A HIPAA investigation rarely turns on whether you had a policy. It turns on dates — when the breach was discovered, when the individuals were told, when access was revoked, when the risk analysis was last done. These are the twelve we watch, every morning, against your own records.
None of these are obscure. They are the dates that decide whether a finding is written up, and every one of them is a subtraction anybody could do — if anybody were doing it every morning.
The outer limit for telling the affected individuals. A breach counts as discovered the first day it would have been known by exercising reasonable diligence, so the argument about whether it was a breach happens on the clock.
45 CFR 164.404(b)The regulation does not say within a week. It says when the employment ends. This is the commonest finding written against a departing employee, and it is a two-second job that nobody owns.
45 CFR 164.308(a)(3)(ii)(C)Policies, the notice of privacy practices, complaints and their disposition, and the training record — kept six years from creation or from the day the document was last in effect, whichever is later.
45 CFR 164.530(j)(2) and 164.316(b)(2)(i)Not a portal you have to remember to open. A dashboard that holds the current state, one email each morning to the person who owes the work, and a text only when something is already past due.
| State | Who | Requirement | What we found |
|---|---|---|---|
| Past due | Alvarez, D. | Privacy & security training on file45 CFR 164.530(b) | No training record for 3 employees, oldest hire 41 days ago. |
| Past due | Okafor, J. | Access terminated for a leaver45 CFR 164.308(a)(3)(ii)(C) | Account still active. Employment ended 9 days ago. |
| Action due | Privacy Officer | Security risk analysis reviewed45 CFR 164.308(a)(1)(ii)(A) | Last review 356 days ago. Due in 9 days. |
The dashboardEverything open, who owns it, and the citation behind it.
The morning emailOne brief a day, to the person who owes the work.
The textReserved for the ones that cannot wait for email.
All twelve, in the words we use when we tell you one is open. Where the regulation states a number we use it. Where it does not — and several of these do not — we say the number is ours.
The clock runs from discovery, not from the incident — and a breach counts as discovered on the first day it was known, or would have been known by exercising reasonable diligence. Agencies lose weeks deciding whether it was a breach at all, and the clock has been running the whole time.
This one states no number of its own. It ties the HHS notice to the individual notice, which carries the 60-day outer bound — so the requirement is contemporaneously, not eventually.
The HIPAA deadline agencies forget, because nothing happens on the day of the breach. It is due within 60 days of the year end, and a submission dated before the year end cannot be the one for that year.
The commonest HIPAA finding against a departing employee: the badge is collected and the EMR login is not. The rule says access ends when the employment ends, so we count from the termination date with no grace period.
A Required implementation specification, with risk management following from it. The rule states no interval, so we watch a 365-day working default and say so in the finding rather than presenting our number as a federal deadline.
The word in the regulation is periodic; no number appears anywhere in it. We watch a 365-day default and name it as ours.
The rule requires training within a reasonable period of time after someone joins, and states no number of days. We flag at 30 as a working default, and the finding says that in words so you can read it against your own policy.
A programme for all members of the workforce, including management, with periodic security updates. No interval is stated; we watch a year.
This one only speaks when your agency is acting as a business associate for somebody else — running a contracted service for a hospital, say. Leave the field empty and it stays silent.
Policies and procedures, the notice of privacy practices, complaints and their disposition, and the record that privacy training was given. The expensive mistake here is destroying paper too early.
Six years from creation or from the date the document was last in effect, whichever is later — which is longer than most people assume for any policy still in force.
We check that the inventory and the agreements are recorded as present. We do not read the contracts and do not judge whether their wording satisfies 164.504(e)(2). That is a lawyer's job, and telling you otherwise would be both wrong and unwelcome.
The Conditions of Participation a surveyor scores you against.
$349 a monthBloodborne pathogens, hepatitis B, respiratory protection and the injury records.
$149 a monthTake one area on its own at $149 a month, or take Complete — every rule — at $649 a month billed annually. The whole price is on one page.
Send us a recent export and we will run these rules against your real records and show you what is already open today. No obligation, and nothing is kept unless you decide to go ahead.