The HIPAA Audit Program for 2015 - New Focus, New Process

Why Should You Attend:

This webinar on new HIPAA guidance for 2015 will:

• Discuss the HIPAA audit program and how it works.
• Cover the areas that caused the most issues in the 2012 audits.
• Explore what kind of issues and what kind of entities had the most problems and show where entities need to improve their compliance the most.
• Explore the typical risk issues that lead to breaches of health information and see how those issues may be a target for auditors in 2015.
• Review the contents of the HIPAA Audit Protocol used in 2012 to show what documentation needs to be on hand should your organization be selected for an audit in 2015.
• Present methods for using the contents of the HIPAA Audit Protocol to build your own compliance plan by relating your compliance activities directly to the questions that might be asked.
• Discuss the HIPAA audit and enforcement regulations and processes, and how they apply to HIPAA covered entities and business associates.
• Explain recent changes that increased fines and created new penalty levels, including new penalties for willful neglect of compliance that begin at $10,000.
• Discuss results of prior HHS audits and their penalties including recent actions involving multi-million dollar fines and settlements.
• Detail new trends in information security risks so you can start planning for the work you'll need to do to stay in compliance and keep patient information private and secure.

Areas Covered in the Webinar:

• The HIPAA random audit program is being refocused and redefined to make it more relevant to finding and correcting some of the most prevalent security and privacy compliance issues, based on the experience gained in the 2012 audits and in HIPAA breaches.
• HIPAA audits have been few and far between in the past, but that's changing now - the HHS is now auditing HIPAA covered entities and business associates even if there have been no complaints or problems reported.
• Fines and penalties for violations of the HIPAA regulations have been significantly increased and now include mandatory fines for willful neglect of the rules that begin at $10,000 minimum and can reach $50,000 per day.
• The HIPAA Audit Protocol of 2012 will be examined along with the sets of questions asked at other HIPAA audits previously.
• Find out what HHS OCR is likely to ask you if you are selected for an audit, and what you'll need to have prepared when they do.
• Find out the rules that you need to comply with and what policies you can adopt that can help ensure compliance.
• Learn how having a good compliance process can help.
• Find out what you'll need to have documented to survive an audit and avoid fines.

Who Will Benefit:

This webinar will provide valuable assistance to all personnel in medical offices, practice groups, hospitals, academic medical centers, insurers, business associates (shredding, data storage, systems vendors, billing services, etc.). The titles are:

• Compliance Director
• CEO
• CFO
• Privacy Officer
• Security Officer
• Information Systems Manager
• HIPAA Officer
• Chief Information Officer
• Health Information Manager
• Healthcare Counsel/Lawyer
• Office Manager
• Contracts Manager

Instructor Profile:

Jim Sheldon-Dean, is the founder and director of compliance services at Lewis Creek Systems, LLC, a Vermont-based consulting firm founded in 1982, providing information privacy and security regulatory compliance services to a variety of health care providers, businesses, universities, small and large hospitals, urban and rural mental health and social service agencies, health insurance plans, and health care business associates. He serves on the HIMSS Information Systems Security Workgroup, has co-chaired the Electronic Data Interchange Privacy and Security Workgroup, currently serves on the WEDI Breach Notification sub-workgroup, and is a recipient of the 2011 WEDI Award of Merit. He is a frequent speaker regarding HIPAA and information privacy and security compliance issues at seminars and conferences, including speaking engagements at AHIMA national and regional conventions and WEDI national conferences, and before regional HFMA chapter meetings and state hospital associations.

Mr. Sheldon-Dean has nearly 30 years of experience in policy analysis and implementation, business process analysis, information systems and software development. His experience includes leading the development of health care related websites; award-winning, best-selling commercial utility software; and mission-critical, fault-tolerant communications satellite control systems. In addition, he has eight years of experience doing hands-on medical work as a Vermont certified volunteer emergency medical technician. Mr. Sheldon-Dean received his B.S. degree, summa cum laude, from the University of Vermont and his master's degree from the Massachusetts Institute of Technology.

Topic Background:

The random HIPAA Compliance Audit program had a year of trial audits in 2012. The US Department of Health and Human Services has reviewed the results of that work and the HIPAA audit program is being restarted based on what was learned from the 2012 audits. Areas of weakness as shown in the 2012 audits and as shown by breach reports are likely targets for the next round of audit questions, and HHS is sending out requests for information to 1,200 covered entities and business associates to determine their suitability to be audited.

While in the past audits had been performed only at entities that reported a breach or had a complaint filed against them, the new rule calls for audits whether or not there is a complaint or breach. The HHS Office for Civil Rights (OCR) can ask to perform an audit on short notice, and your organization will need to provide a response in less than ten business days. Knowing what questions are likely to be asked and have been asked at prior HIPAA compliance audits can make preparing for and surviving a HIPAA audit much easier.

USDHHS has published the protocol used for the 2012 HIPAA audits, so it is possible to know much better now how to prepare for an audit. Nearly any healthcare covered entity may be subject to an audit; all entities need to know what kinds of questions they’ll be asked, what information they'll need to provide and how to prevent issues that could lead to violations and fines.

If your organization is not ready, the HIPAA rules have new, significantly higher fines, including mandatory minimum fines of $10,000 for willful neglect of compliance. In addition, HIPAA enforcement has taken on a new importance at HHS; officials have publicly stated that enforcement is now a priority, and that means being ready for an audit is more important than ever.

Follow us :