Benefits Update - May 2012: HHS Begins HIPAA Privacy and Security Audits


[author: Callan Carter]

As you may recall, the HITECH Act required Health and Human Services (HHS), the federal agency in charge of administering HIPAA, to affirmatively conduct periodic audits to ensure that covered entities and business associates are complying with HIPAA's privacy and security rules. Before HITECH, HHS was mostly responding to complaints and not conducting random audits of HIPAA compliance.

HHS's Office for Civil Rights (OCR) has launched a pilot audit program and expects to complete 150 audits by the end of 2012. These audits will include requesting documentation as well as onsite visits and a final report noting compliance issues.

These HHS audits can lead to compliance reviews, resulting in monetary settlements or the imposition of civil money penalties. Covered entities and business associates, including employer-provided health plans and their service providers, should make sure their workforce training, policies and procedures, and security risk assessments are in place, easily accessible and up-to-date.

For more information contact the author at or (415)490-9000.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Fisher Phillips | Attorney Advertising

Written by:


Fisher Phillips on:

Popular Topics
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.