An auditor doesn’t walk in and ask if you care about resident privacy. They ask for the access log from March, and then they check whether it matches what your policy says should be happening. That gap, between what’s written down and what’s actually running, is where most communities lose points, not because they’re careless, but because nobody’s checked the two against each other in a while.
Preparing for a security audit in senior living means closing the gap between what your policies say and what your community actually does, before an auditor finds it for you. That includes organizing documentation, testing whether your physical and technical safeguards work as described, and confirming staff actually follow what’s written down. Communities that treat this as an ongoing practice, not a pre-audit scramble, consistently find fewer surprises when the audit happens.
This guide walks through what auditors actually check, how to get your documentation in shape, and what changes if you’re running a skilled nursing or long-term care facility instead of independent or assisted living.
Not Sure How Audit-Ready You Actually Are?
If you’re earlier in this process and still mapping out where your risk actually sits, Identifying and Mitigating Cyber Risks in Senior Living Communities is the place to start.
What Do Auditors Actually Check During a Security Audit?
Auditors check three things: whether your documentation exists and is current, whether your physical and technical safeguards function the way policy describes, and whether staff’s daily behavior matches what’s written down. A binder of unused policies fails an audit just as fast as having no policies at all.
Under the HIPAA Security Rule (45 CFR Parts 160 and 164), the current round of HHS Office for Civil Rights audits is focused specifically on risk analysis and access control provisions, the same categories OCR has repeatedly identified as its most common audit findings.
Documentation That Holds Up
If it’s not written down, it doesn’t count, and if it’s written down but three years old, it barely counts more. Auditors want to see:
- Risk assessments and mitigation plans, dated, with evidence they were acted on, not just filed. According to HIPAA Journal’s tracking of OCR enforcement actions, settlements rose from 13 in 2023 to 21 in 2025, and an inadequate or missing risk analysis was the cited root cause in nearly every major case.
- Access logs, for anything touching electronic protected health information (ePHI), showing who accessed what and when, pulled from centralized logging rather than assembled system by system after the fact.
- Incident response documentation, not a vague policy statement, but an actual step-by-step plan with named responsibilities, typically structured around a recognized framework like NIST Special Publication 800-61. HHS also publishes NIST Special Publication 800-66 specifically as an implementation guide for the Security Rule, worth having on hand if you’re building this from scratch.
- Training records, showing who completed what, and when, not just that a training program technically exists.
Vendor access isn't usually the issue caught first. It's an access control policy that says permissions get reviewed quarterly, sitting next to a permissions list that hasn't actually been touched in over a year.
Scattered documentation across email threads and someone’s desktop folder is the most common reason communities scramble the week before an audit. A single, organized, access-controlled repository, digital or physical, is worth building before you need it, not during.
Physical and Technical Safeguards Auditors Will Test
Auditors don’t just ask about safeguards, they test them. According to OCR’s own published audit findings, the most frequently cited technical safeguard gaps are inadequate access controls, weak authentication, and insufficient audit logging, exactly the kind of gap that doesn’t surface until someone asks you to prove it. Expect questions like: who has badge access to server rooms and network closets, and is that list current? Is full-disk encryption, BitLocker or FileVault, managed centrally across devices, or configured device by device with no way to confirm coverage? Can you actually produce a login history for a specific system on request, or does that require calling three different vendors first?
The gap that trips up most communities isn’t a missing safeguard, it’s a safeguard that exists but that nobody can produce evidence for quickly. A firewall you can’t show configuration change logs for might as well not exist from an auditor’s perspective.
Find Out What You Could (and Couldn't) Prove on Demand
What Policies Should You Review Before an Audit?
Review your access control policy for role-based permissions and multi-factor authentication (MFA) requirements, your incident response plan for specific notification timelines, and your policy review cadence itself. Under the HITECH Act’s breach notification requirements, timelines for notifying HHS and affected individuals need to be explicit, not implied.
- Access control policy. Does it name who can access what, by role, using role-based access control (RBAC) rather than shared or ad hoc permissions, and does it require MFA for anything touching ePHI? Shared logins between staff members are worth checking for specifically, since they undermine the whole point of an access log.
- Incident response plan. Does it include specific timelines for notifying affected parties and, where required, the Department of Health and Human Services? A vague “we’ll investigate” doesn’t hold up.
- Policy review cadence. When was this policy actually last touched? Set a recurring review, at least annually, and document that the review happened even if nothing changed.
Training Staff Before the Audit, Not After
Auditors will ask how you train staff on security and privacy, and they’ll sometimes ask staff directly. A caregiver who can’t explain what to do if they suspect a phishing email is a finding, regardless of how good your written policy is. Training needs to be role-specific: what a housekeeping staff member needs to know about workstation access looks nothing like what a nurse needs to know about resident record access.
Simulated phishing tests and short, regular refreshers catch gaps a single annual training session won’t. If your last staff-wide training happened during onboarding and nothing since, that’s worth fixing before an auditor asks about it.
How Is Audit Prep Different for Nursing Homes and Long-Term Care Facilities?
Skilled nursing and long-term care facilities have to file Payroll-Based Journaling (PBJ) data with the Centers for Medicare & Medicaid Services (CMS), a staffing report unrelated to cybersecurity but central to that setting’s audit readiness. Independent and assisted living communities don’t carry this requirement, one of the clearest differences between the two audit experiences.
Skilled nursing facilities undergo federal CMS certification surveys that explicitly tie staffing levels to PBJ data, a review layer assisted living communities don’t share, since assisted living licensing is regulated at the state level without that same staffing-to-documentation requirement.
For the fuller picture of how managed IT needs shift in this setting, Managed IT Services for Long-Term Care covers what changes beyond just the audit checklist.
Working With a Pre-Audit Partner
A second set of eyes catches what your own team stops seeing after looking at the same systems every day. A pre-audit assessment finds the gap between your policy and your practice while you still have time to close it quietly, instead of explaining it to an actual auditor.
If you’re trying to decide whether an internal review is enough or whether you need a full external security risk assessment, 5 Reasons Senior Living Communities Should Conduct Annual Security Risk Assessments covers why the annual, externally-led version matters even if you’re already doing internal checks.
Every piece of this, cybersecurity, budgeting, help desk, skilled nursing, works differently depending on where your community sits, and Managed IT Services for Senior Living: The Complete Guide for Community Administrators walks through how they all fit together.
Walking Into Your Next Audit Prepared, Not Scrambling
The communities that pass audits without drama aren’t the ones with zero gaps. They’re the ones who found their gaps first, on their own schedule, instead of on an auditor’s.
