Issue link: https://viewer.e-digitaledition.com/i/55875
Quick Tips to Get You Ready By Joy D. Kosiewicz T WENTY HIPAA AUDITS are in progress and 130 more will take place this year. Complaint- driven investigations are also on the rise. Are you ready? Who is being audited? Everyone is a target. The first 20 audits consist of 10 provider organizations, including 3 hospitals, 3 physician offices, 1 labora- tory, 1 dental office, 1 nursing/custodial facility, and 1 pharmacy; 8 health plans; and 2 claims clearinghouses. The audited entities range from small providers with less than $50 million in revenue or assets to large providers and payors with greater than $1 billion in revenue or assets. How? You will be notified in writing from the Office of Civil Rights if you are selected for an audit. The notice will ask you to provide documentation of your compliance efforts within 10 days. OCR will likely request copies of your risk assessment, privacy and security policies, training documents and records, breach notification policy, and security incident response plan. The OCR will then schedule an on-site visit that can last between 3-10 days. You will have 30-90 days notice of the on-site visit. The Audit Report. OCR will provide you with a draft report to which you have 10 days to respond. It is imperative that you carefully review and respond to this report. You can provide OCR with evidence of your compliance or, if you are not in compliance, your commitment to remedying any such non-compliance. OCR can initiate a formal compliance review if its audit uncovers a serious compliance issue. Corrective actions and penalties may be assessed based on the formal compliance review. Quick Tips To Get You Ready + Inform your personnel. Establish a routing procedure to ensure the notice gets to the appropriate person – you only have 10 days to respond! Prepare them for the on-site audit. + Make sure you have a copy of your most recent risk assessment. Your risk assessment should be updated at least annually. + Identify your privacy, security, and breach notification policies and make sure they are up to date. + Training records should be available to 44 | Cleveland-Akron-Canton MD NEWS n MDNEWS.COM n MARCH-APRIL 2012 evidence all personnel have received the proper training. + Check that your security incident logs and breach notification logs are being kept up to date. Your response plan should be readily accessible and consistently followed. Review your third party contracts to verify business associate contracts have been signed as applicable. Of Note. Private practices top the list of the most common type of covered entity required to take corrective action, followed by general hospitals, outpatient facilities, health plans, and pharmacies. The top issues that result in corrective action are impermissible uses and disclo- sures, lack of safeguards, lack of access, using/disclosing more than the minimum necessary, and patient complaints. On the Horizon. By February 17, 2012, HHS is to establish a method for award- ing a percentage of any civil monetary penalty or settlement collected to the patient harmed by the HIPAA violation. Joy Kosiewicz is an attorney in the Health Care Group at Brouse McDowell in Akron. ■ Are You Prepared for a HIPAA Audit?