Description

In this session we will discuss the HIPAA audit and enforcement programs and how they work, and discuss the areas that caused the most issues in prior audits and enforcement actions. We will explore what kind of issues and what kind of entities had the most problems, and show where entities need to improve their compliance the most. We will also explore the typical risk issues that lead to breaches of health information and see how those issues may become a target for auditors in the next round.

Knowing what questions are likely to be asked and have been asked at prior HIPAA compliance audits can make preparing for and surviving a HIPAA audit much easier. USDHHS has published the updated protocol being used for the HIPAA audits, so it is possible to know how to prepare for an audit. Nearly any health care covered entity may be subject to an audit or enforcement investigation; all entities need to know what kinds of questions they’ll be asked, what information they'll need to provide and how to prevent issues that could lead to violations and fines. We will examine the updated HIPAA Audit Protocol as well as other questionnaires that have been used in the past and may be used to help prepare an organization for a future review.

We will discuss what information and documentation must be prepared in advance so that you can be ready for an audit or enforcement review at any time, including sample information request forms and questions asked at prior audits. The session will also cover how to know if you may become the subject of an audit or enforcement action, and what you can do to help limit your exposure. We will discuss how most enforcement actions come about and what can be done to prevent incidents that lead to enforcement activity.

Why should you Attend?

• HIPAA violations can occur for a wide variety of reasons, and if HHS investigates, you may wind up on the receiving end of multi-million dollar penalties, and corrective action plans that can easily cost ten times the cost of the settlement amount or more. If you are not prepared to address issues that have been shown to be a problem in prior breaches and violations, HHS may use a heavy hand in making an example of you – even the head of the HHS Office for Civil Rights has said he’s looking for a “big, juicy settlement” – you don’t want to be that settlement!
• Not only that, if you don’t address the issues that have been shown to be a problem for others in the past, you are leaving yourself open to having those same problems yourself, and have to report breaches or be subjected to an investigation when a patient complains.
• Finally, the HIPAA Audit program is required by law and is not going away any time soon. While HHS may still be absorbing the results of the last round, we now know what kind of questions and expectations may be involved in the final program, and being ready to survive a HIPAA Audit is essential.

Areas Covered in the Session:

• The HIPAA Random Audit program is being refocused and redefined to make it more relevant to finding and correcting some of the most prevalent security and privacy compliance issues, based on the experience gained in the 2012 and 2016 audits and in the HIPAA Breach Notification process.
• HIPAA Audits have been few and far between in the past, but that's now changing - the HHS is now auditing HIPAA covered entities and business associates even if there have been no complaints or problems reported.
• Fines and penalties for violations of the HIPAA regulations have been significantly increased and now include mandatory fines for willful neglect of the rules that begin at $10,000 minimum and can reach $50,000 per day.
• The HIPAA Audit Protocol will be examined along with the sets of questions asked at other HIPAA audits previously.
• Find out what HHS OCR is likely to ask you if you are selected for an audit, and what you'll have to have prepared already when they do.
• Find out what the rules are that you need to comply with and what policies you can adopt that can help you come into compliance.
• Learn how having a good compliance process can help you stay compliant more easily.
• Find out what you'll need to have documented to survive an audit and avoid fines.
• Learn how to export the contents of the HIPAA Audit Protocol and use them as the foundation of your compliance activities and documentation.

Background:

HIPAA enforcement and audits are now a significant reality, and settlements for violations are being announced for more violations regularly. Now, with the increases in breach reporting and the HIPAA random audit program, enforcement of HIPAA is something that every HIPAA entity and business associate needs to be aware of and prepared for, by taking the proper steps in advance to have your compliance in order and the documentation to prove it.

Knowing what questions are likely to be asked and what documentation is necessary to show compliance are key to preparations for HIPAA compliance inquiries, and this session will explore a number of sets of questions and the issues they revealed, leading to enforcement action.

Who will Benefit?

• Compliance Manager
• HIPAA Privacy Officer
• HIPAA Security Officer
• CEO
• Office Manager
• HR Director
• Privacy Officer
• CIO
• Records Release Manager
• HIM Manager
• Counsel