Home Health & Hospice Week

Hundreds of providers will receive HIPAA scrutiny this year.

You’ve been hearing for years that HIPAA audits are around the bend, but with the HHS Office for Civil Rights repeatedly delaying them, many providers were beginning to wonder if the privacy audits were simply an urban myth. An OCR announcement in March, however, confirmed that phase two audits are very real — and have been in motion for a while.

What is phase two? During phase one of the HIPAA audits, the OCR implemented a pilot program to essentially establish the audit protocol. Now that phase two has started, OCR has pledged to audit not only covered entities, but also their business associates. Although most of the audits will be “desk audits,” some will be on-site audits, the OCR said in its announcement.

Fortunately, providers familiar with the phase one audits won’t find the phase two process that much different, says attorney Neil Eggeson of Eggeson Appellate Services in Indianapolis. “The phase one audits involved a three-step process: After creating the audit protocols (step one), OCR conducted an initial wave of 20 audits to test the protocols (step two). After revising the protocols, OCR conducted the rest of its audits,” he says. The total number of audits involved during phase one included only 115 covered entities.

“The phase two audit protocol is essentially a further revision of the phase one protocol streamlined to focus on specific areas,” Eggeson says. Due to that fact, OCR does not foresee revising the audit protocols further. “The first round of desk audits will focus on covered entities, the second round of desk audits will focus on business associates, and the third round of on-site audits will be drawn from those entities audited during the first two rounds. As all desk audits are expected to be completed by December 2016, it would seem that phase two is going to be limited to roughly 200 entities total (including health plans and clearinghouses).”

Don’t Stress About BAs

Some providers are concerned that if their business associates fail an audit, the BA will drag the provider down with it. Fortunately, however, that doesn’t appear to be a big risk.

“Strictly speaking, under HITECH a covered entity is not responsible for its business associ- ate’s compliance,” Eggeson says. “Thus, if a business associate fails a Phase two audit, it should not affect the covered entity’s own audit performance.”

If, however, you know about a BA’s privacy issues prior to an audit, then you do bear some responsibility to address it, Eggeson says. Thus providers “are well within their rights to demand broader assurances from their business associates — including a periodic review/audit of their business associates’ compliance.”

Assuming you are already familiar with your business associates’ privacy practices and you believe that they are in compliance with HIPAA, then you shouldn’t have to “pre-audit” them to make sure they are on the straight and narrow.

Note: More about Phase two of the HIPAA audits is at www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html.