Has the Office of Civil Rights selected your company for a HIPAA audit? Instead of worrying about the implications, get ready to put your best foot forward. The guide will help you get a better understanding of proper HIPAA compliance for your business.
HIPAA compliance audit
What is it? It is an audit of companies that handle protected health information. Through this audit, the US Health and Human Services (HHS) Office for Civil Rights (OCR) assesses how these organizations and their associates protect the sensitive personal information of patients. There are five main rules that your organization must comply with or face hefty fines.
Privacy rule: This rule prevents the unauthorized use of patient health information and medical records. The patient has the right to edit this data and must provide consent for its use.
Security rule: This provides the framework for ensuring data safety for the storage and transfer of patient health information.
Transaction rule: It addresses the standardized codes used to maintain the security of medical records.
Identifiers rule: It ensures the appropriate use of a unique identifier for each covered entity during transactions.
Enforcement rule: This rule ensures that penalties are in place for breaches of protocol.
Why are you facing a HIPAA compliance audit?
HHS OCR has randomly selected your organization for HIPAA audit or someone has registered a complaint against you. HHS OCR may also be suspecting a breach in your organization. Whatever the reason, you cannot avoid it now.
HIPAA violations leading to HIPAA audit
While any number of violations lead to HIPAA Audit, here are some common ones:
Disclosure and unauthorized access to PHI: Any access to PHI that is not authorized by the patient can lead to a HIPAA audit. The HHS can also audit you for disclosing PHI without prior permission.
Lack of security measures: The lack of suitable security measures leading to insecure PHI can also lead to HIPAA audit.
Lack of patient authorization: Lack of patient authorization for PHI use in writing or lack of specificity in the permission form can lead to the audit.
Improper disposal of PHI: Patient records must be stored for six years and then destroyed. Failure to comply can lead to an audit.
Failure to notify patients of a breach: In case of a breach of security of the PHI, the concerned patient or patients must be notified. Failure to do so can lead to an audit.
How to prepare yourself for a HIPAA compliance audit
You must be ready for a HIPAA audit before the OCR tells you to get ready for it. Here’s the roadmap.
HIPAA security and privacy officer
You must appoint a HIPAA Security and Privacy Officer. They will develop and oversee privacy policies for PHI. After implementation, if these procedures are inadequate then they will update the procedures. They will also develop and conduct training for employees regarding HIPAA compliance. Finally, they investigate potential breaches of guidelines and provide solutions. This officer will be the point of contact for the HSS OCR in case of a HIPAA audit.
Conducting HIPAA guidelines training for employees
You must conduct comprehensive training to ensure your employees understand the latest guidelines of HIPAA. They should understand its significance and the importance of PHI security. They should understand the procedures involved and the penalties for breaches.
Risk management plan and risk analysis
Your organization should track where the PHI is generated, stored, and transmitted. You should then look for security risks at these points, including the potential for security breach and the potential impact in case of a breach. The organization should do a gap analysis, vulnerability scans, and penetration tests and document the results exhaustively.
Review of policies and procedures
HIPAA guidelines are updated and potential security risks evolve. So your approach cannot be static. Instead, you must review and update your policies and procedures regularly to stay HIPAA-compliant.
Internal audit
Periodic internal audits are a must for identifying instances of non-compliance and addressing them before you face an actual HIPAA audit.
Cost of HIPAA Compliance audit
HIPAA audits are not chargeable for the organization. But non-compliance can lead to steep fines. So it is a good idea to have internal audits which can be fairly costly and last for over a month.
Summing up
As you can see, there’s a lot to take in regarding HIPAA compliance. Hopefully, the information in this guide can provide you with a better understanding of what’s required to tackle any issues head-on.
