Audits Heat Up HIPAA Liability


In November 2011, the Office for Civil Rights (OCR) began audits to assess compliance with the HIPAA Privacy, Breach Notice, and Security Rules. The OCR compliance audits will be conducted by KPMG LLP and generally will consist of an initial document request, an onsite visit by the auditors, and then negotiation of an audit report.  In a time when fines for HIPAA non-compliance surpass the million dollar mark, covered organizations should take action now to evaluate HIPAA compliance and mitigate potential liability:

- Documentation: Ensure, at minimum, that all the policies and procedures required by the HIPAA Privacy, Breach Notice, and Security Rules are finalized and regulator-ready.  If you are audited, you will have only 10 business days to respond to the initial documentation request.  Therefore, we recommend developing a comprehensive list of all relevant policies so they can be produced quickly.  Also begin noting what other documentation would support your compliance efforts (such as a log of disclosures) and how it can be produced for OCR inspection.

- Business Associates: If you have not identified all of your vendors that handle protected health information, do so now.  Negotiate business associate agreements with all such vendors.

- Risk Analysis: Covered entities must periodically conduct a comprehensive, formal risk analysis. OCR likely will request the results of that analysis during an audit.  If you have not conducted a risk analysis in the last 12 months, do so now.  Evaluate the results and determine how best to mitigate or manage each risk identified (an activity also required by the Security Rule).  Document the entire process.

- Evaluate Compliance: Covered entities must evaluate periodically the effectiveness of their HIPAA compliance programs, including compliance with recent changes due to the HITECH Act and applicable regulations.  If you have not done a formal evaluation of your program, such as conducting a trial run of your breach incident response plan, do so now.  Document the process, and adjust procedures in light of the results.

- Training:  If you have not consistently or recently trained employees, now is a good time for a refresher.  Maintain documentation evidencing that every relevant employee has been trained.

- Subject Matter Experts: OCR will expect you to know which individuals in your organization can speak to each aspect of HIPAA implementation.  You should make a list of these people now and ask them the kinds of questions OCR might pose.

- Timely Response:  Ensure that the appropriate people will receive any communications from OCR in a timely manner.  Deadlines for responding during an audit are very short—sometimes as short as 10 business days.  Do not let OCR communications sit in someone’s inbox while they are on vacation for a week, potentially cutting your response time in half.

Please see full article below for more information.

LOADING PDF: If there are any problems, click here to download the file.

Written by:


Poyner Spruill LLP on:

Readers' Choice 2017
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.