Back to News
Human Risk ProtectionAugust 18, 2026

Six Gaps That Fail a HIPAA Audit

When the Office for Civil Rights reviews a healthcare practice, the findings are rarely exotic. They are the basics, left undone. The Office for Civil Rights, or OCR, is the federal agency that enforces HIPAA.

You do not need to become a security expert to pass a review. You need someone to own these six things, keep them current, and be able to prove them. Here is what comes up the most, why it matters, and what "done right" actually looks like.

01

Shared logins

If three people use one front-desk password, you cannot prove who opened a given record.

Done rightA unique login for every user, on every system that touches patient data.
02

No multi-factor authentication

A single stolen or guessed password becomes a master key to email, the records system, and remote access.

Done rightMFA on email, your records system, and any remote login. A password alone is never enough.
03

No audit logging

You are expected to show who accessed which record and when. Without logs, you cannot.

Done rightAccess logging turned on and retained for the systems that hold patient data.
04

Unencrypted devices

A lost or stolen laptop with patient data on it can become a reportable breach on its own.

Done rightFull-disk encryption on every laptop, phone, and drive that leaves the building.
05

No current risk assessment

This is the first document OCR asks for, and the one most often missing or years out of date.

Done rightA documented risk assessment, reviewed at least once a year and after major changes.
06

Missing business associate agreements

If a vendor that handles patient data has a breach and you never signed a BAA, the violation is yours.

Done rightA signed agreement on file with every vendor that stores, processes, or can see patient data.

This is a plain-language summary of common HIPAA Security Rule safeguards, not a complete compliance checklist. A risk assessment is how you find the gaps specific to your practice.

The pattern behind all six

None of these are hard to fix in isolation. They become findings because no single person owns them, so they drift. The login that made sense with three employees never got revisited at fifteen. The risk assessment from two years ago never got updated. The vendor agreement nobody remembered to sign.

That is the real work of HIPAA compliance. Not heroics, just steady ownership. A risk assessment turns these from a vague worry into a short, ordered list you can actually work through.

A straight answer, not a guess

Not sure which of these you could prove today?

That is exactly what a HIPAA risk assessment is for. We will walk your setup and tell you what to close first.

Let's connect Request a callback

Based on common HIPAA Security Rule safeguards, 45 CFR Part 164, Subpart C. For general information only, not legal advice.