Is Your Technology HIPAA Audit Ready?
A HIPAA audit can be a terrifying concept, considering that failure to comply can result in civil and criminal penalties. According to HHS, over $24 million in fines were assessed in 2016 alone.
Although HIPAA regulations are complex and challenging to manage, ignoring them is not an option. So whether you received a notice of an audit or not, ensuring your practice is compliant is a must! The best way to achieve a good audit result is to embrace the process as something that will better your practice, staff, and patients in the long run.
So, how should you get started? Read on to learn the best practices, so when the time comes, your audit will run smooth.
Ask yourself, does your practice have a/an…
Up to date risk analysis
Identifying the risks in your environment is one of the first steps to ensuring your security program would pass a HIPAA test. Your auditor will want to know about the security programs in place. Check out the US Department of Health and Human Services page for their risk analysis guidelines.
Defined breach notification and incident response process
An incident response plan is an important component of HIPAA compliance as it states what you will do in case of a security breach. An auditor will look for the processes in place to respond to and document any security breaches at your organization. In addition, the HITECH Breach Notification Rule requires documentation to determine if incidents need to be reported to authorities and individuals affected. Covered entities who report a breach will not be fined for the breach, however they will incur fines if they do not have documented policies and procedures on how to handle a breach.
Routine PHI training programs
Ensure your PHI training program is up to date and ongoing, as it is critical for entire staff to know the fundamentals of handling patient information in relation to the HIPAA security rule. Remember, while under audit, organizations must be prepared to provide documentation of training for anyone with access to patient information; including, employees, volunteers and other contractors or staff. Employees must also attest to their ongoing HIPAA training.
Established BYOD policies
Does your organization have special policies and procedures for mobile devices? If not, HIPAA requires that employees should be using encrypted devices and if missing or stolen, devices are able to be wiped. To make sure your audit runs smoothly, ensure your mobile policies meet federal requirements.
Document, Document, Document
Above all, the easiest way to demonstrate you are compliant is to keep records of all HIPAA-related documents. Be sure to create gap reports identifying changes and improvements from year to year. By the time your auditor comes, you can feel confident knowing you have everything in place. Make sure you file and store your documents in a well-organized, easily accessible and securely stored to prevent future headaches down the road.
Would you pass a HIPAA audit?
Not many covered entities would at this point. So just like an annual patient checkup, regularly analyzing your IT system, policies and procedures is essential. By assessing where your practice meets (or falls short of) HIPAA regulations, you can identify areas of risk, take proactive steps to reduce it and meet compliance.
Our monitoring, reporting and diagnostics will help you see where your technology measures up or falls short, and give you the information you need to improve your IT security, efficiency and overall tech health. Schedule an automated IT checkup to see where your organization stands on HIPAA compliance, or talk to our team of experts if you need assistance in any of these areas.
