industry leading education - compliancy group...agenda hipaa’auditprogram’overview’...
TRANSCRIPT
855.85HIPAA www.compliancygroup.com
Industry leading Education
Certified Partner Program
• Please ask questions • For todays Slides http://compliancy-group.com/slides023/ • Todays & Past webinars go to: http://compliancy-group.com/webinar/
Get Involved.
#cgwebinar
Surviving a HIPAA Audit: Five Crucial Steps RICHARD WAGNER
Quick Poll #1
Quick Takeaway The HIPAA Audit program sounds scary
Challenge – think of this as an opportunity ◦ IT/Security/Compliance: voice can be heard ◦ Providers: beHer serve your paIents in an increasingly unsecure environment
Overall theme: tackle the priority items, then move onto the other issues
Agenda HIPAA Audit Program Overview
Pilot Program Results and Discussion
Five Steps to Surviving an Audit
QuesIons
The HIPAA Audit Program Enacted into law in 2009 (ARRA/HITECH) Designed to combat ex post enforcement
HHS’ Office of Civil Rights (OCR) oversees program, but most work contracted out to consultants
Two pilot programs (2012 and 2013)
Permanent rollout in 2014
Pilot: 2012-‐2013 Caveat: designed/implemented before Omnibus Rule ◦ Covered EnIIes only, no Business Associates ◦ Used old breach analysis, etc.
OCR findings ◦ Many issues, even intenIonal misrepresentaIons ◦ Small providers had the most difficulty ◦ Security flaws dominated findings
Pilot Findings
Privacy Rule Findings
Security Rule Problems
Points of Emphasis: Privacy Rule Policies and procedures Minimum Use
Points of Emphasis: Security Rule Risk assessment, risk assessment, and risk assessment
Mobile device security ◦ Data in moIon ◦ Data at rest
Security incident procedures ◦ Ever more important a`er HIPAA Omnibus RegulaIons went into effect
HIPAA Audit Survival THE FIVE STEPS
Step #1 – OrganizaOon IniIal document request period: 10 days from the postmarked audit leHer
Done by design: tesIng your response Ime
Following this step also allows you to assess your documentaIon gaps
Update old documents
Establishing an audit trail
Quick Poll #2
Step #2 – Security Risk Assessment The most important document you need for HIPAA compliance ◦ Stressed by OCR and the HIPAA Audit process ◦ Also has great pracIcal value – a risk assessment is foundaIonal to proper risk management
Does not have to be daunIng – scalable according to size
What you need to assess ◦ PotenIal risks and vulnerabiliIes to the confidenIality, integrity, and availability of ePHI
Other Ips
Step #3 – Plugging the PHI Holes Risk management – comes on the heels of your risk assessment
Document everything ◦ Remember, the goal is to establish an audit trail
PrioriIze risk miIgaIon acIons
Step #4 – Business Associate Agreements Update your BAA to reflect Omnibus changes ◦ The changes aren’t drasIc, but they need to be in there
Make sure all vendors are under an agreement ◦ BAA terms and complexity needed can vary from provider to provider ◦ Consult your aHorney if necessary
Get subcontractor assurances
Related – vendor management procedures
Step #5 – Training Point of emphasis in the audits, so documentaIon is criIcal
Don’t limit yourself to HIPAA training ◦ Security awareness should be included as well
Use the training as an opportunity to gain informaIon
Conclusions Audits signal a major change in enforcement
As worrisome as this might sound, this can be viewed as an opportunity
Risk assessment: the foundaIon
The more documentaIon, the beHer
QuesOons
Richard Wagner
richard@qliqso`.com
Free Demo and 60 Day Evaluation www.compliancy-‐group.com
855.85 HIPAA (855.854.4722)
The Guard:
One Simple, cost effective Compliance Tracking Solution that satisfies HIPAA, HITECH Risk Assessment, and Omnibus Compliance • Reduces Risk & Liability • Differentiates you from the competition • Retain Clients/Patients • Improve Revenue