Since 2016, the Office for Civil Rights (OCR) in the Department of Health and Human Services (HHS) has been conducting Phase 2 of the HIPAA Audit Program. Through the use of desk audits, HHS has randomly requested documentation and evidence from organizations required to be HIPAA compliant. HHS OCR is conducting the desk audits to assess the overall compliance of both Covered Entities and Business Associates. OCR plans to share any results gathered through the audit process, and issue guidance targeted to identified compliance challenges.
The desk audits can be requested in two forms:
- Risk Analysis (or Risk Assessment) and Risk Management provisions of the Security Rule, or;
- Access and notice provisions of the Privacy Rule and the applicable content and timeliness provisions of the Breach Notification Rule.
This week, we’re taking a look at what one Covered Entity provided HHS that was selected for a desk audit. What did they lack that kept them from meeting HIPAA compliance? How would your HIPAA audit go? The answer might surprise you.
An OCR Desk Audit
In 2017, a healthcare organization with fewer than 20 employees, was informed by OCR of its selection for audit. The medical practice had 10 working days to reply. The audit focused on the Risk Analysis and Risk Management provisions of the Security Rule. This organization provided OCR with the following documentation that outlined their compliance efforts relating to Risk and Risk Management:
- Policies and Procedures addressing the Privacy and Security Rules
- Over 50 other HIPAA compliance policies
- HIPAA Risk Assessment administered in 2016
- Corrective action plan created in 2016
- Security management process policy
It’s clear from the feedback this organization received, their evidence for compliance wasn’t enough. Although they provided OCR with over 50 policies, manuals, and assessment, the actual content in them was incomplete, inadequate, and/or lacking altogether. After reviewing the materials, OCR provided the organization results of their audit in the form of a report.
The feedback was provided in two forms:
- Auditor Ratings: a relative level of entity compliance efforts for each audited element on a scale of 1 through 5.
- Auditor Analysis and Findings: specific analysis and findings based on documentation provided.
Auditor Ratings
The feedback this organization received was far from ideal. The auditor assessed entity efforts to comply with the selected elements using the following guidelines. Their score of 3 (highlighted below) out of 5 suggests room for improvement, saying that they “made attempts to comply, but the implementation is inadequate, or some efforts indicate a misunderstanding of requirements.”
The next section of the audit report includes the auditor’s specific analysis and findings from the Risk Analysis and Risk Management documentation.
Auditor Analysis & Findings
Risk Analysis
OCR notes that they failed to address management’s involvement in the Risk Analysis process. They also indicate that the document failed to address the Risk Analysis scope.
Further, OCR stated that the healthcare organization could not prove that their Risk Management policies and procedures were in place and enforced for six years. Covered Entities must retain copies of their policies and procedures for six years.
The organization provided one Risk Assessment administered in 2016. OCR stated that the Risk Assessment:
- Did not define the scope of the systems to include all the entity’s systems that create, transmit, or maintain ePHI.
- Did not provide an analysis of currently implemented security measures.
- Did not provide adequate evidence that it has conducted accurate and thorough assessments of the potential risks and vulnerabilities to PHI.
- Did not demonstrate that the results were made available to those individuals with Risk Analysis responsibilities.
Risk Management
OCR was not impressed with this organization’s Risk Management process. They provided Policies and Procedures manual and a Security Management Process Policy. OCR explained that the Risk Management documentation:
- Did not provide policies and procedures that demonstrate it has a Risk Management process sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.
- Did not identify what is considered an acceptable level of risk based on management approval.
- Does not specifically address the workforce members’ roles in the Risk Management process.
- Did not provide evidence that its policies were in place and enforced six years ago.
The findings of this OCR Desk Audit suggest that they did not provide a complete Risk Analysis or a Risk Management plan, nor were they able to prove their HIPAA documentation has been held for at least six years. Now with the help from OCR, they will receive a Final Report with corrective actions to implement for their HIPAA compliance plan.
Could your Organization Pass a HIPAA Desk Audit?
This organization did provide the HIPAA-related documents that OCR requested, but the documentation did not prove that they had safeguards to adequately protect PHI. The end of OCR’s presented the following summary after reviewing this practice’s documentation:
“Failure to fully implement security measures that reduce risks and vulnerabilities to a reasonable and appropriate level could leave electronic protected health information susceptible to unauthorized use and/or disclosure.”
The Proof’s in the Pudding
What’s the takeaway from this organization’s HIPAA desk audit? You can’t have generic HIPAA Risk Assessment documents, or bare bones Policies and Procedures template, and expect to have a HIPAA compliant representation of how your business and HIPAA work together. Your Risk Assessment and Risk Management Plan should be well thought out and thorough, as should all of your HIPAA documentation.
And just because the OCR Desk Audits are coming to an end doesn’t mean this is over. In 2017 and 2018, OCR will be conducting on-site audits of Covered Entities and Business Associates. The on-site audits are going to be broader than the desk audits. They will review compliance activities related to a comprehensive set of requirements of the Privacy, Security, and Breach Notification Rules, including additional analysis.
HHS OCR Director Roger Servino says his top enforcement priority for the coming year is to find a “big, juicy, egregious” breach case to use as an example from which others can learn. With the proper authorities on the lookout for violations, any Covered Entity or Business Associate is up for grabs, Director Servino adding that “Just because you are small doesn’t mean we’re not looking and that you are safe if you are violating the law. You won’t be.”1
For more information on creating a HIPAA compliant Risk Assessment and Risk Management processes specifically, take a look at one of our recent blog articles, “The Ins and Outs of Risk Management”. Need assistance determining all of your HIPAA compliance needs? Total HIPAA offers HIPAA training and compliance materials customized to meet your industry-specific requirements. Call us today at 800.344.6381.
