The HIPAA Annual Review: What to Update Every Year and When

What does a HIPAA annual review have to update?

Six things: the risk analysis and its risk management plan, the written policies, workforce training, user access, the business associate list, and the breach log that goes to HHS. The Security Rule describes these as periodic rather than annual, but once a year is the cadence OCR, cyber insurers and hospital vendor reviews expect, and it is the one that keeps the documentation from drifting.

Run it as a calendar, not a weekend. Spread the six items across the year and each one takes an afternoon.

The checklist

Item	What to do	Regulation
Risk analysis	Reconfirm where ePHI lives, add new systems and vendors, re-rate the risks, update the risk management plan with new owners and dates	164.308(a)(1)(ii)(A) and (B)
Evaluation	Check that each policy still matches what staff do; record the result	164.308(a)(8)
Policies	Review every policy, update the version and date, retire what no longer applies; keep the old versions six years	164.316(b)(2)
Training	Confirm every workforce member was trained, new hires included; retrain where policies changed; keep attendance records	164.308(a)(5), 164.530(b)
Access review	Compare every account on every system holding ePHI with the current staff list; remove leavers; reduce over-broad rights	164.308(a)(3) and (a)(4)
Business associates	Confirm a signed BAA exists for every vendor touching PHI, and that it covers the services you now use	164.308(b), 164.504(e)
Contingency plan	Test a restore from backup; update contact lists and the emergency access procedure	164.308(a)(7)
Breach log	File the year's breaches affecting fewer than 500 individuals with HHS within 60 days of year end	164.408(c)
Notice of privacy practices	Confirm the posted and handed-out versions match and reflect any change in practice	164.520
Incident log	Read the year's security incidents; look for repeats that point to a missing control	164.308(a)(6)

A calendar that works for a small practice

• January and February: breach log to HHS (the deadline for the previous calendar year is 60 days after 31 December, so 1 March in 2027). Access review while the year's leavers are fresh in mind.
• March and April: risk analysis refresh. Walk the systems, update the inventory, re-rate. Our guide to the HIPAA risk analysis explains what the document contains.
• May and June: policy review against the refreshed analysis. The policies a small practice needs gives the full list to check against.
• July and August: training, timed so new policies are taught rather than filed. Contingency plan test.
• September and October: business associate inventory. Each agreement checked against the BAA checklist.
• November and December: evaluation under 164.308(a)(8). Did the year's changes break anything? Write the summary the security officer signs.

Move things around to suit your busy season. The point is that each item has a month and an owner.

What changes the answer this year

Three things to watch for in a 2026 review.

New systems. A telehealth platform, an AI scribe, a texting service or a new imaging vendor added since the last analysis is in scope and probably has no BAA yet. Ask every department what they started using.

Leavers with live accounts. This is the most common finding in access reviews and the cheapest to fix. Check the EHR, the email tenant, the billing portal, the cloud storage and the building alarm.

The Security Rule update. The January 2025 proposal would make the annual cadence explicit, with a required yearly compliance audit and a yearly review of the risk analysis; it is still a proposal; the Unified Agenda lists final action for July 2027; the current rule applies now. A practice that already runs the calendar above will have little to add when the final rule arrives.

What to keep as evidence

Each item on the list produces a record: the dated risk analysis, the policy version log, the training roster, the access review spreadsheet with sign-off, the BAA register, the restore test result and the HHS portal confirmation. Keep them together, keep them six years, and the next OCR letter or insurance renewal becomes a matter of attaching files rather than reconstructing a year.

If the review finds the analysis was never thorough in the first place, that is a bigger job than a refresh. Risk analysis vs a full compliance program explains the difference and what to do first.

Where AccuSights fits

We run the calendar with you: the named engineer who did the risk analysis does the refresh, the endpoint agent is built in so device evidence collects itself, and remediation of what the review finds is included. We do not certify HIPAA compliance, because no one can. Start with the HIPAA framework page or book a free Risk Diagnosis and we will tell you which months you have missed.