OCR Audits to Begin in 2016

Obermayer Rebmann Maxwell & Hippel LLP
Contact

Beginning in 2016, the United States Department of Health and Human Services’ Office for Civil Rights (OCR) will conduct another round of audits to gauge compliance with privacy provisions in the Health Insurance Portability and Accountability Act (HIPAA). This announcement comes in the wake of criticism leveled against OCR for inconsistencies enforcing the HIPAA Rules.

In an executive summary entitled “OCR Should Strengthen its Oversight of Covered Entities’ Compliance with the HIPAA Privacy Standards,” the United States Department of Health and Human Services’ Office of the Inspector General (OIG) criticized OCR for its failure to implement the required audit program in order to proactively assess possible noncompliance from covered entities. In a second executive summary, “OCR Should Strengthen its Followup of Breaches of Patient Health Information Reported by Covered Entities,” OIG determined that OCR was failing to ensure covered entities who experienced large data breaches documented corrective action. The report found that OCR did not record small-breach information in its case tracking system. OIG recommended that OCR develop a policy to check whether covered entities had been previously investigated. OIG recommended that OCR continue to expand outreach and education efforts to covered entities.

OCR responded to the criticism by announcing its plans to move forward with the “second phase” of its audit program in a September 23, 2015 letter to the Inspector General. In the letter, OCR revealed that it will conduct audits on covered entities beginning in early 2016. The audits will determine whether these entities are properly disclosing suspected breaches of protected health information (PHI) and whether they are appropriately protecting the privacy and physical security of PHI. The audits will focus on common areas of noncompliance, including the failure of organizations to conduct security risk assessments to identify and mitigate risks to PHI. Risks to PHI include exposed servers, unencrypted laptops, unchanged default passwords, outdated security software, and inadequate training.

The audits, which were mandated by the Health Information Technology for Economic and Clinical Health Act (HITECH), will include both onsite visits and remote “desk reviews.” Inspectors will not only examine the current state of the audited entities, but what the entity has historically done to be compliant with the HIPAA Rules. The audits are designed to inform OCR on the areas in which to direct its enforcement and technical assistance. At present, OCR relies heavily on reports of privacy violations from the general public and self-reporting on data breaches.

In preparation for the audits, OCR will spend the coming months updating audit protocols, refining the pool of potential audit subjects, and implementing a screening tool to assess size, entity type, and other information about potential audit subjects. Although the size of the audit program is not yet clear, prior statements from OCR indicate that the audit program will likely include hundreds of entities.

As 2016 nears, covered entities and potential audit targets need to begin audit preparations. Organizations should conduct their own security risk assessments to evaluate the effectiveness of security controls used to protect PHI. Organizations should review HIPAA policy requirements and begin to compile records of previous audit reports and evaluations related to the implementation of the HIPAA security, privacy and breach notification standards. Audit targets should be prepared to provide this information to OCR for examination. Finally, organizations should develop an audit response plan that identifies the organization’s lead responder, provides a list of responsive documents, and prepares personnel to answer questions.

The Health Law Gurus™ will continue to monitor the implementation of OCR audits. Please check back with us for updates.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Obermayer Rebmann Maxwell & Hippel LLP | Attorney Advertising

Written by:

Obermayer Rebmann Maxwell & Hippel LLP
Contact
more
less

Obermayer Rebmann Maxwell & Hippel LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.