The HIPAA Audit Program for 2016 - New Focus, New Process

Why Should You Attend:

This webinar will review the contents of the HIPAA Audit Protocol used in 2012 to show what documentation needs to be on hand should your organization be selected for an audit in 2016. The course will present methods for using the contents of the HIPAA Audit Protocol to build your own compliance plan by relating your compliance activities directly to the questions that might be asked, and discuss what information and documentation must be prepared in advance so that you can be ready for an audit at any time. Sample information request forms and questions from prior audits will be reviewed.

Additionally, the course will discuss the HIPAA audit and enforcement regulations and processes, and how they apply to HIPAA covered entities and business associates. It will explain the recent changes that increase fines and create new penalty levels, including new penalties for willful neglect of compliance that begin at $10,000.

The results of prior HHS audits (and their penalties) will be discussed, including recent actions involving multi-million dollar fines and settlements. In addition, new trends in information security risks will be discussed so you can begin planning for the work you'll need to do to stay in compliance and keep patient information private and secure.

Areas Covered in the Webinar:

• The HIPAA Random Audit Program is being refocused and redefined to make it more relevant to finding and correcting some of the most prevalent security and privacy compliance issues, based on the experience gained in the 2012 audits and in HIPAA breaches.
• HIPAA audits have been few and far between in the past, but that's now changing - the HHS is now auditing HIPAA covered entities and business associates even if there have been no complaints or problems reported.
• Fines and penalties for violations of the HIPAA regulations have been significantly increased and now include mandatory fines for willful neglect of the rules that begin at $10,000 minimum and can reach $50,000 per day.
• The HIPAA Audit Protocol of 2012 will be examined along with the sets of questions asked at other HIPAA audits previously.
• Find out what HHS OCR is likely to ask you if you are selected for an audit, and what you'll have to have prepared already when they do.
• Find out what the rules are that you need to comply with and what policies you can adopt that can help you come into compliance.
• Learn how having a good compliance process can help you stay compliant more easily.
• Find out what you'll need to have documented to survive an audit and avoid fines.

Who Will Benefit:

This webinar will provide valuable assistance to all personnel in medical offices, practice groups, hospitals, academic medical centers, insurers, business associates (shredding, data storage, systems vendors, billing services, etc.). The titles are:

• Compliance Director
• CEO
• CFO
• Privacy Officer
• Security Officer
• Information Systems Manager
• HIPAA Officer
• Chief Information Officer
• Health Information Manager
• Healthcare Counsel/Lawyer
• Office Manager
• Contracts Manager

Instructor Profile:

Jim Sheldon-Dean is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a wide variety of healthcare entities. He is a frequent speaker regarding HIPAA, including speaking engagements at numerous regional and national healthcare association conferences and conventions and the annual NIST/OCR HIPAA Security Conference. Mr. Sheldon-Dean has more than 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development, and eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. He received his B.S. degree, summa cum laude, from the University of Vermont and his master’s degree from the Massachusetts Institute of Technology.

Topic Background:

The random HIPAA compliance audit program had a year of trial audits in 2012. The US Department of Health and Human Services has reviewed the results of that work and the HIPAA audit program is being restarted based on what was learned from the 2012 audits. Areas of weakness as shown in the 2012 audits and as shown by breach reports are likely targets for the next round of audit questions, and HHS is sending out requests for information to 1200 covered entities and business associates to determine their suitability to be audited.

While in the past, audits had been performed only at entities that reported a breach or had a complaint filed against them, the new rule calls for audits whether or not there is a complaint or breach. The HHS Office for Civil Rights (OCR) can ask to perform an audit on short notice, and your organization will need to provide a response in less than ten business days. Knowing what questions are likely to be asked and have been asked at prior HIPAA compliance audits can make preparing for and surviving a HIPAA audit much easier.

USDHHS has published the protocol used for the 2012 HIPAA audits, so it is possible to know much better now how to prepare for an audit. Nearly any health care covered entity may be subject to an audit; all entities need to know what kinds of questions they’ll be asked, what information they'll need to provide and how to prevent issues that could lead to violations and fines.

If your organization is not ready, the HIPAA rules have new, significantly higher fines, including mandatory minimum fines of $10,000 for willful neglect of compliance. In addition, HIPAA enforcement has taken on a new importance at HHS; officials have publicly stated that enforcement is now a priority, and that means being ready for an audit is more important than ever.

Follow us :