Run Your Colocation HIPAA Audit With This Practical Checklist

Healthcare organizations reported 770 HIPAA breaches in 2025, the highest annual total on record, and the average breach now costs $7.42 million per incident, maintaining healthcare’s position as the costliest sector for data breaches for 14 consecutive years. If your organization colocates servers that store or process electronic Protected Health Information (ePHI), that number should focus your attention immediately. A colocation facility is not a passive rack rental; it becomes part of your compliance posture the moment your patient data touches its infrastructure.

The good news is that a structured audit approach makes this manageable. This checklist walks through every major domain you need to review before, during, and after a HIPAA audit, with a clear focus on what colocation adds to the equation.

Key Takeaways

• A signed Business Associate Agreement is non-negotiable: Signing a Business Associate Agreement (BAA) is a mandatory legal requirement for any colocation provider that hosts sensitive data, as it establishes the provider’s liability. If your provider has not signed one, stop everything else until they do.
• Physical safeguards are audited, not assumed: Data centers that store or handle ePHI usually operate as business associates under HIPAA, which makes them directly responsible for meeting physical safeguard requirements defined in a BAA, an agreement that defines the protection requirements for facilities, infrastructure, and systems. Verify these controls in writing, not just on a sales call.
• Risk analysis failures dominate enforcement: Enforcement actions involving risk-analysis failure account for roughly 90% of OCR investigations. Therefore, map your colocation provider’s documented controls into your own risk analysis every time you conduct one.
• Contingency planning must include your provider’s infrastructure: Contingency planning under the HIPAA Security Rule requires covered entities to maintain data backup, disaster recovery, and emergency mode operation plans. The colocation provider’s own business continuity plan, generator fuel supply, mean time to repair for power and cooling failures, and data access procedures during a disaster become part of your HIPAA contingency planning evidence.
• Encryption is the most cost-effective breach safeguard: Key factors for reducing data breach costs include AI-driven and ML-driven insights, security analytics, threat intelligence, and data encryption. Confirm your colocation setup supports AES-256 at rest and TLS 1.2 or higher in transit, then document it.

Quick-Start Prioritization Framework

Start here if you’re:

• New to colocation HIPAA compliance: Begin with the BAA, confirm it is executed, current, and contains breach notification timelines before touching anything else.
• Preparing for an OCR audit: Prioritize your risk analysis update and evidence documentation, since risk analysis failures drive roughly 90% of enforcement actions.
• Running a mature compliance program: Focus on contingency plan testing and log reviews, where gaps tend to hide in programs that look complete on paper.

1. The Business Associate Agreement: Your Compliance Foundation

Why the BAA Comes First

Under the HIPAA Omnibus Rule, any third party that a covered entity creates, receives, maintains, or transmits ePHI through is classified as a Business Associate. That classification applies to your colocation provider regardless of whether they can read the data on your servers. Whether a colocation provider is a business associate depends on its access: HHS has said that a cloud provider storing ePHI is a business associate even if it cannot view the data.

The practical consequence is straightforward. BAAs are required. Before moving any PHI-related workloads to a colocation facility, you need a signed BAA with the provider. The agreement should specify the provider’s HIPAA responsibilities, including their obligation to implement appropriate safeguards and report any security incidents that might affect PHI.

What Your BAA Must Contain

Use this checklist when reviewing your current or proposed BAA:

• Permitted uses and disclosures of ePHI are explicitly defined
• Provider commits to implementing safeguards aligned to the HIPAA Security Rule
• Breach notification timelines are addressed; Business Associates must report suspected breaches to covered entities without unreasonable delay, and no later than 60 days after discovery
• Subcontractor flow-down requirements and due diligence expectations are documented, along with the right to audit, evidence sharing, and remediation timelines
• The business associate is required to return or destroy PHI received from, or on behalf of, the covered entity at the agreement’s termination

Pro Tip: Do not accept a heavily modified BAA that limits the provider’s HIPAA obligations. A provider that pushes back on standard BAA language is signaling how they will behave during an actual incident.

2. Physical Safeguards: Walk the Floor Before You Trust the Paper

Facility Access Controls

Facility access controls define entry and movement within a data center environment and are implemented in layers to reduce exposure to sensitive infrastructure. During your audit, do not rely solely on the provider’s compliance documentation. Request a physical walkthrough and compare what you observe with their stated policies.

