HIPAA Compliance Auditory Checklist

When it comes to HIPAA audits, a process must be followed to make sure that your medical practice or business is ready to react to a request from the Office for Civil Rights (OCR) of the Department of Health and Human Services (HHS). Depending on the type of violation and the scope of OCR’s inquiry, HIPAA audit requirements might fluctuate widely.

You must first comprehend the HIPAA audit process and what to anticipate from HHS OCR in the case of a HIPAA audit before we can discuss HIPAA audit standards.

Is There a Chance of a HIPAA Audit?

There are two categories of entities that must comply with HIPAA legislation. Physicians, insurance companies, and health care clearinghouses are examples of covered entities (CE). Business associates (BA) are entities that have been recruited to handle PHI. Typical examples include IT service providers, storage providers, fax and shredding businesses, medical billing companies, practice management companies, and many more.

Therefore, you run the risk of HIPAA violations and investigations regardless of whether your company is a covered entity or a business associate. Since HIPAA enforcement applies to both CEs and BAs, most health care organizations must be familiar with its auditing procedures.

What Triggers a HIPAA Audit?

HIPAA violations that are reported by you, a staff member, a patient, or an internal whistleblower cause HHS OCR (US Department of Health and Human Services’ Officer for Civil Rights) audits to be initiated. A reported violation or potential violation will always be the starting point for a HIPAA inquiry.

OCR is in charge of and monitors HIPAA regulatory enforcement. When OCR receives a complaint, your organization can get a notice outlining the procedures OCR will follow and the beginning of a HIPAA audit.

What are HIPAA Covered entities?

This covers third-party service providers as well as software utilized by healthcare institutions like hospitals, clinics, health plans, and insurance companies.

Hospitals and other healthcare organizations are referred to as “Covered Entities,” and any individuals who have access to PHI are referred to as “Business Associates.”

Administrative requirements for an audit

Transaction Rules, Unique Health Identifiers, and Code Set Standards are only a few of the topics that are covered by the Administrative Requirements of HIPAA (Part 162). Both Covered Entities that handle billing and claims management internally and Business Associates that do so for Covered Entities are obliged to adhere to the requirements of this Part.

Operating rules, transaction rules, and documentation are the only three compliance areas that organizations typically need to include on an internal HIPAA audit checklist.
Check that the eligibility, claims status, and electronic funds transfer/remittance advice operating guidelines are being followed.
Using the Administrative Simplification Enforcement and Testing Tool (ASETT), verify transactions for compliance.
If policies, processes, or test results need to be documented for a compliance review, do so.

Although there haven’t been any civil monetary penalties for administrative requirements violations to date, CMS has the power to fine Covered Entities and Business Associates for noncompliance with Part 162 if an organization doesn’t pass a review and then doesn’t follow a corrective action plan. 51% of organizations received a corrective action plan after failing compliance reviews in the year leading up to April 2022.

Privacy Rule requirements for an audit

The Privacy Rule simply has two fundamental requirements: giving individuals control over their protected health information and protecting personally identifiable health information from unauthorized uses and disclosures. However, depending on the nature of their operations, organizations subject to the Privacy Rule may be required to adhere to up to fourteen sets of standards in order to meet these two requirements.

Why does it say “up to” 14? This is true even though the Privacy Rule must be followed by all Covered Entities, not all organizations are subject to all regulations. Additionally, depending on the service being rendered for or on behalf of a Covered Entity and/or the conditions of their Business Associate Agreement with a Covered Entity, some Business Associates may be required to adhere to specific Privacy Rule criteria.

Security Rule requirements for an audit

A Security Rule audit checklist is simple compared to the possible intricacy of a Privacy Rule audit checklist. The Security Rule not only has a much less number of standards than the Privacy Rule, but its standards are also less ambiguous. The Security requirements General Rules also permit “flexibility of approach” in how the requirements are applied to Covered Entities and Business Associates.

Additionally, a HIPAA Security Risk Assessment (SRA) Tool that organizations can use online or download as an Excel document has been created in collaboration by the Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights to help them meet the Security Rule’s risk assessment requirements.

Typical HIPAA Infractions That May Lead to HIPAA Audits

Generally, a PHI breach will result in a HIPAA audit. PHI breaches can result from a variety of causes, such as:

Ransomware attack
Malware attack
Laptops, smartphones, and tablets with access to PHI that have been lost or stolen
Paper PHI should not be disposed of in an inappropriate manner, such as by tossing patient documents in the trash rather than using a shredding service and lockable trash cans.
Office break-in

Other times, PHI can be improperly accessed by unauthorized individuals or improperly disclosed to unauthorized individuals, leading to HIPAA audits.

