Jessica Forbes Olson and T.J. Lang write:
In Part 1, we noted that on March 21, 2016, the Office of Civil Rights (“OCR”) announced it will launch a second round of HIPAA audits this year. As with the first round of audits, in round two OCR will be reviewing compliance with HIPAA Privacy, Security and Breach Notification rules. New for this round, the 2016 audits will focus on covered entities, including health care providers and health insurers, and their business associates.
A HIPAA compliance checklist for health care providers and insurers follows:
- Determine whether for HIPAA purposes you are a hybrid entity, an affiliated covered entity or part of an organized health care arrangement. Document that status.
- Appoint a HIPAA privacy official.
- Appoint a HIPAA security official.
- Appoint a HIPAA privacy contact person who will handle complaints and respond to the exercise of patient or participant rights.
- Determine where PHI is located, whether hard copy, electronic, or spoken.
- Determine the reasons why PHI is used or disclosed (e.g., treatment, payment, health care operations, public health reasons, public policy reasons, to government agencies or officials).
- Determine which departments and workforce members have access to PHI, why they have such access and the level of access needed.
- Identify and document the routine requests, uses and disclosures of PHI and the minimum necessary for those requests, uses and disclosures.
- Identify all business associates: vendors that create, maintain, use or disclose PHI when performing services for your entity.
- Have executed business associate agreements with all business associates.
- Have and follow written HIPAA privacy, security and breach notification policies and procedures.
- Train all workforce members who have access to PHI on the policies and procedures and document the training.
- Have and use a HIPAA-compliant authorization form.
- Have and follow process for verifying the status of personal representatives.
- Distribute a notice of privacy practices and providers must attempt to obtain acknowledgment of receipt of notice from patients and post one in each facility where patients can view it.
- Establish and document reasonable administrative, technical and physical safeguards for all PHI, including hard copy and spoken PHI.
- Conduct and document a HIPAA security risk analysis for all electronic PHI (e.g., PHI on desktops, laptops, mobile phones, iPads and other electronic notebooks, copy machines, printers, discs and thumb drives).
- Address risks to ePHI that are identified in the HIPAA security risk analysis.
- Update your HIPAA security risk analysis periodically or when there is a material change in your environment that does or could impact PHI or if there are changes in the law impacting PHI.
- Encrypt PHI to fall within the breach safe harbor.
- Have written disaster recovery and contingency plans.
- Prepare for and respond to security incidents and breaches.
- Comply with HIPAA standard transactions and code set rules related to electronic billing and payment.
- Although it will not be covered by the audits, comply with more stringent state privacy and security laws (e.g., document retention; patient consent; breach reporting).
- Maintain HIPAA compliance documentation in written or electronic form for at least 6 years from the date the document was created or last in effect.
For more information about OCR audits or assistance in conducting a HIPAA compliance review, please contact any member of the Fox Rothschild Health Law practice group.
Jessica Forbes Olson is a partner and TJ Lang is an associate, both resident in the firm’s Minneapolis office.