Review each of the following during your assessment:

• How visitor access is managed and logged, and what authentication is required to access the data hall
• Whether layered perimeters include 24/7 staffed security, CCTV coverage, visitor verification, detailed access logs, mantraps or turnstiles to enforce one-person entry, and controls to deter piggybacking
• Alignment between policy and practice: are documented procedures consistently followed? Are doors ever propped open? Do individuals bypass authentication through courtesy access? Are visitors properly escorted at all times?

Device and Media Controls

Apply zone-based access controls for data halls, cages, and MMRs, and regularly audit physical access, revoking access promptly when roles change. Document device re-use, repair, and disposal to prevent data remanence across tenants. Ask your provider for written evidence of their media sanitization process and request a sample certificate of destruction.

Pro Tip: Hardware disposal requirements under HIPAA specify that all ePHI must be properly removed or destroyed from devices before they are discarded or repurposed, preventing any chance of data leakage. This obligation flows down to your colocation provider. Confirm it is covered explicitly in your BAA and request documentation for any device retirement during the audit period.

3. Technical Safeguards: Encryption, Access Controls, and Audit Logs

Encryption Standards

HIPAA does not prescribe specific algorithms, but using current AES encryption standards and strong transport protections is standard practice. In practice, the industry baseline for colocation environments is AES-256 at rest and TLS 1.2 or higher for data in transit. This blueprint aligns practical controls with HIPAA technical safeguards: encrypt ePHI everywhere, standardize on TLS 1.3 and AES-256, and use AES-256 in authenticated modes such as AES-GCM for databases, object storage, and backups.

Your audit checklist for encryption should verify:

• Storage volumes and database backups encrypted with AES-256
• Network transit protected by TLS 1.2 at minimum, TLS 1.3 preferred
• Key management policy documented, with defined rotation schedules
• Centralized key management with role separation, key rotation, protected key backups, and monitoring for misuse

Audit Controls and Logging

Information system activity review and audit controls are where OCR keeps finding gaps. Your colocation environment must support your obligation to log and review ePHI access. Specifically, audit your setup against these requirements:

• Comprehensive audit controls including centralized logging, integrity monitoring, time sync, and alerting
• Time-synced logs, incident reporting capability, and evidence sharing during audits
• Physical security records including visitor logs, access reviews, maintenance logs, and media disposal certificates

Access to log data is your responsibility, not just your provider’s. Confirm through your BAA that you can retrieve these records independently during an investigation.

4. Administrative Safeguards: Risk Analysis and Workforce Requirements

Conducting Your Risk Analysis for the Colocation Environment

All ePHI created, received, maintained, or transmitted by an organization is subject to the Security Rule. The Security Rule requires entities to evaluate risks and vulnerabilities in their environments and to implement reasonable and appropriate security measures to protect against reasonably anticipated threats. Risk analysis is the first step in that process.

Critically, that analysis must cover your colocation environment as a distinct risk domain. Risk analysis requirements mean you need to evaluate threats to your ePHI wherever it resides. Your colocation provider should provide documentation to support your risk assessment, including security certifications, audit reports, and detailed control descriptions.

The HIPAA Security Rule requires periodic risk analysis but names no fixed interval. HHS OCR guidance and NIST SP 800-66 Rev. 2 both describe risk analysis as an ongoing, periodic activity. A practical approach is to review the colocation-specific section of your risk analysis annually and whenever you add new equipment, change providers, or experience a security event.

Provider Workforce and Training Verification

Your provider should maintain a documented HIPAA program, workforce training, and background checks for staff with access to your infrastructure. Request evidence of this during your audit. A provider who cannot produce workforce training records or background check policies is not positioned to support your obligations.

Pro Tip: Business associate oversight means you are expected to monitor your provider’s ongoing compliance. Request annual attestations, review updated SOC reports, and establish a formal process for evaluating continued adherence to HIPAA requirements. Build this into your calendar as a recurring task, not a one-time review.

5. Contingency Planning: Disaster Recovery in a Colocation Context

What HIPAA Actually Requires

HIPAA contingency plan requirements include a Data Backup Plan requiring retrievable, exact copies of ePHI; a Disaster Recovery Plan requiring procedures to restore any loss of ePHI and affected systems; and an Emergency Mode Operation Plan requiring the ability to sustain critical operations that protect ePHI during an emergency.

