HIPAA Self-Assessment

The Privacy Officer doesn’t have to be a HIPAA expert, but needs to be a person in your company with strong organizational skills and someone who has the ability to sanction employees. Usually, this is a manager, officer, or owner of your company.

The Security Officer doesn’t have to be a HIPAA expert, but needs to be a person in your company with strong organizational skills and someone who has the ability to sanction employees. Usually, this is a manager, officer, or owner of your company. The same person can serve both the Privacy and Security Officer Roles.

A detailed Risk Assessment is required for HIPAA Compliance, and this is one of the first items you will be asked for in the event you are audited. This document helps you to identify any security deficiencies that exist in your company.

This includes HR staff, owners, IT staff, etc.

September 15, 2015 is when the HIPAA Omnibus Ruling went into affect for all Covered Entities, Business Associates and Business Associate Subcontractors. There have been significant updates to the law, and the fines and penalties have also been increased for non-compliance.

Annual training on your company’s HIPAA Privacy and Security Policies and Procedures is required for all employees that see or may come in contact with PHI as a part of their job requirement. This may include- HR managers and staff, IT manager and staff, owners, and line managers.

HIPAA requires that you have an Business Associate Agreement with any 3rd parties that store, transmit or backup your PHI.