HIPAA Audits and Enforcement Updates

HIPAA audits and enforcement are now a significant reality, and settlements for violations are being announced for more violations regularly.  Now, with the increases in breach reporting and the HIPAA random audit program, enforcement of HIPAA is something that every HIPAA entity and business associate needs to be aware of and prepared for, by taking the proper steps in advance to have your compliance in order and the documentation to prove it.

Knowing what questions are likely to be asked and what documentation is necessary to show compliance are key to preparations for HIPAA compliance inquiries, and this session will explore a number of sets of questions and the issues they revealed, leading to enforcement action.

HIPAA violations can occur for a wide variety of reasons, and if HHS investigates, you may wind up on the receiving end of multi-million-dollar penalties, and corrective action plans that can easily cost ten times the cost of the settlement amount or more.  If you are not prepared to address issues that have been shown to be a problem in prior breaches and violations, HHS may use a heavy hand in making an example of you – even the head of the HHS Office for Civil Rights has said he’s looking for a “big, juicy settlement” – you don’t want to be that settlement!

Not only that, if you don’t address the issues that have been shown to be a problem for others in the past, you are leaving yourself open to having those same problems yourself, and have to report breaches or be subjected to an investigation when a patient complains.

Finally, the HIPAA Audit program is required by law and is not going away any time soon.  While HHS may still be absorbing the results of the last round, we now know what kind of questions and expectations may be involved in the final program, and being ready to survive a HIPAA Audit is essential.

The HIPAA Random Audit program is being refocused and redefined to make it more relevant to finding and correcting some of the most prevalent security and privacy compliance issues, based on the experience gained in the 2012 and 2016 audits and in the HIPAA Breach Notification process.

Areas Covered in the Session:

• HIPAA audit and enforcement programs
  – How they work
  – Areas that caused the most issues in prior audits and enforcement actions
  – What kind of issues and what kind of entities had the most problems
  – Where entities need to improve their compliance the most
  – Typical risk issues that lead to breaches of health information
  – How those issues may become a target for auditors in the next round
•  How to prepare for an HIPAA compliance audit
  – Knowing what questions are likely to be asked and have been asked at prior HIPAA compliance audits
  – USDHHS updated protocol for the HIPAA audits, so it is possible to know
  – Which entity may be subject to an audit or enforcement investigation
  – How to prevent issues that could lead to violations and fines
  – Questionnaires that have been used in past and may be used for a future review.
• Information and documentation
  – What information and documentation required in advance for an audit or enforcement review at any time
  – How to know if you may become the subject of an audit or enforcement action,
  – What you can do to help limit your exposure
  – How most enforcement actions come about and what can be done to prevent incidents that lead to enforcement activity.