Your colocation provider’s infrastructure is directly implicated in all three. The HIPAA Contingency Plan standard requires that you maintain the availability of ePHI during emergencies. Your colocation partner should provide the building blocks, power, cooling, and network redundancy, so you can meet your Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

Checklist Items for Contingency Planning

Review the following with your provider during each annual audit cycle:

• Documented RTO and RPO targets, with evidence that recent restore tests validated those targets
• A geographically separated DR site, since this is the most common healthcare colocation deployment, satisfying HIPAA’s contingency planning requirement while providing operational failover for ransomware incidents, power events, and natural disasters
• Generator fuel supply documentation and mean time to repair records for power and cooling failures
• Internal audit records and tabletop exercise documentation showing coordination between your team and your colocation contact

6. Compliance Documentation and Audit Readiness

Certifications to Request From Your Provider

A HIPAA-compliant data center is not a facility with a special HIPAA certification. HIPAA does not certify data centers. Instead, a data center supports HIPAA compliance when its physical environment, operational controls, and supporting services help regulated organizations meet the Security Rule’s requirements for protecting ePHI.

What that means in practice: ask your provider for independent third-party evidence, not marketing language. Specifically, request:

• Compliance attestations from third-party assessments such as SOC 2 Type II and clear control descriptions
• A current HIPAA attestation letter or independent audit report
• HITRUST certification where available, since this maps multiple frameworks including ISO, NIST, and HIPAA into a single verifiable result

Mapping Provider Controls to Your Own Documentation

Map controls to HIPAA Security Rule requirements to identify gaps quickly. Create a responsibility matrix that identifies which controls your provider owns outright, which you own, and which are shared. For example, physical access controls are primarily the provider’s responsibility, while application-level access controls are yours. You must store and keep records of all privacy policies, privacy practice notices, complaints, remediation plans, and other documentation for six years after their initial creation. Apply that same retention standard to every document you collect from your colocation provider.

For organizations in Northern California looking for a facility with this documentation already in place, Datacate’s Rancho Cordova colocation facility holds HIPAA, SOC 2 Type II, SOC 3, and CSA STAR certifications, providing a compliant and secure environment for all data and service types. The facility provides biometric authentication and secure controlled physical access, and is SOC, HIPAA, and CSA STAR compliant with redundant network infrastructure and N+2 fiber redundancy.

Frequently Asked Questions

Does every colocation provider need to sign a BAA?

A Business Associate Agreement is the HIPAA-required contract between a Covered Entity and any third party, such as a hosting provider, that creates, receives, stores, or transmits Protected Health Information on its behalf. The BAA defines permitted uses, security requirements, breach-notification obligations, and each party’s liability for ePHI. If your provider has any access to systems containing ePHI, including physical access to the servers themselves, they are a Business Associate and a BAA is required.

What physical security controls must a colocation facility maintain for HIPAA?

Common HIPAA physical safeguards include facility access controls to protect physical locations and equipment from unauthorized access, including door locks, alarm systems, and video surveillance for sensitive areas like data centers or server rooms, as well as environmental protections for data centers and server rooms against environmental hazards. Your audit should verify that these controls are documented, tested, and consistently enforced, not just listed in a policy document.

How often should I audit my colocation provider for HIPAA compliance?

HHS guidance states that organizations should conduct risk analysis annually, biennially, or every three years, and also provides examples of situations that might require an updated risk analysis, including a security incident, a change in ownership, turnover in key staff or management, or the incorporation of new technology. At a minimum, review your colocation-specific controls annually and request an updated SOC 2 Type II report each year.

What happens if my colocation provider experiences a breach?

When the HHS Office for Civil Rights investigates a breach, they look beyond what went wrong during the incident; they examine your entire compliance posture, including the security controls at your data center. Your BAA should explicitly define the notification timeline and escalation path. Business Associates must report suspected breaches within 60 days of discovery, and your BAA should specify a shorter timeline.

Is a private cage required for HIPAA compliance in colocation?

HIPAA and PCI-DSS standards do not explicitly mandate a private cage, but they do require strict physical access controls. In practice, HIPAA’s physical security rule requires that only authorized personnel access systems containing PHI. While many colocation providers offer secure environments, they will not automatically include data encryption solutions. Businesses handling sensitive data should avoid shared cabinet colocation in favor of dedicated racks or private suites.

