7 Documentation Gaps That Turn a Small Incident Into a Large Penalty

November 6, 2026 · HIPAA Security Suite

The Same Incident, Two Very Different Years

Read enough enforcement actions and a pattern becomes hard to miss. The penalty rarely tracks the severity of the underlying event. Small breaches produce large settlements; large breaches sometimes close quietly. What separates them is what the organization could produce when asked.

An investigation is largely a documentation exercise. The regulator cannot observe your practice a year ago; they can only read what you wrote down at the time. When the record is thin, the investigation widens — because the only way to find out what your safeguards were is to keep asking. Here are the seven gaps that most reliably turn a contained event into an expensive one.

1. No current risk analysis

This is the first request in nearly every investigation and the most-cited failure in recent enforcement. "Current" is doing real work in that sentence: an analysis from three years ago, before you added a location and moved to a new EHR, is evidence that you once understood your risks rather than that you understand them now. If you have one finding to close before year-end, this is it.

2. No record of what you did about the findings

Having the analysis is the first question; acting on it is the second, and OCR has signaled that the second is now squarely in scope. A report with recommendations and no follow-through demonstrates that you identified a risk and left it in place — which is materially worse than never having looked, because now the knowledge is documented. Keep a register with owners, dates, and evidence, as we covered in the shift from risk analysis to risk management.

3. Missing business associate agreements

An easy finding, made in minutes, and difficult to explain away. Investigators ask for the vendor list and then for the corresponding agreements, and gaps between the two lists are self-evident. Worth noting: an unsigned agreement in a folder is not an agreement, and a vendor's own terms of service is not a BAA unless it contains the required provisions.

4. No workforce training records

Not a slide deck — a roster. Who was trained, on what content, on what date, with acknowledgment. Practices that train diligently but never record it are in the same position as practices that never trained, because the evidence is identical: nothing. Include volunteers, contractors, and anyone else who touches PHI, and include the training given to new hires on arrival rather than at the next annual cycle.

5. No sanction policy, or one that was never applied

The Security Rule requires a sanction policy for workforce members who violate your procedures. Most practices have one buried in a manual. Fewer can show it has ever been used. If an investigation reveals that an employee snooped in records and the organization's response is not documented anywhere, the policy reads as decorative. A brief, dated note of what happened and what action was taken is enough.

6. No documented decisions on addressable specifications

If you did not encrypt, did not implement automatic logoff, or skipped another addressable specification, there should be a written analysis explaining the decision and what you do instead. As we covered in addressable has never meant optional, that document is the difference between a defensible judgment call and an unexplained absence.

7. No incident log for the events that were not breaches

This one is counterintuitive, and it is the gap that most often widens an investigation. Most security events are not reportable breaches — a misdirected fax retrieved immediately, an email to the wrong internal recipient, a device briefly unaccounted for. HIPAA expects you to evaluate each one, and a documented risk assessment concluding "low probability of compromise" is exactly how you justify not notifying.

Practices that keep that log can show a pattern of diligence: events were noticed, evaluated, and handled. Practices with no log look like they never noticed anything, which invites the question of what else went unnoticed. The log helps you most in the cases where you decided not to report.

The Common Thread

None of these seven require sophistication. They require someone to write down something that already happened. The training occurred; the roster did not. The vendor was vetted; the agreement was never countersigned. The incident was handled well; nobody recorded the reasoning.

That is genuinely frustrating, because the practices that fall into these gaps are usually not the careless ones. They are busy ones where the work gets done and the documentation does not, and from the outside those two situations are indistinguishable.

A Two-Hour Test

Pick an afternoon and try to produce all seven: current risk analysis, remediation register, BAA list with signed agreements, training roster, sanction policy with any applications, addressable-specification decisions, incident log. Whatever you cannot find in two hours is what you would not find under investigation either — and now you know before it matters.

Call to Action

If the two-hour test sounds uncomfortable, that is the useful signal. Schedule a walkthrough to see how these seven records stay current and findable in one place, or take the 3-minute readiness quiz to see which one you are missing.