The U.S. Department of Health & Human Services (HHS) announced its preparation to move into its next phase of audits of healthcare covered entities and their business associates. According to HHS, “[t]he 2016 Phase 2 HIPAA Audit Program will review the policies and procedures adopted and employed by covered entities and their business associates to meet selected standards and implementation specifications of the Privacy, Security, and Breach Notification Rules.” Physicians, medical practices, other providers and healthcare businesses, and their business associates, should take steps to ensure they are current and compliant with respect to HIPAA requirements.
Federal Investigation/ Medical Audit Lawyers
HHS is charged by federal law with the responsibility to enhance and protect the health and well-being of all Americans. To that end, HHS, through its Office of Civil Rights (OCR), endeavors to ensure high quality health and human services and promote advances in medicine and public health. Federal law known as the Health Information Technology for Economic and Clinical Health Act (HITECH) requires HHS to conduct periodic audits of healthcare providers and their business associates to ascertain compliance (or lack thereof) with the HIPAA Privacy Rule, the HIPAA Security Rule, and the HIPAA Breach Notification Rule. The HIPAA Privacy, Security and Breach Notification Rules, though very important to our government’s efforts to protect protected health information (PHI), are additional burdens for those in the business of providing healthcare and their business partners who might have access to PHI.
A few years ago, OCR used a “pilot” audit program to assess a sampling of covered entities’ progress in implementing HIPAA’s requirements for protecting PHI. Now, utilizing the information obtained by its pilot audit program, OCR will begin auditing both healthcare providers and their business associates. Beginning this year, OCR will review and analyze policies and procedures adopted by covered entities and business associates against the requirements of the HIPAA Privacy, Security and Breach Notification Rules.