HRSA operational site visits have a well-deserved reputation for comprehensive scope — reviewers examine governance, clinical quality, finance, compliance, and operations with a thoroughness that reflects the federal programme investment they are evaluating. Information security has historically been addressed in site visits through the compliance review component, which examined HIPAA status at a relatively high level.
In 2026, that examination has become more substantive. Reviewers are asking specific questions about technical controls, testing the health centre's ability to describe its security programme from genuine knowledge rather than documentation familiarity, and examining business continuity capability in specific cybersecurity incident scenarios. Health centres that encounter this scrutiny without preparation spend significant time during the review explaining gaps rather than demonstrating strength.
The health centres that handle the information security component of HRSA site visits most effectively treat it the same way they treat the clinical quality component: with a designated expert who manages the programme actively and can speak to its current state accurately, supported by organised documentation that the reviewer can examine directly. This article provides the documentation checklist, the answer scripts for the four questions reviewers consistently ask, and the 90-day preparation timeline that converts a potentially stressful site visit into a confident compliance demonstration.
The Five Documents Reviewers Request
Based on current HRSA site visit protocols and post-visit debriefs from health centres in the field, five categories of cybersecurity documentation are most commonly examined during 2026 site visits. Organise these in a physical or digital folder that can be produced within five minutes of a reviewer's request.
1. HIPAA Security Officer Designation
A document naming the designated Security Officer by name and title, with their contact information and a brief description of their responsibilities. Reviewers will ask the Security Officer questions directly — the designation document must match what that individual actually does. A Security Officer who is also the IT director, executive director, or a clinical director with multiple other responsibilities is not disqualifying; what matters is that the designated individual actively performs the security function and can demonstrate that knowledge in conversation.
What reviewers look for beyond the document: when they ask "what does your Security Officer do on a week-to-week basis," the answer should be specific. Reviewing access logs, following up on vulnerability scan findings, updating the risk register, conducting phishing simulation reviews — not "overseeing our HIPAA compliance programme."
2. HIPAA Security Rule Risk Analysis (Most Recent)
The full document, not a summary. Reviewers examine three things: scope (does the analysis cover all service lines, all physical locations, and all technology systems that create, store, or transmit ePHI?), methodology (is the risk identification and rating process systematic and documented?), and currency (was it completed within the past 12 months?). A risk analysis completed 18 months ago is out of compliance with the annual requirement. A risk analysis that covers the EHR but not email, mobile devices, or remote access workstations has scope gaps that will generate follow-up questions.
3. Security Awareness Training Completion Records
Individual documentation confirming that every staff member with ePHI access completed HIPAA Security Rule training in the current compliance year. A training roster showing 47 of 52 staff completed training, with five names missing, will generate a conversation about the five. The documentation should include the staff member's name, the training module completed, the completion date, and a reference to the training content. "We did a training session last March" is not documentation. Individual records with staff names and completion dates are documentation.
4. Business Continuity Plan — Cybersecurity Incident Section
Specifically the section describing what happens to patient care operations during a cybersecurity-related system outage. Reviewers ask this question because they have encountered health centres that had no answer — organisations whose business continuity planning addressed natural disasters but had not extended that thinking to ransomware or EHR vendor outages. The section should address: how clinical staff access patient information when the EHR is unavailable; how medication administration is managed without electronic records; how appointment scheduling and patient communication continue; and who makes the decision to invoke downtime procedures and how that decision is communicated.
5. Business Associate Agreement Inventory
The current list of vendors with ePHI access and the BAA execution status for each. Reviewers may ask about specific vendors by name — particularly EHR vendors, billing services, cloud storage providers, and managed IT or managed security service providers. The inventory should confirm that BAAs are in place, identify the execution date, and note the renewal date where applicable. A BAA inventory that has not been reviewed in two years will likely be missing vendors added during that period.
The Four Questions Reviewers Ask — and How to Answer Them
The most effective preparation for the information security component of an HRSA site visit is not documentation assembly alone. It is the ability of the designated Security Officer to answer specific questions accurately and from knowledge. The following four questions appear consistently across 2026 site visit reports. For each, the confident answer represents the response of a health centre with an active security programme; the unprepared response represents what reviewers actually hear when the programme is incomplete or the Security Officer is not prepared.
