Business Associates are now on the DHHS Office of Civil Rights auditing radar for HIPAA compliance.

1. Leadership
In The News
Blog
Ostendio Customers
Contact Us
New OCR HIPAA Audits Planned – Should Digital Health
Providers Be Worried?
by Grant Elliott , Founder & CEO, Ostendio
FEATURES PRICING MARKETPLACE ABOUT US
Page 1 of 4New OCR HIPAA Audits Planned - Should Digital Health Providers be worried? | Ostend...
4/7/2014http://ostendio.com/new-ocr-hipaa-audits-planned-digital-health-providers-worried/

2. Last week the Department of Health and Human Services (HHS) Office of Civil Rights
(OCR) released its version of a Security Risk Assessment tool to “help guide health care
providers in small to medium sized offices”. This comes after their announcement in February to
target 12,000 companies for proactive HIPAA audits, a third of which will be Business Associates
(BAs).
All this activity follows criticism from some quarters that since introducing the Audit Protocols in
2011, the OCR has been largely ineffective at applying them. With other agencies seemingly
stepping in to fill the void, the OCR is under increasing pressure to step up their game and show
they are able to effectively police the HIPAA regulations.
So who will be affected? When the OCR conducted its first set of audits in 2011 to validate the
Audit Protocol it mainly focused on large Covered Entities such as hospitals and health plans.
This time around it has indicated it will be targeting Business Associates as well, but it is
probably still safe to assume it will be more focused on larger enterprises rather than small to
medium sized businesses. However, this does not mean SMBs should remain complacent as
this exercise is part of a general acceleration of proactive auditing by the OCR and of course
don’t forget should any company be guilty of a breach, then they immediately put themselves in
the OCR strike zone.
Until now, for many small and medium sized business, managing HIPAA compliance has been
more of a marketing initiative than a true exercise in managing and protecting sensitive data.
This is not a criticism or a suggestion that these companies are trying to be deceptive, rather that
there is an element of denial within the small to medium business community about compliance
and a belief that, despite the changes in the law last year, they can continue to fly under the
radar. This approach is driven by a lack of understanding about what they need to do to manage
compliance.
The reality is that while obtaining compliance is a never-ending journey, the first steps are
relatively simple. The OCR comes down hardest on companies that have never conducted a risk
assessment which is why they have now released their own Risk Assessment tool. They are
making it clear there is no excuse for not completing a risk assessment indicating a preference
for companies that know where their vulnerabilities are to those that don’t. Sticking your head in
the sand, or assuming that good IT practices are sufficient will only result in a stiffer penalty. It is
much better to learn what you need to do and to get started down that path even if you can only
do this slowly. As a smaller organization you are not expected to employ the same level of tools
or resources to manage compliance but you are expected to know what compliance looks like
and to have a plan to achieve it.
Despite these recent announcements it is unlikely as a small to medium business that you need
to be looking over your shoulder worried about a proactive OCR audit. That day may still come,
but in the interim you need to be sure you are taking the appropriate actions just in case you find
yourself under the microscope for less random reasons. And that starts by conducting your own
Risk Assessment. You can find more about how to manage your compliance
at http://ostendio.com.
Page 2 of 4New OCR HIPAA Audits Planned - Should Digital Health Providers be worried? | Ostend...
4/7/2014http://ostendio.com/new-ocr-hipaa-audits-planned-digital-health-providers-worried/

3. Resources:
Security 101: Security Risk Analysis – Risk Assessment
Compliance 101: MyVCM High Level Risk Assessment
RESOURCES
Request a Demo
Recent Articles
In The News
Pricing
Marketplace
COMPANY
About Us
Ostendio Customers
Press
Privacy Policy
Terms of Use
CONNECT WITH US..
Twitter Feed
Twitter
LinkedIn
Facebook
Latest tweets
RT @WebSecurityNews: Hackers can hijack $100,000 Tesla electric cars with simple password crack, experts
warn http://t.co/NCgwMjBYen
5 days ago
Follow @Ostendio
Page 3 of 4New OCR HIPAA Audits Planned - Should Digital Health Providers be worried? | Ostend...
4/7/2014http://ostendio.com/new-ocr-hipaa-audits-planned-digital-health-providers-worried/

4. © 2014 Ostendio, Inc. All Rights Reserved
Page 4 of 4New OCR HIPAA Audits Planned - Should Digital Health Providers be worried? | Ostend...
4/7/2014http://ostendio.com/new-ocr-hipaa-audits-planned-digital-health-providers-worried/