What to Audit in a Health Information System

Executive Summary: For health system leaders, an information system audit is a governance tool that objectively assesses whether technology is safe, compliant, and fit-for-purpose. Federal law (e.g. the HITECH Act) even mandates periodic HIPAA compliance audits, and NIST guidance calls for regular technical and non-technical evaluations of security controls. A comprehensive audit spans five domains – security, data integrity, availability, interoperability, and identity/access – and produces a prioritized risk report. Executives should see vulnerabilities framed in terms of business impact (patient harm, regulatory fines, downtime), with clear remediation priorities and cost estimates. Audits should occur on a steady schedule (not just after an incident) and include human/process reviews. Organizations that treat auditing as an ongoing culture rather than a one-off event tend to achieve stronger security and compliance results.

Why Audits Matter to Leadership

Auditing health IT systems is fundamentally about risk management and compliance, not just IT. An audit gives leadership an “apples-to-apples” view of security gaps or compliance holes. For example, HIPAA’s Security Rule explicitly requires periodic reviews of safeguards, and the HITECH Act obliges regulators to conduct regular HIPAA audits. These audits reveal potential violations that could trigger huge fines or breaches that endanger patients. Executives need the audit findings translated into business language: which vulnerabilities could lead to a HIPAA fine or a patient safety incident if ignored. A well-structured audit report highlights the most critical gaps, rates their risk (e.g. likelihood and impact), and outlines a clear remediation roadmap (with effort/cost estimates) so leaders can make informed, strategic decisions.

Importantly, an effective audit isn’t a one-time checklist exercise. It should be part of governance: senior leaders should review audit results, budget remediation, and ensure policies are actually followed. Human factors matter: for instance, confirming that staff follow access-control policies or that change-management processes are enforced is often as revealing as technical scans. In short, audits give leadership the evidence to act – they turn IT issues into enterprise risks that can be managed.

Five Key Audit Domains

• Security & Cybersecurity: Verify protections against cyberthreats and data breaches. This includes penetration tests, vulnerability scans, firewall/IDS configurations, encryption status, patch management, and malware controls. (Regulators and frameworks call for robust security controls – e.g. annual risk assessments and controls audits are a best practice.) Findings should highlight any exploits or missing defenses that could expose patient records or systems.
• Data Integrity and Quality: Ensure that clinical data is accurate, complete, and uncorrupted. Data integrity “assures that the data is accurate and has not been changed”. The audit should check logs and controls that prevent tampering or unintended edits (for example, copy-and-paste errors in EHR notes). Inaccurate data (like a vital sign typo or mislabeled lab result) can directly harm patients, so audits should validate reconciliation processes, data validation rules, and audit trails for key data.
• Availability & Business Continuity: Confirm that systems stay up and recover quickly from failures. Review disaster recovery and backup plans, uptime reports, and failover testing. Unplanned EHR or system downtime can halt care and endanger patients, so executives should ensure robust contingency plans. (Surveys show most hospitals have experienced outages in recent years, often with inadequate recovery plans – an audit should expose any gaps.) Recommendations often include redundant systems, regular failover drills, and tested recovery procedures to guarantee continuity of care.
• Interoperability & Standards Compliance: Check that the system meets required standards and data exchange obligations. For example, audit that certified EHR modules support current interoperability APIs (FHIR, HL7, etc.) and meet any API certification criteria. Federal rules (21st Century Cures Act) now require open patient-access APIs and prohibit information blocking, meaning patients must electronically access their full health record at no charge. The audit should verify compliance with these mandates (e.g. successful exchange with outside systems, no unauthorized blocking) and adherence to relevant coding/terminology standards.
• Identity & Access Governance: Ensure only authorized users can access appropriate data. Review role-based access controls, authentication methods (ideally multi-factor), and periodic access recertification. The audit should detect orphaned accounts, excessive user privileges, and gaps in how quickly access is revoked for departing or role-changed staff. Well-run access governance is a key control for patient privacy and is often required by regulations as part of security management.

Translating Findings into Business Impact

An executive-level audit report should convert technical gaps into concrete business risks. Each audit finding should be rated by likelihood and impact – e.g. the potential cost of a privacy breach or operational disruption if unaddressed. Leadership doesn’t need code details, but they must understand the risk exposure and priority. For example, instead of a technical note on an unpatched server, the report might say, “If exploited, this vulnerability could expose patient records or halt scheduling operations.” The report should then assign a priority and an estimated remediation effort or budget. This risk-based roadmap helps boards and executives allocate resources: fix the high-impact, high-probability issues first, while documenting less critical items as future improvements.

Auditing People and Processes

Good IT audits go beyond technology to review human procedures and governance. Auditors should verify that policies are actually enforced: are access provisioning and deprovisioning done on schedule? Are change management approvals documented? Do staff receive regular security training and follow its guidance? Often, an access control policy is only as strong as its enforcement – so audit whether periodic user access reviews are conducted and logged. Similarly, check incident response drills and whether lessons learned from past incidents were implemented. Vendor management is also key: ensure business associate agreements are in place and that third-party services have been independently assessed. In practice, interviewing staff and observing processes (e.g. watching how credentials are requested or how patches are applied) can reveal gaps that technical scans miss.

Continuous Audit Culture and Cadence

Security and compliance are not “once-and-done.” Regular, scheduled audits are far more effective than reactive one-offs. HIPAA actually mandates periodic security evaluations, and frameworks like NIST encourage continuous monitoring of controls. Ideally, critical areas (like network security and data access) should be audited annually or semi-annually, with interim checks or automated monitoring for high-risk assets. Maintaining an ongoing audit cycle (risk assessment → remediation → reassessment) ensures new threats or changes don’t slip through. In essence, build audit into your governance rhythm: treat audit findings as inputs into enterprise risk management, with accountability for closure at the appropriate level.

Governance Recommendations for Boards and Executives

Audit results should directly inform strategic oversight. We recommend boards or executive committees own this process. For example, many hospitals assign cybersecurity oversight to a risk or audit committee. That committee should regularly review summarized audit findings, ensuring that remediation progress is tracked and funded. The CIO or CISO should report metrics (e.g. number of open findings, mean time to fix, audit frequencies) at board meetings. Key governance questions include: Does the organization have a tested incident response and continuity plan? Are we meeting all mandated requirements (HIPAA, meaningful use, etc.)? Has the latest audit found significant gaps? By integrating IT audit into the governance cycle – approving risk appetite, funding security initiatives, and following up on remediation – leadership makes sure the health system remains compliant and resilient.