ADHICS TRBA Audit Guide: What to Expect

The Technical Review Board Audit (TRBA) is the DoH-approved audit of your ADHICS controls. Here is the full six-phase timeline — from scoping 90 days out to closing the findings 90 days after the report lands.

The six phases of a TRBA audit

T-90 days

Scope + schedule

✓DoH-approved audit firm engaged
✓Scope confirmed by facility, tier and in-scope sites
✓Lead contact and clinical operations lead designated
✓Evidence pack location shared (secure portal or inline review)

T-60 days

Document pre-review

✓Policy pack, SoA and risk register submitted
✓Vendor register and ADHICS-aligned contracts attached
✓Prior-year quarterly reports attached
✓Open findings from prior cycle attached with remediation status

T-14 days

Walkthrough + corrections

✓Auditor flags missing or stale documents
✓Facility closes documentation gaps
✓Mock interview with accountable owner / CISO (recommended)
✓Technical validation targets confirmed

Audit week

On-site audit

✓Site visits with physical security spot-checks
✓Interviews with accountable owner, IT lead, clinical ops lead
✓Technical validation of MFA, encryption, logging, backups
✓Daily close-out of observations with the facility

T+14 days

Findings report issued

✓90-day remediation window starts
✓Findings graded (major, minor, observation)
✓Facility response plan due within 15 days of report
✓Report filed with DoH alongside the quarterly submission

T+90 days

Remediation close-out

✓Evidence of remediation submitted to the auditor
✓Major findings re-validated by on-site or evidence review
✓Residual items rolled into the next quarterly report
✓DoH confirmation closes the audit cycle

What TRBA auditors examine

The auditor’s scope follows the ADHICS tier that applies to your facility, but the evidence pack is predictable. Have these ready in a secure portal before the audit kicks off.

Information security policy pack and approval record
Statement of Applicability — one per facility, aligned to the applicable ADHICS tier
Risk register with quarterly review evidence
Access-control review logs (quarterly cadence) and MFA enforcement proof
Encryption posture for ePHI at rest and in transit, plus key management records
Backup test records with restoration evidence
Centralised logging with retention aligned to ADHICS
Vendor register with ADHICS-aligned contracts and sub-processor flow-down
Incident response runbook with DoH notification path and incident register
Business continuity and disaster recovery plan with test records
Training completion records for all staff with ePHI access
Quarterly compliance report submissions for the prior 4 quarters
Malaffi connection controls — authentication, logging, access review

The 90-day findings window

After the audit, the firm issues a findings report graded into major, minor and observation. The clock starts on the report date.

Day 15: Your facility’s response plan is due to the auditor — owner, milestones, committed close date per finding.
Day 45: Mid-window review. Majors should have active remediation evidence attached.
Day 90: Remediation evidence submitted. Majors re-validated by the auditor. Residual items roll into the next quarterly report with DoH visibility.

Open findings past day 90 become a licensure risk. For complex findings that cannot close in 90 days, submit a documented remediation plan — not an informal note — before the window closes.

Common gaps that drive findings

Six patterns show up in nearly every TRBA report we see. Close these before the audit and your findings count drops materially.

No facility-specific SoA

A single corporate Statement of Applicability is not accepted. Each DoH-licensed facility needs its own, mapped to the tier that applies to that site.

Quarterly reports submitted late (or missing)

Missing a prior quarterly submission is treated as a major finding. Even a thin report filed on time beats a thorough one filed late.

HIMS vendor contracts without ADHICS clauses

Vendor contracts need explicit ADHICS references — security obligations, incident notification, sub-processor flow-down, right-to-audit.

MFA bypass accounts

Local admin and break-glass accounts without MFA are a recurring finding. Document the compensating control (hardware token, vaulted credentials) and rotation cadence.

Logging without retention

Logs exist but retention is too short, or retention is unverified. ADHICS expects documented retention aligned to the tier and the ability to produce historical records on request.

DR plan without a test record

A written DR plan is not enough. Auditors look for a dated test with restoration evidence and documented lessons captured.

How LowerPlane prepares you

Our ADHICS workspace tracks every finding against the 90-day clock, pulls remediation evidence from your connected systems, and keeps the TRBA evidence pack audit-ready between cycles. Your dedicated advisor runs mock interviews with the accountable owner (or CISO) and walks the response plan with you.

Pre-built evidence pack mapped to all 12 control families.
Finding tracker with 90-day timer per item, auto-rolled into the quarterly report if unresolved.
Mock-interview script tuned to the Basic / Transitional / Advanced tier that applies to you.
Malaffi connection control pack as a separate attestation bundle.

See the ADHICS platform page or the cost breakdown.

Frequently asked questions

Who conducts the TRBA audit?

The Technical Review Board Audit is performed by a DoH-approved audit firm. The firm is independent of your facility. The audit scope, scheduling and findings follow DoH-published guidance for the ADHICS tier that applies to your facility.

How often does a TRBA audit happen?

TRBA audits are tied to the DoH licensure cycle. Expect a full audit at licensure renewal and ad-hoc audits in response to reported incidents or control-effectiveness concerns. Advanced-tier facilities typically see additional interim reviews.

What is the 90-day findings window?

After the TRBA audit the auditor issues a findings report. Non-conformities must be remediated within 90 days of the report date, with evidence of remediation submitted back to the auditor and DoH. Open findings past 90 days can trigger a licensure review.

What if a finding cannot be closed in 90 days?

For complex findings, submit a documented remediation plan with milestones to the auditor before the 90-day window closes. DoH expects a credible plan with accountable owner, dependencies and a committed close date — not a reset of the window.

Can we use existing ISO 27001 or SOC 2 evidence?

Yes. TRBA auditors accept external attestations as supporting evidence for overlapping control families (governance, access control, cryptography, operations security, supplier relationships). You still need the ADHICS-specific overlays — DoH notification path, Malaffi connection controls, quarterly reporting workflow.

How long does the audit itself take?

Basic-tier audits typically run 2–3 days of auditor time including document review and site visits. Transitional-tier audits run 4–5 days. Advanced-tier audits run 1–2 weeks and include deeper interviews with the CISO, internal audit function and clinical operations lead.

The ADHICS TRBA Audit, End-to-End