Day Pitney launches its own HIPAA Self-Assessment Tool to help clients prepare for the second phase of HIPAA audits by the U.S. Department of Health and Human Services' Office for Civil Rights (OCR) to begin in early 2016. The target for these audits has expanded beyond covered entities – healthcare providers, health plans and clearinghouses – and will also include business associates, such as vendors, suppliers and consultants.
Because HIPAA noncompliance can be costly and disruptive to an organization, Day Pitney created a simple-to-use automated tool based on OCR's audit protocol to help clients assess whether they are in compliance with HIPAA's security, privacy and breach notification requirements. OCR has engaged a contracted vendor to conduct the audits and has the authority to initiate enforcement actions based on the audit results.
"Companies should really start self-audits as soon as possible to make sure they are in compliance with the HIPAA rules. The most common deficiency found by the OCR is the failure to conduct a security risk assessment to identify and mitigate risks to Protected Health Information that may be exposed on servers and unencrypted laptops, as well as ancillary risks resulting from unchanged default passwords, outdated security software and inadequate training."
The tool, which asks user-friendly questions with links to applicable regulation citations, is designed to be completed by a company's compliance officer, privacy officer, health information manager, medical records manager or legal counsel. Once a client inputs their information, the tool provides an automated assessment summary. If there are areas of noncompliance, Day Pitney is ready to work with the client to address and correct such areas.
Although the tool cannot guarantee a successful audit result, any covered entity or business associate can benefit from its use. After reviewing the tool, one hospital's general counsel noted that even organizations that have done a lot of work to implement the necessary privacy and security policies can use the tool to determine whether there are any gaps in their compliance program. For organizations that have not yet completed their HIPAA-readiness, the tool can be used as a roadmap that shows what needs to be done. A more detailed description of the tool can be found here on Day Pitney's website.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
