HHS Begins HIPAA Privacy and Security Audits

(Benefits Update, No. 2, May 2012)

As you may recall, the HITECH Act required Health and Human Services (HHS), the federal agency in charge of administering HIPAA, to affirmatively conduct periodic audits to ensure that covered entities and business associates are complying with HIPAA's privacy and security rules. Before HITECH, HHS was mostly responding to complaints and not conducting random audits of HIPAA compliance.

HHS's Office for Civil Rights (OCR) has launched a pilot audit program and expects to complete 150 audits by the end of 2012. These audits will include requesting documentation as well as onsite visits and a final report noting compliance issues.

These HHS audits can lead to compliance reviews, resulting in monetary settlements or the imposition of civil money penalties. Covered entities and business associates, including employer-provided health plans and their service providers, should make sure their workforce training, policies and procedures, and security risk assessments are in place, easily accessible and up-to-date.