A New Phase of HIPAA Audits is Coming in 2016 for Both Covered Entities and Business Associates
By: Drew Krieger, Esq.Earlier this year, the Office of Inspector General (OIG) strongly urged the Office for Civil Rights (OCR) to enforce “covered entities’ compliance with the HIPAA privacy standards, and recommended that OCR (1) fully implement a permanent audit program; (2) maintain complete documentation of corrective action; (3) develop an efficient method in its case-tracking system to search for and track covered entities; (4) develop a policy requiring OCR staff to check whether covered entities have been previously investigated; and (5) continue to expand outreach and education efforts to covered entities.”
OCR not only received these recommendations, it agreed with all five and even offered its plan to help address them in a letter to Inspector General Daniel R. Levinson dated September 23, 2015.
One of OIG’s primary concerns is that OCR is not doing enough to “proactively identify possible noncompliance from covered entities.” The system that is in place now is one of reactionary compliance auditing, and OIG wants that to change. In the coming months, OCR plans to make that change. OCR does agree that it has not fully implemented the audit requirements under the HITECH Act established February of 2010.
Starting in 2016, the OCR will launch Phase 2 of its audit program that will include both desk reviews of policies as well as on-site reviews. The target areas of these audits, according to OCR, will be the “common areas of noncompliance”, and the audits will include HIPAA business associates. To accomplish this, OCR will update its electronic document management system and build capacity to support an “internal audit program.”
In response to OIG’s recommendation regarding documentation, OCR will make efforts to ensure that “all investigators working on cases involving the HIPAA Rules understand the appropriate procedures for maintaining documentation of corrective action.”
Additionally, as of September of this year, OCR states that its case-tracking system has been upgraded. This enables OCR staff to track the history of compliance for a covered entity. This is
in response to OIG’s recommendation that OCR develop a more efficient case-tracking system. Also, OCR will implement a new standard policy and process to check for prior investigations of covered entities or business associates when a new investigation commences.
In light of OIG’s report and OCR’s response, changes are coming for HIPAA compliance in 2016. What does it all mean? Perhaps most importantly, it means that OCR will begin the implementation of the Phase 2 audit system that proactively identifies HIPAA compliance issues for covered entities and business associates. On-site audits may become more common as a result. It is important for any entity that operates in the health care industry as either a covered entity or business associate to reevaluate its HIPAA compliance processes for 2016, as these changes are coming in the following months.
Sources:
Suzanne Murrin, Office of Inspector General, OCR Should Strengthen Its Oversight of Covered Entities’ Compliance with the HIPAA Privacy Standards, available at http://oig.hhs.gov/oei/reports/oei-09-10-00510.pdf (September 2015).
Jocelyn Samuels, Office for Civil Rights, Response Letter to Office of Inspector General (Sept. 23, 2015).
