Smart Benefits: Audit or No Audit, Stay HIPAA Compliant

Rob Calise, GoLocalProv Business/Health Expert

Smart Benefits: Audit or No Audit, Stay HIPAA Compliant

If you didn’t receive notice of a desk audit last year under the Phase 2 HIPAA audit program, that doesn’t necessarily mean you’ll be spared. That’s because covered entities and their business associates may still be selected for an onsite audit in 2017 as part of a third round of the Phase 2 audits. 

While the chance of being audited is slim, the ongoing audits serve as a reminder for all organizations to review their HIPAA compliance procedures. A good place to start is to review the audit protocol released last spring by HHS’ Office of Civil Rights (“OCR”). 

In addition, the following entity desk audit guidance on select protocol elements can serve as a guide for your review:

GET THE LATEST BREAKING NEWS HERE -- SIGN UP FOR GOLOCAL FREE DAILY EBLAST

Timeliness of Breach Notification. Upload documentation of five breach incidents for the previous calendar year affecting fewer than 500 individuals, documenting the date individuals were notified, the date the covered entity discovered the breach, and the reason, if any, for a delay in notification.

 

Content of Breach Notification.

  • If the entity uses a standard template or form letter, upload the document.
  • Upload documentation of five breach incidents affecting 500 or more individuals for the previous calendar year.
  • Upload a copy of a single written notice sent to affected individuals for each breach incident.

 

Content of Notice of Privacy Practices.

  • Upload a copy of all notices posted on website and within the facility, as well as the notice distributed to individuals, in place as of the end of the previous calendar year.

 

Provision of Notice of Privacy Practices.

  • Upload the URL for the entity web site and the URL for the posting of the entity notice, if any.
  • If the entity provides electronic notice, upload policies and procedures regarding provision of the notice electronically.
  • Upload documentation of an agreement with the individual to receive the notice via e-mail or other electronic form.

 

Right to Access PHI.

  • Upload policies and procedures for individuals to request and obtain access to protected health information.
  • Upload all documentation related to the first five access requests which were granted, and evidence of fulfillment, in the previous calendar year.
  • Upload all documentation related to the last five access requests for which the entity extended the time for response to the request.
  • Upload any standard template or form letter required by or used by the CE to document access requests.

 

Security Risk Analysis.

  • Upload policies and procedures regarding the entity’s risk analysis process.
  • Consistent with 164.316(b)(2)(ii)-(iii) [relating to availability and updating of security policies and procedures], upload documentation from the previous calendar year demonstrating that documentation related to the implementation of this implementation specification is available to persons responsible for implementing this implementation specification and that such documentation is periodically reviewed and, if needed, updated.
  • Consistent with 164.316(b)(2)(i) [relating to retention of security policies and procedures], upload documentation demonstrating that policies and procedures related to the implementation of this implementation specification were in place and in force six (6) years prior to the date of receipt of notification.
  • Upload documentation of the current risk analysis and the most recently conducted prior risk analysis.
  • Upload documentation of current risk analysis results.

 

Security Risk Management Process.

  • Upload policies and procedures related to the risk management process.
  • Consistent with 164.316(b)(2)(i) [relating to retention of security policies and procedures], upload documentation demonstrating that policies and procedures related to the implementation of this implementation specification were in place and in force six (6) years prior to the date of receipt of notification.
  • Consistent with 164.316(b)(2)(ii)-(iii) [relating to availability and updating of security policies and procedures], upload documentation from the previous calendar year demonstrating that documentation related to the implementation of this implementation specification is available to the persons responsible for implementing this implementation specification and that such documentation is periodically reviewed and, if needed, updated.
  • Upload documentation demonstrating the security measures implemented to reduce risks as a result of the current risk analysis or risk assessment.
  • Upload documentation demonstrating the efforts used to manage risks from the previous calendar year.
  • Upload documentation demonstrating that current and ongoing risks are reviewed and updated.

 

Once you review the information from OCR, perform a self-assessment of your compliance efforts. Be sure to review your existing policies and protocols, organize HIPAA-related documentation, review staff HIPAA training documentation, and, if you’re a covered entity, update your Business Associate agreements or, as a Business Associate, ensure your protocols are compliant with HIPAA standards.

 

Rob Calise is the Managing Director, Employee Benefits. of Cornerstone|Gencorp, where he helps clients control the costs of employee benefits by focusing on consumer driven strategies and on how to best utilize the tax savings tools the government provides. Rob serves as Chairman of the Board of United Benefit Advisors, and is a board member of the Blue Cross & Blue Shield of RI Broker Advisory Board, United HealthCare of New England Broker Advisory Board and Rhode Island Business Healthcare Advisors Council. He is also a member of the National Association of Health Underwriters (NAHU), American Health Insurance Association (AHIA) and the Employers Council on Flexible Compensation (ECFC), as well as various human resource associations. Rob is a graduate of Bryant University with a BS in Finance.

Rhode Island’s 50 Wealthiest and Most Influential - 2015 Edition

Enjoy this post? Share it with others.