REVIEWER QUESTION: "Walk me through what happens when a staff member loses a device that has patient information on it."
✓ CONFIDENT ANSWER: "When a device is reported lost or stolen, the Security Officer is notified within [X] hours per our incident response procedure. We use [MDM system name] for mobile device management, which allows us to remotely wipe the device within [timeframe]. The incident is logged in our security incident register. If the device contained ePHI and we cannot confirm the data is encrypted and unreadable, we conduct a four-factor breach risk assessment within 24 hours to determine whether breach notification is required under HIPAA. We have [X / had zero] device loss incidents in the past 12 months, all resolved through [remote wipe / encryption confirmation]."
✗ UNPREPARED RESPONSE: "We have a policy about that. I would need to check what it says exactly. We do have MDM — IT handles that."
DOCUMENTATION TO HAVE OPEN: The MDM management console open showing enrolled devices; the device loss incident response procedure; the security incident log for the past 12 months
REVIEWER QUESTION: "How does the health centre ensure that staff working from home are protecting patient information?"
✓ CONFIDENT ANSWER: "All remote access to our clinical systems and patient data goes through our VPN, which requires multi-factor authentication — staff cannot connect without both their password and a second verification step. Remote workstations are enrolled in our MDM programme, which enforces encryption, screen lock, and our acceptable use policy. Staff who work from home completed our remote access security training in [month/year], which covered home Wi-Fi security, screen privacy, and PHI handling outside the office. We do not permit staff to access ePHI from personal devices that are not enrolled in our MDM programme."
✗ UNPREPARED RESPONSE: "We have a remote access policy. We remind staff about security practices. Most of our people are pretty careful."
DOCUMENTATION TO HAVE OPEN: The remote access policy; the MFA implementation record or screenshot showing MFA enforcement; the remote-worker device inventory from MDM
REVIEWER QUESTION: "Has the health centre experienced any security incidents in the past 12 months? What happened?"
✓ CONFIDENT ANSWER: "Yes / No. [If yes:] We experienced [description of incident — e.g., a phishing email that resulted in one staff member clicking a malicious link] on [date]. The incident was detected by [monitoring system / staff report] within [timeframe]. We contained it by [specific action], conducted a four-factor breach risk assessment, and determined [whether breach notification was required and what action was taken]. The incident is fully documented in our security incident log, which I can show you. We updated our training programme in response by [specific change]." [If no:] "We have had no reportable security incidents in the past 12 months. Our incident log shows [number] potential security events that were investigated and determined not to constitute reportable incidents — I can walk you through those."
✗ UNPREPARED RESPONSE: "I don't think we've had anything serious. I would need to check with IT. We had some phishing emails but I don't know if those count."
DOCUMENTATION TO HAVE OPEN: The security incident log for the past 12 months; the four-factor breach risk assessment form; any breach notification records if applicable
REVIEWER QUESTION: "What would your nurses do if the EHR was unavailable for 24 hours?"
✓ CONFIDENT ANSWER: "Our downtime procedure is documented and staff have been trained on it. If the EHR is unavailable, nursing staff use our downtime paper forms to document assessments and medication administration — we keep a 48-hour supply of printed downtime forms at each clinical workstation. Medication orders are verified from the printed medication administration records we generate and update daily as a downtime preparation step. The clinical supervisor is responsible for communicating the downtime status to all staff and initiating the paper documentation process. Once the EHR is restored, we have a defined process for reconciling paper records back into the electronic system, which is the Security Officer's responsibility in coordination with the EHR administrator."
✗ UNPREPARED RESPONSE: "That would be a big problem. Our EHR is pretty reliable though. I suppose nurses would call the supervisor. We haven't had that happen."
DOCUMENTATION TO HAVE OPEN: The written downtime procedure; a sample of the printed downtime forms; the daily printed MAR generation procedure
State-Specific Considerations for HRSA Site Visit Preparation
HRSA site visit protocols are national, but state-specific regulatory frameworks create additional information security documentation requirements that reviewers may examine alongside the federal HIPAA standard. Three state contexts deserve specific attention.