By Jay Hodes, President – Colington Consulting
In February of this year, the U.S. Department of Health and Human Services (HHS) published an Agency Information Collection Request in the Federal Register. The request indicates the HHS Office for Civil Rights (OCR), the agency that enforces HIPAA compliance, is looking to initiate a HIPAA Audit Review Survey. OCR, according to the request, “is conducting a review of the 2016-2017 HIPAA Audits to determine its efficacy in assessing the HIPAA compliance efforts of covered entities.” The abstract states “information collection consists of 39 online survey questions that will be sent to 207 covered entities and business associates that participated in the 2016-2017 OCR HIPAA Audits. The survey will gather information relating to the effect of the audits on the audited entities and the entities’ opinions about the audit process.”
The good news, at least from the early indication in the request, is that these new audits will only affect organizations that participated in the prior audits. With a limited budget and lack of staffing, OCR will be hard pressed to go beyond what is indicated in the request. In the past, OCR contracted out parts of the audit program and it remains to be seen if that will also occur with this new round of audits. Publicly, OCR has not provided any information as to when the audits would begin.
When the audits do begin, OCR will use an online survey to:
- Measure the effect of the 2016-2017 HIPAA Audits on covered entities’ and business associates’ subsequent actions to comply with the HIPAA Rules.
- Provide entities with an opportunity to give feedback on the Audit and its features, such as the helpfulness of HHS’ guidance materials and communications, the utility of the online submission portal, whether the Audit helped improve entity compliance, and the entities’ responses to the Audit-report findings and recommendations.
- Provide OCR with information on the burden imposed on entities to collect audit-related documents and to respond to audit-related requests; and
- Seek feedback on the effect of the HIPAA Audit program on the entities’ day-to-day business operations.
- The information, opinions, and comments collected using the online survey will be used to improve future OCR HIPAA Audits.
The limited scope of these planned audits does not mean organizations that must comply with HIPAA regulations are off the hook because they were not included in the initial group. Organizations are still required to comply with all HIPAA regulatory compliance requirements, including a self-reporting breach notification to HHS OCR if any PHI or ePHI is compromised, regardless of how many individuals were affected. If the breach affects 500 individuals or more, the likelihood of an OCR investigation is probable.
Last week, OCR sent out through their listserv, a FAQ regarding updated clarification on Change Healthcare Cybersecurity Incident. As part of one of the FAQs, OCR provided a summary of breach notification requirements and reporting procedures for covered entities.
As an important reminder, if a breach of unsecured PHI or ePHI affects 500 or more individuals, a covered entity must notify the HHS OCR of the breach without unreasonable delay and in no case later than 60 calendar days from the discovery of the breach. The notification clock starts the day the breach is discovered.
OCR also indicated if the number of individuals affected by a breach is uncertain at the time of notification submission, the covered entity should provide an estimate, and, if it discovers additional information, submit updates in the manner specified below. If only one option is available in a particular submission category, the covered entity should pick the best option, and may provide additional details in the free text portion of the submission.
Organizations should use the planned HIPAA Audit Review Survey as a proactive exercise to determine compliance with all aspects of HIPAA, including breach notification requirements.
Colington Consulting | HIPAA Compliance, Risk Assessment & Management
Allow our team of regulatory experts to assess your organization’s compliance with the HIPAA Security and Privacy Rules, the risk assessment process, and breach notification requirements. We offer customized services to meet specific requirements for your organization, making HIPAA compliance strategies effective and efficient. For a free, initial consultation to see how we can assist your organization, give our office a call at 844.740.7100.
Helping Organizations Achieve HIPAA Compliance™