reviews, log reviews, backup and restoration tests, incident and breach assessments, disposal records and the periodic evaluation.

A covered entity, such as a clinic, adds the Privacy Rule documents that face patients: the notice of privacy practices, authorisation forms, and the procedures and logs for access, amendment and accounting requests.

Retention, review and keeping the file alive

Retention is the one number the rules give: six years from creation or from the date a document was last in effect, whichever is later. The Privacy Rule's accounting of disclosures also looks back six years. Customer contracts may ask for more; read them before setting a disposal date.

Review follows change. The Security Rule expects documentation to be reviewed and updated when your environment or operations change: a new client, a new system holding ePHI, a new vendor, a move to remote work.

Effivity holds the programme in one controlled repository: policies with owners, approval and version history, superseded versions archived rather than deleted, access by user rights, and records such as training, incidents, reviews and agreements kept against the requirement they evidence. Its role for HIPAA is described in Effivity for HIPAA: the guide.

Documentation mistakes that surface in vendor audits

• Policies with no risk analysis beneath them. A polished policy set built on a generic or missing risk analysis is a failure that recurs in HHS resolution agreements.
• Agreements that flow one way. The client agreement is signed, but the cloud host, the offshore partner or the shredding company has none.
• Addressable decisions left unwritten. Encryption not deployed on a system, with no record of why or of the alternative.
• Old versions deleted. When a regulator asks what the policy said at the time of an incident two years ago, only an archive answers.

HIPAA documentation: questions buyers ask