The Health Insurance Portability and Accountability Act (HIPAA) is increasingly stringent on enforcing its privacy and security rules upon healthcare institutions. HIPAA’s regulations outline how private health and patient information should be protected, along with guidelines on how healthcare organizations should proceed in the event of a security breach or data leak.
The cost on non-compliance when it comes to HIPAA regulations can be steep. Not only can these fines be costly, but in some cases lawsuits and criminal charges can be filed if the breach is large enough. Reporting these issues to the Office for Civil Rights (OCR) of the Department of Health and Human Services cannot be taken lightly either.
Recently, the OCR began shifting towards proactive audits of healthcare institutions, insurance plans, and clearinghouses. While the organization performs audits to help improve compliance efforts within healthcare institutions, it is not afraid to conduct full-blown compliance reviews if an audit reports unethical or fraudulent behavior.
To avoid healthcare non-compliance and failed audits from the OCR, consider the following:
Establish a Risk Assessment Program
When the OCR performs audits and identifies HIPAA compliance violations, a frequent theme is the lack of a proper healthcare risk assessment program. These sorts of programs are vital in protecting patient health information and highlighting potential vulnerabilities in their processes. The risk analysis program should also uncover the current health of the organization’s IT infrastructure and if it is properly capable of protecting this vital information.
For example, a risk assessment program can identify the encryption capabilities of the IT ecosystem and spot areas of improvement.
Related Article: Risk Assessment when Managing Contracts
Manage Business Associate Contracts and Agreements
Hospitals and healthcare institutions often rely on business associates for covered entities and other third-party affiliates. These businesses usually offer a service or good in return for safeguarded health information. An array of healthcare management and billing companies, third-party hosted IT infrastructure providers, and Medicare groups all represent the need for solid business associate agreements. The OCR keeps a close eye on these agreements, stressing the need for an automated contract management system or software like ConvergePoint’s in place to handle all documentation tied to the third-party affiliates.
Without a contract management platform, an error in the contract lifecycle process can be spotted during an OCR audit and lead to significant fines and penalties.
Develop an HIPAA Audit Response Plan
Preparation is key when facing an OCR and HIPAA compliance audit. Having an audit response plan is place is critical for every healthcare organization to possess. First off, identifying who answers audit requests from the OCR and provides documentation to them is imperative.
In this case, the responder could utilize the contract management software in place at their organization to easily retrieve all required documents, especially if an audit trail has been automatically maintained. Documents like the previously mentioned business associate contracts, HIPAA notification policies, incident tracking programs, employee training courses, and risk assessment findings will all come in handy once an audit takes place. It’s also a great option to run mock audits within an organization in the event a real one were to occur.
A contract management software on SharePoint like ConvergePoint’s ensures all contracts and agreements are stored in one central repository, so users can easily retrieve documents required by the OCR and HIPAA. Obligation management features highlight key dates with auto-reminders and audit trails, and real-time dashboards efficiently present that information. Plus, renewal notifications allow for unused contracts to be renegotiated or removed altogether.
Talk to a compliance specialist today to learn how our Contract Management expertise can be applied to your business by scheduling a demo now.