HIPAA Audit: OCR Is On The Move
Irrespective of the industry, the digital era demands protection of employee privacy and particularly the healthcare information as a vital obligation on the part of every employer. While the governments have designed HIPAA and HITECH laws to effectively manage this information, remaining compliant to these regulations is a daunting challenge in the world of cyber criminals.
The past year had seen enterprises and individuals from various industries falling prey to data breaches and HIPAA compliance failures more so from the healthcare industry. The office for Civil Rights (OCR) has therefore taken stern steps to ensure privacy and security of data across enterprises in 2015. Since the OCR wants to ensure that enterprises, medical practitioners, their business associates and covered entities take proactive steps to ensure compliance to Health Insurance Portability and Accountability Act, they intend to use HIPAA audit Program randomly across enterprises to check for compliance levels. With HIPAA audits in the horizon, enterprises need to institute smart practices and be audit ready.
The increase in HIPAA audits is a part of a stimulus and any complaint of security breach that involves more than 500 people are sure to trigger an audit. So even employers across other industries also need to take proactive steps to be compliant to these regulations, without which they are also liable to hefty fines.
Understanding some of the common pitfalls will help enterprises to avoid the same during HIPAA audits of 2015. These mistakes include:
- Non-compliance with the Security Rule by not updating and encrypting documents and overlooking associate agreements.
- Failures to implement security risk assessment and compliance programs that help employees understand the need for security of PHIs which include vital information and payment card data.
- Non-establishment of security programs that will ensure proactive monitoring of security and performance indicators and failure to continuously train and retrain employees with critical access on documenting processes of the vital data and EHR
- Failure to update Privacy Practices
- Ignoring privacy laws that interact with HIPAA
With OCR using HIPAA audit program to randomly assess covered entities and their business associates for compliance with the HIPAA privacy, security and breach notification rules, they must have a proactive approach to audits. As a step towards this, enterprises need to ensure that their plan is documented and well communicated across the various entities across the organization.
With regulators favouring a risk-based approach, enterprises need to make use of Security and Compliance programs such as Aegify, that will help them evaluate the risks and vulnerabilities in their environments. While this will implement security controls that will address these issues it will also prepare their business to face OCR as and when it reaches them.
Related posts
Hi blogger !! I read your content everyday and i must say you have high quality
articles here. Your blog deserves to go viral. You need initial boost only.
How to go viral fast? Search for; forbesden’s tools
How do you comply with the Health insurance Portability and Accountability Act ( HIPAA )? This article covers the four basic elements of the regulations.