Final Thought

Running a colocation HIPAA audit does not have to be overwhelming. Work through the six domains in this checklist in order: BAA, physical safeguards, technical safeguards, administrative safeguards, contingency planning, and documentation. Assign an owner and a due date to each item. Collect evidence as you go, because OCR doesn’t take your word for it. A working checklist gives each standard an owner and dated evidence sampled across the review period, because OCR asks for the records behind every policy.

The organizations that fare best in audits treat compliance as an operational discipline, not a one-time project. Start with your BAA, verify what your provider actually does on the floor, and document everything.

Sources

1. Healthcare Data Breach Statistics: 2025 Roundup, Cobalt.io. Healthcare breach cost and frequency data. https://www.cobalt.io/blog/healthcare-data-breach-statistics
2. Healthcare Cybersecurity Statistics, 2026 Report, Total Assure. Breach volume and ransomware trend data. https://www.totalassure.com/blog/healthcare-cybersecurity-statistics
3. HIPAA Compliant Colocation Services for Hospitals: 2026 Buyer’s Guide, Inflect. BAA requirements and HITRUST overview. https://inflect.com/blog/hipaa-compliant-colocation-services-for-hospitals-2026-buyer%E2%80%99s-guide
4. Colocation for Healthcare: HIPAA-Compliant Infrastructure, Inflect. Five HIPAA Security Rule requirements for colocation facilities. https://inflect.com/blog/colocation-for-healthcare-hipaa-compliant-infrastructure-for-hospitals-health-systems-and-clinical-it-teams
5. Colocation HIPAA Compliance: Requirements, BAAs, and Provider Checklist, AccountableHQ. BAA provisions, DR protocols, and provider checklist. https://www.accountablehq.com/post/colocation-hipaa-compliance-requirements-baas-and-provider-checklist
6. Healthcare Data Center Infrastructure: HIPAA Compliance, PHI Security, Netrality. Colocation BAA readiness and physical security assessment. https://netrality.com/blog/healthcare-data-center-hipaa-compliance-phi-security/
7. HIPAA Compliance Checklist, HIPAA Journal. Documentation retention and breach notification requirements. https://www.hipaajournal.com/hipaa-compliance-checklist/
8. HIPAA Compliant Data Center: What It Is, Key Requirements, and How to Choose a Provider, AccountableHQ. Physical security requirements and BAA provisions. https://www.accountablehq.com/post/hipaa-compliant-data-center-what-it-is-key-requirements-and-how-to-choose-a-provider
9. Guidance on Risk Analysis, HHS.gov (Official). Security Rule risk analysis requirements. https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html
10. HHS Intensifies HIPAA Risk Analysis Enforcement in 2025, National Law Review. OCR Risk Analysis Initiative enforcement data. https://natlawreview.com/article/hhs-ocr-risk-analysis-enforcement-initiative-continues-under-new-administration
11. Average Cost of a Healthcare Data Breach Falls to $7.42 Million, HIPAA Journal. IBM 2025 Cost of a Data Breach Report data. https://www.hipaajournal.com/average-cost-of-a-healthcare-data-breach-2025/
12. Encryption and Key Management for HIPAA Technical Safeguards, AccountableHQ. AES-256 and TLS standards for ePHI. https://www.accountablehq.com/post/encryption-and-key-management-for-hipaa-technical-safeguards-a-practical-blueprint
13. HIPAA Business Continuity Requirements Explained, AccountableHQ. Contingency plan components and DR requirements. https://www.accountablehq.com/post/hipaa-business-continuity-requirements-explained-contingency-planning-data-backups-and-disaster-recovery
14. HIPAA Compliant Data Center: What Healthcare Organizations Should Look For, HIPAA Vault. Data center certification standards. https://www.hipaavault.com/resources/hipaa-compliant-data-center/
15. What is HIPAA Compliant Colocation?, Datacate, Inc. Colocation services and HIPAA compliance context. https://www.datacate.net/colocation/
16. HIPAA Compliance in the Data Center: Meeting Regulatory Standards, Datacate, Inc. Shared responsibility and compliance pitfalls. https://www.datacate.net/compliance-in-the-data-center-meeting-regulatory-standards/