Health Information Compliance Alert

URAC's security rule compliance accreditation program is up and running, but some say that accreditation programs may be running out of steam.

URAC May 6 announced final approval of its "HIPAA Security Accreditation program for Covered Entities and Business Associates" and says 10 companies are currently seeking accreditation in the program. The accreditation organization says the program focuses on the fundamentals of ongoing risk management, and that the program "enables health care organizations to validate their security compliance program and demonstrate to their customers and business partners that they have taken the necessary steps to safeguard Protected Health Information (PHI) in accordance with the HIPAA Security Rule."

URAC president and CEO Garry Carneal said the commitment by these 10 companies to achieve security rule compliance and accreditation sets an excellent example for other covered entities and business associates, but the true value of accreditation has never firmly been set, and many covered entities are wondering where the merits of accreditation lie.

To put it perhaps more bluntly, are accreditation programs simply money-making schemes? "It's hard to tell," offers Kristen Rosati, an attorney in the Phoenix office of Coppersmith Gordon Schermer Owens & Nelson. But she says it's important to note that accreditation is not required by the HIPAA regulations. That being said, though, Rosati does see the benefits offered by programs such as URAC and the Joint Commission on Accreditation of Healthcare Organizations: "Even though it's not required by HHS, it may be beneficial for some other organizations that don't have the in-house expertise to determine whether they're complying or not."

Others argue that since HHS doesn't require accreditation, going through the program isn't very appealing. Russell Opland, chief privacy officer/HIPAA coordinator for the University of Pennsylvania Health System in Philadelphia, asks, since it's not required, "who are you going to sell that to?" That is, will accreditation from JCAHO or URAC be valuable to your patients? "Is that going to be a significant factor in a patient choosing to go to a different place for care?" inquires Opland. He feels that when people are looking at places for important health care decisions, "those sorts of [programs] really fall by the wayside when it comes to them selecting the place that they'll go to receive treatment, so I don't see that as being a big factor at this point."

Rosati reminds you that there are many ways to find out whether you're compliant: You can go through accreditation or you can hire a consultant to come in and evaluate the program, as two examples. As far as which option is best for you, you'll have to decide that for yourself. "[Accreditation] definitely is not required, but it may be useful for someone without adequate in-house expertise to determine whether they're complying. That's maybe a balanced way to put it."