Staying ahead of HIPAA compliance audits
February 14, 2012
Last November, the Department of Health and Human Services announced that it would be collaborating with specialists from KPMG Consulting to conduct up to 150 random Health Insurance Portability and Accountability Act data audits by the end of 2012. As the initiative enters full swing, health IT practitioners are anxiously preparing for a potential visit from regulators.
"In a time when fines from HIPAA noncompliance surpass the million dollar mark, covered organizations should take action now to evaluate HIPAA compliance and mitigate potential liability," Poyner Spruill attorneys Kelsey Mayo and Elizabeth Johnson explained in a recent bulletin.
According to the legal analysts, documentation should be the first priority for media management teams at audit-eligible organizations. This includes updating all policies relating to HIPAA privacy, breach notification and security standards - and having these materials "regulator-ready." If and when an organization is audited, they are only given 10 business days to respond with the appropriate documentation.
Additionally, all internal and external collaborators must be on the same page. Mayo and Johnson suggest that it may be wise to offer a "refresher" for employees that are uncertain of their HIPAA expertise so that they have a clear understanding of their roles and responsibilities. It is also crucial to assess the compliance of all business associates. HIPAA guidelines follow patient information throughout its journey between systems and organizations, and any weak links must be addressed.
Finally, offices preparing for a visit from regulators should be aware of the criteria and structure of data audits.
"[Audit procedure] will consist of interview with leadership and key personnel, an inspection of operations with respect to privacy and security and an assessment of compliance with HIPAA privacy and security regulations and the organization's HIPAA policies," Thompson Coburn partners noted in a related client advisory.
Although data audits can be intimidating, it is important to remember that regulators are motivated to provide constructive criticism, as opposed to harsh judgment. As such, establishing a cooperative and productive business relationship will be essential to improve operations in the future.
© 2010 B&L Associates.