Audits

August 14, 2020 Let’s be real – there’s probably a few things in life we all have an“Oh, it won’t happen to me” mentality about. For many medical professionals, that may be exactly how you feel about HIPAA audits – yet HIPAA investigations are becoming more common than you might think.  While the odds of facing a totally random HIPAA audit might not be high, they increase significantly when you factor in additional investigation triggers like data breaches, cyber attacks, and patient complaints- none of which a medical practice is immune to. Proactively preparing for anything that might be thrown your way is imperative for your practice to have the ability to handle a HIPAA audit without the consequence of a hefty violation. Here are the top 6 things you should have in place BEFORE a breach, complaint or audit investigation occurs: 1. Security Risk Analysis The first thing the OCR looks for upon investigation is a properly documented and up to date Security Risk Analysis (SRA). This shows that you’ve assessed your practice operations and identified any vulnerabilities – BEFORE an audit occurs. While it’s the first step of HIPAA compliance, only 17% of practices audited by the OCR met this requirement. 2. Practice-Specific Policies & Procedures Proper documentation is key for all aspects of your compliance program including your practice specific HIPAA policies and procedures. These policies and procedures serve as the guidelines for how protected health information (PHI) should be handled within your practice and the proper documentation is necessary to prove the expectations and standards you have set for your organization.  3. Disaster Recovery Plan Disasters happen, most of the time without warning. Having a disaster recovery plan in place is important to ensuring continuity of patient care and continued access to important medical records. As the saying goes, if you fail to plan, you plan to fail. 4. Implement Proper Administrative, Technical and Physical Safeguards Securing all forms of PHI with the necessary safeguards already implemented within your practice is essential to successfully meeting HIPAA requirements – and ultimately protecting your patients. 5. Staff HIPAA Training Properly train your workforce on all HIPAA privacy and security policies and procedures. This training should be ongoing to ensure that staff is staying up to date with any changes to HIPAA regulations or practice operations. 6. Business Associate Agreements It’s important to be on the same page with everyone that has access to your patient’s secure information. Implementing the proper business associate agreements (BAAs) with all third party vendors that could potentially access PHI ensures patient data is secure while also offsetting liability to business associates should they be the cause of a data breach. There’s a lot that goes into your HIPAA program, even more than the top 6 items listed here, which is why it’s all the more important to have a true culture of compliance in place and a complete HIPAA program to prevent and minimize threats to your patient’s data.

February 21, 2020 When you think of the most wonderful time of the year – tax season probably isn’t the first thing that comes to mind. But even though the filing process can be a bit daunting, it’s the lesser of two evils when compared to the IRS audit that could result from not submitting anything at all. So while you file your taxes this time every year in hopes of not having to face the IRS this tax season – what are you doing to prepare for a HIPAA audit? As long as you do everything right, the changes of the government showing up on your doorstep are pretty slim. In fact, considering only about 0.5% of all tax returns filed are actually audited – you have a 6% better chance of becoming a millionaire than you do facing the IRS. But despite the unlikely odds, we’re all still focused on staying off the government’s radar by filing each and every year. This better safe than sorry mentality should also apply to the precautions taken to avoid a HIPAA audit, but for many practices, it doesn’t hold the same weight. Over the past few years, the Office for Civil Rights has investigated more HIPAA complaints and ran more random practice audits than ever before, bringing the total amount of HIPAA fines to over $19 million – just between 2020-2021 alone. So why have we seen such a major increase lately? With technology use in healthcare on the rise and changes in government standards and patient needs, it is easier for Protected Health Information (PHI) to be accessed by those with malicious intent and seemingly harder for practices to provide patients with their own PHI when requested. So just as we all go through the tax filing process – ensuring that you have a complete HIPAA program is pretty similar: So why don’t practices pay more attention to HIPAA, like they do their taxes? It all comes down to the lack of education on what HIPAA compliance really entails. The reality for many practices is that, because of misinformation or lack of education, the proper safeguards are never put in place and data breaches are growing more and more common. The worst part? A HIPAA fine could cost your practice, and has cost many others, millions of dollars in addition to time-consuming administrative burdens. And on top of that, unlike late payment fees or penalties on taxes, once a breach occurs under HIPAA there is no going back – and no way to reduce the government’s levied fines. Our takeaway? You shouldn’t just be preparing for tax season – HIPAA audit season has proven to be a year-round occurrence that deserves just as much of a priority as filing taxes does.