News Feature | October 13, 2014

HIPAA Audits Postponed

By Megan Williams, contributing writer

HIPAA Audits Postponed

The Health And Human Services Office For Civil Rights (OCR) announced in September that it has postponed the upcoming round of HIPAA audits because of a need to update its portal.

History
According to iHealthBeat, The OCR conducted its pilot audit program in 2012. The program involved 115 covered entities, and included audits of:

  • clearinghouses
  • health plans
  • health care providers

The second round of audits (“desk audits”) was scheduled to be performed the fall of this year, and involve OCR staff and 350 covered entities and around 50 business associates.

The Delay
OCR Senior Adviser, Linda Sanches told attendees of the Healthcare Information And Management Systems Society that they should “stay tuned” about the new audit start date, but did not provide specifics.

She also indicated that the project to update the portal technology to streamline the agency’s collection and analysis audit documents was “pushed back.” As a result, OCR decided they would hold off on starting the audits. Sanches also informed attendees that the number of remote desk audits would be under 200 and that on-site audits would be more comprehensive.

Details
Sanches stated that OCR would be sending pre-screening surveys out to covered entities before business associates. Both groups of users will be using the new, online portal and the surveys would only be used to determine if an entity is a candidate for an audit.

Covered entities subject to audits will be selected randomly from a national provider index database, and adjusted to include “a wide geographic range and mix of covered entities, ranging from physician offices to dentists to insurers.” If an entity is already under investigation, it will not be subject to an audit.

Any entity selected for an audit will be responsible for HIPAA compliance including

Sanches advises that to get things in order, covered entities should be getting their houses in order and be aware of who their business associates are.

Going Deeper
Curious about how HIPAA applies to you as a VAR and your clients? Read “How Does HIPAA Apply To VARs.”