HIPAA Records Management Checklist for Healthcare Facilities

Healthcare records management under HIPAA isn't just about locking the file room — it's about being able to demonstrate to an auditor exactly how every record was created, accessed, retained, and destroyed. This checklist captures the same workflow Reynolds engineers run on every HIPAA project across our 22+ Lehigh Valley healthcare clients.

Step 1: Retention Schedule Audit

Before any digitization or destruction work begins, you need a written retention schedule that covers every record type your facility produces. Most failed audits start here.

• Pull your existing retention policy (if any) and your state's medical-records retention law
• Confirm the longer of the two applies (federal HIPAA + state law — never the shorter)
• Cross-reference Joint Commission's record-retention guidance for the record types they inspect
• Document the rationale per record type — auditors ask

Step 2: Active vs Inactive Record Classification

Auditors expect to see a clear boundary between records in active use vs. those in retention storage. Mixing them is a top-5 finding in our audit-prep work.

Step 3: Access Control & Audit Logging

HIPAA Security Rule §164.312(b) requires audit controls — meaning every record access must be traceable. If you use paper records, this is the step where Reynolds usually recommends scanning.

1. Confirm every system that holds PHI has user-level audit logging enabled
2. Confirm logs are retained for at least 6 years (HIPAA minimum)
3. Confirm a documented log-review procedure exists (at least monthly)
4. Confirm break-the-glass procedures are tested and logged
5. For paper records: sign-in/sign-out log for every retrieval, retained 6 years

Step 4: Secure Destruction Documentation

Destruction without documentation is a HIPAA violation per §164.530(j). Every record destroyed needs a Certificate of Destruction (COD) with specific elements.

Required Certificate-of-Destruction Elements

• Date of destruction
• Method of destruction (shred / pulp / incinerate / data overwrite)
• Description of records destroyed (date ranges + record types — not patient names)
• Witness signature(s)
• Vendor name + DBA license # (for outsourced destruction)
• Chain-of-custody log from removal through destruction

Step 5: BAA Coverage for Service Providers

Every vendor that touches PHI — scanning, storage, destruction, IT — needs a signed Business Associate Agreement. Audit prep is the right time to verify yours are current.

# BAA Coverage Audit (run this query against your vendor list)
# For each vendor:
#   1. Does the vendor touch PHI?  (Y/N)
#   2. Is there a signed BAA?      (Y/N)
#   3. Is the BAA dated within 24 months?  (Y/N)
#   4. Does the BAA name a specific facility / scope?  (Y/N)
#   5. Has the vendor's compliance posture been re-verified in the last 12 months?  (Y/N)
# Any "N" answer = gap to remediate before next audit.

Step 6: Continuous Monitoring

HIPAA compliance isn't an event, it's a posture. Reynolds recommends a quarterly self-audit using the steps above plus the metrics in the spreadsheet linked below.

Watch: Reynolds Healthcare Records Workflow

Below is a 3-minute walkthrough of how Reynolds engineers run the audit-prep workflow for a healthcare client. It covers the steps above and shows the chain-of-custody documentation in practice.

Next Steps

If you've worked through this checklist and found gaps, Reynolds offers a free 90-minute HIPAA records assessment for healthcare facilities in PA, NJ, DE, and MD. Our compliance team will walk through your current state and produce a prioritized remediation plan within 5 business days.