Health Information Compliance Alert

Do we account for audit logs?

Question: We have begun auditing our computer systems. Through an exam of the audit logs, we discovered that some patient files were inappropriately accessed. Do those logs need to be included in our patients' accounting of disclosures?

Washington subscriber

Answer: "No," says John Parmigiani, senior VP for Consulting Services at QuickCompliance in Avon, CT. However, the log should facilitate your HIPAA security rule-mandated incident reporting system, he says. "If you determine nothing's been exposed, you're under no reporting requirements," adds Fred Langston, a principal with VeriSign in Seattle, WA.

Remember: If there has been exposure, the breach must be handled in accordance with your facility's defined policies and procedures for incidents, he confirms.

The Bottom Line: "Auditing flows into the incident response," Parmigiani explains. When a potential breach is discovered, the incident response team then investigates it and makes the necessary contacts, Langston concurs.

Any breaches must be reported, experts agree. "The key function of the reporting requirement is to make sure people whose information has been or may have been compromised have the ability to react," Langston reminds.


Who Signs Whose?

Question: We have decided to use a clearinghouse for our transactions. The company we've chosen has submitted a business associate agreement (BAA) for us to sign. Do we, as a covered entity, need to sign this agreement, or should we submit a BAA to them?

Nebraska subscriber

Answer: "This is an enormous problem, and there is no right answer," explains Kirk Nahra, an attorney with Wiley Rein & Fielding in Washington, DC. However, "your obligation is to make sure the right things are in the contract," he adds.

This focus on content is important because the "business associate agreement binds both parties," says attorney Kevin Troutman of New Orleans-based Fisher & Phillips.

Therefore, both your organization and your business associate must "negotiate until you reach a point where you feel the agreement covers everything and is fair to both sides," Troutman suggests.

The Bottom Line: Most of your business associates will have the minimum necessary information in their contracts. Make sure that you, as the customer, hammer out an agreement catered to your facility, Troutman advises.

However, no matter who initiates the contract, "if it is complete and has what the company cares about, then it's fine to sign it," Nahra asserts.