HIPAA Example Evidence

The table below lists commonly evidenced control areas for Health Insurance Portability and Accountability Act (HIPAA) and the artifacts that typically satisfy them; attach these to your controls as evidence.

Control Area	Example Evidence
Customer data policies	Core policy set covering asset management, information security, acceptable use, and data protection
Least privilege for sensitive data access	System access control policy
Internal communication channels	Screenshots from messaging or paging tools showing how security events reach the right personnel
Periodic access reviews	Closed tickets recording review of access lists for in-scope cloud environments, SaaS applications, infrastructure as code tools, and security tooling, with reviewer comments on the results
Periodic risk assessment	The most recent completed risk assessment report
Risk treatment plan	Documented remediation plans for risks the assessment identified
Penetration tests	The most recent annual penetration test report
Asset inventory	A documented listing of all assets (workstations, mobile devices, servers, databases) plus cloud console screenshots enumerating infrastructure
Architecture diagram	An approved architecture diagram
Network diagram	A documented network diagram demonstrating segmentation of your cloud environments
Business continuity and disaster recovery (BCP/DR) tests	Results from the most recent business continuity or disaster recovery test
Incident response team	A documented roster of incident response team members with the responsibility and authority to coordinate response procedures
Security team or steering committee	Evidence that a security team owns the design, implementation, management, and review of security policies, standards, baselines, and procedures
Timely security team communication	Screenshots from communication tools showing the path for security events to reach appropriate personnel
Contractor requirements	An executed contract between your organization and key vendors
Termination and offboarding checklist	Completed termination checklist or help desk ticket for a recently departed employee
Cryptography policies	A list of everywhere data is sent or received over open public networks, documented standards for the protocols and algorithms protecting that data, and configuration screenshots showing those protocols in place
Vendor register and agreements	A current centralized vendor inventory with relationship owner, service description, and risk rating; screenshots from your vendor management system showing risk categorization; an executed agreement with a vendor that accesses, processes, or stores your information assets
Authentication protocol	Screenshots of a user logging in via single sign-on (SSO) or username and password as applicable, plus screenshots showing multi-factor authentication (MFA) is required for employees or offered to users
Secure password storage	Database screenshots demonstrating passwords are stored as salted hashes
Inactivity and browser exit logout	Screenshots showing users are signed out when the browser or tab closes and after a defined inactivity timeout, with reauthentication required
Commitments communicated to customers	A recently executed customer service agreement, terms of service published online, and sign-up screenshots showing users must accept the terms before use
Access provisioning	A documented access request form or help desk ticket for a recent new hire
Root access control	Screenshots showing production login requires a unique SSH account, or a server setting showing the root account cannot log in
Logging system	Screenshots of the location where system activity logs are stored
Log management system	Alert configuration from the logging software, log storage screenshots, and evidence that corrective action followed an alert
Databases monitored and alarmed	Monitoring tool screenshots showing databases are watched with personnel alerting, plus evidence identified incidents were escalated per policy
Messaging queues monitored and alarmed	Monitoring tool screenshots showing queues are watched with personnel alerting, plus escalation evidence for identified incidents
NoSQL databases monitored and alarmed	Monitoring tool screenshots showing NoSQL databases are watched with personnel alerting, plus escalation evidence for identified incidents
Servers monitored and alarmed	Monitoring tool screenshots showing servers are watched with personnel alerting, plus escalation evidence for identified incidents
Intrusion detection/prevention	Screenshots from AWS GuardDuty, Azure Sentinel, GCP Security Command Center, or an equivalent showing the service enabled, the threat types it detects, and who gets alerted
Encrypted remote production access	Screenshots showing production access is denied without a VPN connection and succeeds once connected
Credential key management	Key management procedures within the encryption policy and evidence of the cryptographic technique used to manage keys
Daily backup status monitoring	Tickets showing backup failures were caught and resolved
Failed backup alert and action	The backup service's failure notification configuration, an example failure alert, and the ticket documenting resolution
Backup restore testing	Screenshots of a backup snapshot restored completely and accurately, or restore evidence from the annual DR test
Customer data deletion on termination	For a recently churned customer, disposal logs or screenshots showing customer-specific resources were decommissioned, plus the customer agreement stating the disposal commitments
Clean desk and clear screen	Acceptable use policy and, where applicable, records of its acknowledgement
Disposal of sensitive paper records	Observation of hard copy material being destroyed, on-site or over a video call
Secure storage mechanisms	Photos of locked storage or shred bins at office locations
Disposal of data on hardware	Data retention policy or equivalent documenting the disposal procedure
Notice and acknowledgement of privacy practices	Registration flow screenshots showing new users receive the notice of privacy practices before sign-up completes
Annual privacy notice review	Minutes from management's yearly meeting reviewing privacy practices
