Home Health & Hospice Week

Do your HIPAA P&Ps reflect your practices from years long past?

Establishing HIPAA protocols isn't a one-time job. Make sure your privacy and security practices are up-to-date to account for new information management applications and systems or state laws, or you could come up short under audit, warns attorney Kenneth Rashbaum of Rashbaum Associates in New York.

"Privacy rules essentially demand that we remain vigilant, thus it forces us to always evolve, reach for a standard of excellence, and improve with time," says information security expert Ester Horowitz.

HIPAA Audits Announced

The HITECH Act requires the Department of Health and Human Services "to provide for periodic audits to ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and Breach Notification standards," HHS says in a release. To implement the mandate, the HHS Office for Civil Rights, which is in charge of HIPAA enforcement, "is piloting a program to perform up to 150 audits of covered entities to assess privacy and security compliance. Audits conducted during the pilot phase will begin November 2011 and conclude by December 2012."

The pilot audit program is a three-step process. The first step, which was initiated in July, developed the audit protocols. The initial audits began in November and tested the protocols. The OCR expects these results to modify how the remaining audits were going to be conducted, HHS says in the release.

"The last step will include conducting the full range of audits using revised protocol materials. All audits in this pilot will be completed by the end of December 2012," according to the release at www.hhs.gov/ocr/privacy/hipaa/enforcement/audit/index.html.

Technically all covered entities and their business associates are eligible for an audit. The "OCR will audit as wide a range of types and sizes of covered entities as possible; covered individual and organizational providers of health services, health plans of all sizes and functions, and health care clearinghouses may all be considered for an audit," the HHS website clarifies. "Business associates will be included in future audits."

Fair game: "The new program is a random program, and the selection is not dependent on any prior behavior, violations, breaches or any other factor, so there is no way to take action to prevent being audited under this program," says Jim Sheldon-Dean of Lewis Creek Systems in Charlotte, Vt.

More HIPAA audits: There are also audits being performed as a result of complaints or breach reports, outside of this new program, resulting in violations and settlements for fines.

What You Can Expect

The OCR will notify you in writing if you are going to be audited and who your audit contractor will be. The audit process will be outlined and requests for relevant documents and other information will be made at this stage to ensure you are prepared for the audit. How and when you should return the requested information to the contractor will be specified at this stage.

Keep in mind: You will have to return this information within 10 business days of receiving the notice. Also, "OCR expects to notify selected covered entities between 30 and 90 days prior to the anticipated onsite visit," according to the HHS website. "In this pilot phase, every audit will include a site visit and result in an audit report. During site visits, auditors will interview key personnel and observe processes and operations to help determine compliance."

Note: For pointers on preparing for HIPAA audits, see a future issue of Eli's Home Care Week