The U.S. Department of Health and Human Services has launched a new round of audits to evaluate compliance with patient privacy rules under the Health Insurance Portability and Accountability Act (HIPAA). The audits will involve sending questionnaires to health care providers, insurers, and their business partners to gather information and create an audit pool. Selected organizations could face financial penalties or agreements to improve practices if audits find serious privacy issues. Over 200 audits are planned involving both remote and in-person reviews, with the goal of strengthening guidance on maintaining protected health information confidentiality.

1. Portfolio Media. Inc. | 860 Broadway, 6th Floor | New York, NY 10003 | www.law360.com
Phone: +1 646 783 7100 | Fax: +1 646 783 7161 | customerservice@law360.com
Feds Launch Long-Awaited HIPAA Audits
By Jeff Overley
Law360, New York (March 21, 2016, 3:38 PM ET) -- After years of anticipation, federal
regulators on Monday launched a new round of audits to gauge compliance with patient
privacy provisions of the Health Insurance Portability and Accountability Act.
The launch is starting off innocuously with emails to so-called covered entities — health
care providers, insurance plans and clearinghouses — and to business associates that
handle patient information on behalf of those entities. The emails will simply ask to verify
contact information, after which recipients will receive a “preaudit questionnaire” seeking
details on their business size and operations.
From there, the Office for Civil Rights at the U.S. Department of Health and Human
Services will create a pool of audit targets. The pool will be created “in coming months”
and will “represent a wide range of health care providers, health plans, health care
clearinghouses and business associates,” the OCR said Monday.
If an audit turns up a “serious compliance issue,” the OCR said, further investigation may
occur, which could trigger financial penalties and a formal agreement to improve HIPAA
compliance.
More broadly, the agency said that it will use its findings to develop new guidance and
policies aimed at strengthening adherence to HIPAA rules aimed at safeguarding the
confidentiality of so-called protected health information.
According to news reports last week, about 200 audits are planned. On Monday, the OCR
said that a majority of the reviews will be remote “desk audits,” although some in-person
audits will take place. All the desk audits will be finished by the end of 2016, according to
the OCR.
The OCR had performed pilot audits in 2012, but funding for further inquiries dried up. As
a result, the agency has relied on tips and disclosures of breaches to police HIPAA
compliance. That has given the agency plenty of material, but government watchdogs
have still criticized the lack of proactive oversight.
One of the key questions surrounding audits is how business associates will fare, given
that they have been covered by HIPAA only since 2013. In an interview Monday, Ropes &
Gray LLP partner Deborah Gersh predicted that the OCR may focus in particular on
business associates that conduct large-scale data analysis for covered entities.
On Monday the OCR promised to release its audit protocols — instructions on how audits
are conducted — later this year, when the agency is closer to actually performing the
audits. The protocols are being updated to reflect policies in a 2013 final rule that
expanded HIPAA’s reach.
Page 1 of 2Feds Launch Long-Awaited HIPAA Audits - Law360
3/21/2016http://www.law360.com/articles/774290/print?section=health

2. Companies selected for an audit will receive a detailed overview of the audit process and
an outline of their obligations, according to the OCR. Generally, companies will have 10
business days to submit the requested information, and the OCR will then review the
information and respond with its findings. Companies will then have a chance to respond
to the findings before a final audit report is completed.
--Editing by Edrienne Su.
All Content © 2003-2016, Portfolio Media, Inc.
Page 2 of 2Feds Launch Long-Awaited HIPAA Audits - Law360
3/21/2016http://www.law360.com/articles/774290/print?section=health