Privacy policy publicly available	Screenshot of privacy practices published on your website
Allowable use and disclosure	The section of your privacy practices covering permitted uses and disclosures
Periodic review of privacy policy	Minutes from management's annual privacy policy review
Procedures for information disposal	A documented data deletion policy
Authentication required for access	Screenshots of a user authenticating before viewing their information
Users can access their information	Screenshots of where users find their data in the product, such as a profile page
Users can modify their information	Screenshots of a user editing their personal information inside the application
Privacy requirements communicated to third parties	Evidence that third parties receiving personally identifiable information (PII) were given your handling requirements
Third-party disclosure provisions	Executed contracts with PII-receiving third parties containing provisions to protect personal information
Authorized third parties for PII	A documented, authorized list of third parties permitted to receive or access PII
Incident report template and process	Documented incident response procedures
Privacy and security requirements in third-party agreements	Executed DPAs, business associate agreements (BAAs), or service provider agreements with third parties given access to personal data
Unauthorized disclosures by third parties	Executed third-party contracts containing personal information protection provisions
Third-party breach reporting instructions	Contracts confirming third parties with PII access are told how to report breaches to you
Notification of incidents or breaches	Documented breach notification procedures and the notification template
Use of subprocessors communicated	The section of your published privacy practices listing the third parties that receive PII
Contact information for privacy concerns	The section of your privacy practices giving contact details for inquiries, complaints, and disputes
Point of contact for privacy inquiries	Screenshots showing how a customer submits privacy inquiries, complaints, or disputes
Privacy inquiries tracked	Screenshots of the tracking system for complaints and inquiries, plus an example showing resolution was communicated and corrective action taken
Quarterly privacy compliance review	Minutes from quarterly management meetings tracking compliance with privacy practices and regulations
Board oversight briefings	Board meeting minutes showing cybersecurity and privacy risk were discussed
Physical access to facilities	Physical access control policy
Removable media encryption	If the company issues removable media to employees, evidence the devices are encrypted
Data loss prevention (DLP)	Screenshots of the DLP tooling and an example of an email blocked for containing sensitive data
File integrity monitoring (FIM)	FIM software screenshots and examples of the tool detecting changes
Control self-assessments	Annual internal control assessment report with findings, plus evidence corrective actions were taken
Incident response test	The most recent incident response tabletop exercise
Business continuity plan	The approved plan showing activation criteria, roles and responsibilities, recovery strategies for critical processes, and the approval or last-review date
Business impact analysis	Business impact analysis, often part of the business continuity plan
Vendor management policy	The policy covering due diligence before engagement, risk classification of vendors, contractual security requirements, and ongoing monitoring cadence
Event logging	The relevant section of the data protection policy
Competence records	Job descriptions for a recent hire and an existing employee; recruitment records such as interview invites, interviewer feedback, and candidate evaluations; a completed performance evaluation from the past year; records of education, certifications, and training demonstrating competence for assigned roles
Asset management policy	The policy covering asset inventory, assigned ownership, classification, acceptable handling, and disposal requirements
Activity review	On a cadence you define: tickets recording which audit logs were reviewed, by whom, and when; tickets or minutes recording review of security incident reports; tickets recording review of system activity logs
Designated security officials	Information security policy, or the job description of the designated security official responsible for overseeing security rule compliance
Security updates	Information security policy
Privacy, use, and disclosure	Privacy, use, and disclosure policy
Breach notification	Breach notification policy
Group health plans	Plan documents mapping the requirements to controls; mark out of scope if you are not a group health plan
BAAs	Vendor management policy, business associate policy, and the BAA template if it is not embedded in the policy
HIPAA awareness training	Privacy, use, and disclosure policy, completion certificates from your HIPAA training provider, and any other records of training on protected health information (PHI) handling
Document retention period	Data protection policy plus a retention schedule listing record types (such as BAAs) and their retention periods (such as 7 years), stored with your evidence and linked to the control
Data secure disposal	Data disposal policies and procedures
Account lockout after failed logins	Lockout configuration for relevant systems showing the failed-attempt threshold and lockout duration
Password history enforcement	Configuration screenshots showing new passwords must differ from the previous four
Management approval for media transfer	Records from a recent media transfer, including distribution to individuals, showing approval by an authorized manager
Multiple methods for security awareness	Evidence that periodic security updates go out through varied channels, such as newsletters, intranet reminders, or chat announcements
Phishing simulations	Campaign configuration screenshots, results dashboards, and an example simulated phishing email
Logging and monitoring policy	The policy defining which systems and events are logged, retention periods, who reviews logs, and the review cadence