Recently, the Health and Human Services Office for Civil Rights (HHS OCR) announced that it would be resuming the Health Insurance Portability and Accountability Act (HIPAA) Audit program established by the Health Information Technology for Economic and Clinical Health Act of 2009 (the “Act”). The audits will focus on the HIPAA security rule which establishes a national standard for protecting individuals’ electronic personal health information (ePHI). As such, the rule mandates that appropriate administrative, physical, and technical safeguards be in place to ensure the confidentiality, integrity, and security of ePHI.
The audits intended to gauge compliance with HIPAA, identify best practices, discover risks and vulnerabilities, and implement preventative measures to address potential breaches. The first round of audits took place in 2009, and a second round was completed between 2016 and 2017. According to the HHS OCR, the current round of audits will focus on the security rule due to growing concerns surrounding increased cybersecurity incidents and breaches caused by hacking, malware, and ransomware.
As a prerequisite to the newest round of audits, the HHS OCR has begun to issue “HIPAA Audit Participant Surveys” to those covered entities and business associates that participated in the 2016-2017 HIPAA audits. Covered entities include most health care providers, health plans, health care clearinghouses, and their business associates. The information collected from the surveys will, among other things, help measure the effectiveness of previous audits and help improve the audit program, overall.
In anticipation of the audits that will certainly follow, covered entities should consider conducting their own internal review of ePHI security policies to identify weaknesses and to address compliance gaps which might exist. To assist small to medium-sized health care practices with this process, the HHS OCR maintains a public database of privacy and security resources and tools including a security risk assessment tool.
(This blog, prepared by Campanella Law Office, is for general informational purposes only and is not intended to convey specific legal advice, nor is it intended to create or constitute an attorney-client relationship.)