When it comes to unauthorized access, HIPAA infractions might involve:

Employees seeing patient records for purposes unrelated to their employment duties
Employees viewing PHI on a computer or other public device (such as one in a waiting area where other patients can see them openly)

Unauthorized disclosures that violate HIPAA laws include:

Giving a patient’s PHI to a relative without that patient’s express consent
Giving local media a patient’s PHI without their express consent
Using a patient’s PHI without their express consent for research

HIPAA Audit Guidelines

OCR will contact businesses using certified letters. You’ll probably also get an email from OCR at some point. Be aware that health care organizations have previously received reports of bogus HIPAA investigations. These bogus letters are a part of a campaign to dupe healthcare organizations into giving the perpetrators private information.

The crucial thing to keep in mind is that OCR will communicate by certified letter. That letter will include all of the facts regarding the possible inquiry, requests for information, and a schedule of deadlines by which further action must be taken.

A HIPAA desk audit is the first. Federal investigators will ask your organization for proof about the type of HIPAA breach when they select you for a HIPAA desk audit. Documentation relating to any aspect of your organization’s HIPAA compliance programme may be requested by OCR investigators, including but not limited to:

Records of employee training with supporting documentation
Showing that you have checked the compliance level of your organization through an audit
Remediation plans that have been completed, dated, and signed, to resolve any compliance holes in your organization
Rules and regulations
Agreements for business partners and vendors, as well as proof of thorough research
Emergency recovery strategy
Keeping track of any events or HIPAA violations that have taken place inside the company

An onsite HIPAA audit is the other type of HIPAA audit you could anticipate. Federal investigators from OCR will visit your organization to look into its physical properties, which is exactly what it seems like it will happen. A document request and review component is frequently needed for onsite HIPAA audits. Any of the aforementioned components (or any other part of a successful HIPAA compliance programme described in HIPAA regulation) may be included in the paperwork that OCR investigators will require.

How to React to a HIPAA Audit?

Don’t freak out if HHS OCR notifies your company that a desk audit or on-site audit is coming up under HIPAA. The following actions can be taken by your organization to get ready:

Make a list of your current compliance papers to make it accessible in case investigators ask for it.
If you haven’t already, choose a Compliance Officer; they will be the point of contact between you and OCR investigators. Consider forming a task force or team composed of personnel from relevant departments (such as IT, quality, administration, compliance, etc.) if your organization is larger.
If you haven’t already, start an internal investigation into the infraction.
Get as much information as you can about the data breach’s cause, scope, and potential victims if it was the source of the infringement. Be sure to have the details of any police reports filed on hand as well.
Evaluate your organization’s current HIPAA compliance programme and gather documentation of your “good faith effort” to comply with HIPAA. This includes any previous actions your organization may have taken, such as security risk assessments, employee training, policies and procedures, business associate agreements, and anything else.

Suggestions for Creating and Finishing HIPAA Audit Checklists

It can be difficult to incorporate all aspects of HIPAA compliance into a single HIPAA audit checklist, and because the checklist is so thorough, it may create gaps that result in compliance failures.

There are two approaches to overcoming this obstacle. Divide the HIPAA audit checklist into smaller, more manageable chunks, or hire a compliance specialist to assist you with both creating and finishing the checklist.

One benefit of selecting the latter option is that compliance experts have the expertise to evaluate an existing checklist, ascertain how much assistance you require, and provide as much assistance as necessary to develop a thorough checklist. This strategy has the advantage of keeping you from searching for risks that don’t exist or that don’t pertain to your organization, thus saving you time and money.

Conclusion

The rules for what to do after a HIPAA audit can seem a little intimidating if you’re currently going through one. Although this is a significant event in the history of your company, worse has happened to organizations just like yours. Keep in mind some of the HIPAA audit criteria and practices that we have already covered. These could aid in preparing you and your company for a HIPAA audit and the possible penalties brought on by an OCR probe.

TechVariable helps businesses prepare to respond to any HIPAA audit triggers. Schedule a call with our expert team today!

Advanced Data ETL, Reporting and Gen AI

No-code data engineering

Automated data transformation

Enterprise-grade LLM

MODULES

Healthcare Data Management

Advanced Data ETL, Reporting and Gen AI

No-code data engineering

Automated data transformation

Enterprise-grade LLM

Solutions that ensure

Advanced Data ETL, Reporting and Gen AI

No-code data engineering

Automated data transformation

Enterprise-grade LLM

Explore more

Advanced Data ETL, Reporting and Gen AI

No-code data engineering

Automated data transformation

Enterprise-grade LLM

HIPAA Compliance Auditory Checklist

Is There a Chance of a HIPAA Audit?

What Triggers a HIPAA Audit?

What are HIPAA Covered entities?

Administrative requirements for an audit

Privacy Rule requirements for an audit

Security Rule requirements for an audit

Typical HIPAA Infractions That May Lead to HIPAA Audits

HIPAA Audit Guidelines

How to React to a HIPAA Audit?

Suggestions for Creating and Finishing HIPAA Audit Checklists

Conclusion