Anesthesia Coding Alert

There’s not a set form for you to follow.

You know that assessing your practice’s compliance risk on a regular basis is a good idea. But did you know that there aren’t guidelines for a particular form or template to follow? It’s true: Although it might seem like the HHS Office for Civil Rights (OCR) has a template for everything, they do not have a set formula or outline for risk analysis documentation.

Here’s why: Your risk analysis process may look entirely different from another provider’s approach, but you’ll probably have some similarities if you plan on including all of the HIPAA Security Rule requirements in your protocols. Plus, if you want to stay in the OCR’s good graces, you’ll need to thoroughly document your risks — and how you plan to manage them.

“It’s very difficult to have a standardized, one-size-fits-all kind of approach,” says HIPAA expert Jim Sheldon-Dean, founder and director of compliance services at Lewis Creek Systems LLC in Charlotte, Vermont. “Every organization is different and has a different way of approaching [its] risk analysis.”

You must have procedures for reporting, processing, and responding to suspected or known information security risks and incidents, Sheldon-Dean stresses. These procedures are essential for investigating, mitigating,