> ## Documentation Index
> Fetch the complete documentation index at: https://docs.officeridge.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA compliance

> PHI access audit trail, security incidents, business associate agreements, and compliance documents.

These tabs hold your HIPAA evidence: who accessed protected health information, what incidents
occurred, which vendors are covered by agreements, and where your policies live.

## HIPAA Audit Trail

Immutable HIPAA audit trail recording every PHI access with actor, action, and IP address.

**Columns:** Actor · Role · Action · Resource Type · Resource ID · Success · IP Address · Timestamp

<Note>
  This trail is immutable. Entries cannot be edited or deleted, by anyone, including administrators.
  That is what makes it usable as evidence.
</Note>

**Success** matters as much as the successful accesses. A run of failed attempts against member
records is a signal worth investigating.

<Warning>
  The audit trail records metadata about access — who, what, when, from where. It does not record the
  clinical content viewed. Do not expect it to tell you what a user read, only what they opened.
</Warning>

## Security Incidents

Security incident reports with HIPAA breach risk assessment and notification timelines.

**Columns:** Title · Discovered · Status · ePHI Encrypted? · Risk Level · Within 60 Days?

| Field               | Why it matters                                           |
| ------------------- | -------------------------------------------------------- |
| **Discovered**      | Starts the notification clock                            |
| **ePHI Encrypted?** | Encrypted data may fall under the breach safe harbour    |
| **Risk Level**      | The assessed risk to affected individuals                |
| **Within 60 Days?** | Whether notification happened inside the required window |

<Warning>
  **Within 60 Days?** tracks a hard regulatory deadline measured from **Discovered**, not from when
  the investigation concludes. Record the discovery date accurately and escalate immediately — the
  clock does not pause while you assess.
</Warning>

## Business Associates

HIPAA Business Associate Agreements with lifecycle tracking and compliance audit dates.

**Columns:** Company · Service · BAA Status · Signed · Expires · Sub-Agreements · Security Contact ·
Last Audit

| Field                | What it tracks                                 |
| -------------------- | ---------------------------------------------- |
| **BAA Status**       | Where the agreement stands                     |
| **Signed / Expires** | The agreement's validity window                |
| **Sub-Agreements**   | Downstream subcontractors handling your PHI    |
| **Security Contact** | Who to reach at the vendor during an incident  |
| **Last Audit**       | When you last reviewed the vendor's compliance |

<Warning>
  **Sub-Agreements** is easy to overlook. A business associate who subcontracts your PHI needs
  agreements in place downstream too. Your obligation does not stop at the first vendor.
</Warning>

Vendors also appear in [Vendors and purchasing](/finance/vendors-and-purchasing) with their BAA
status. Same records, different view.

## Compliance Documents

HIPAA compliance documents with 6-year retention, version control, and review scheduling.

**Columns:** Title · Type · Version · Active · Approved · Next Review · Retention Expires

| Field                 | What it tracks                        |
| --------------------- | ------------------------------------- |
| **Version**           | Which revision this is                |
| **Active**            | Whether it is the current version     |
| **Approved**          | Whether it has been signed off        |
| **Next Review**       | When it must be reviewed again        |
| **Retention Expires** | When the 6-year retention period ends |

<Warning>
  HIPAA documents carry a six-year retention requirement. **Retention Expires** tells you when a
  superseded document may be disposed of — not before.
</Warning>

## Handling a suspected breach

<Steps>
  <Step title="Record the incident immediately">
    Set **Discovered** to the actual discovery date. This starts the 60-day clock.
  </Step>

  <Step title="Determine whether ePHI was encrypted">
    Encrypted data may not constitute a reportable breach.
  </Step>

  <Step title="Assess the risk level">
    Consider what data was involved and who could have accessed it.
  </Step>

  <Step title="Check the audit trail">
    The HIPAA audit trail shows what was accessed and by whom.
  </Step>

  <Step title="Notify within the window">
    Set **Within 60 Days?** once notification is complete.
  </Step>
</Steps>

<Warning>
  This is not legal advice. Breach determination and notification obligations depend on
  circumstances. Involve your privacy officer and counsel.
</Warning>

## Reviewing business associates

<Steps>
  <Step title="Filter on Expires">
    Agreements within 90 days of expiry need renewing.
  </Step>

  <Step title="Check Last Audit">
    A vendor not audited recently should be reviewed.
  </Step>

  <Step title="Confirm sub-agreements">
    Ask whether the vendor has added subcontractors since the agreement was signed.
  </Step>

  <Step title="Verify the security contact">
    An out-of-date contact is useless during an incident.
  </Step>
</Steps>

## Troubleshooting

| Problem                                | What to check                                                                                       |
| -------------------------------------- | --------------------------------------------------------------------------------------------------- |
| I need to correct an audit trail entry | You cannot. The trail is immutable by design. Record the correction as a separate note or incident. |
| A vendor has PHI access but no BAA     | Stop the access until an agreement is in place.                                                     |
| A document shows overdue for review    | **Next Review** has passed. Review, version, and re-approve it.                                     |
| Repeated failed access attempts        | Investigate. Check [Security](/account/security) login history for the account involved.            |

## Related

<CardGroup cols={2}>
  <Card title="Member safeguards" icon="heart-handshake" href="/compliance/member-safeguards">
    Complaints, incidents, and member rights.
  </Card>

  <Card title="Security" icon="shield-half" href="/account/security">
    Account security and login history.
  </Card>
</CardGroup>