Overview:

In this session we will discuss the HIPAA audit program and how it works, and discuss the areas that caused the most issues in the 2012 audits. We will explore what kind of issues and what kind of entities had the most problems, and show where entities need to improve their compliance the most, and also explore the typical risk issues that lead to breaches of health information and see how those issues may be a target for auditors in 2014.

• We will review the contents of the HIPAA Audit Protocol used in 2012 to show what documentation needs to be on hand should your organization be selected for an audit in 2014. We will present methods for using the contents of the HIPAA Audit Protocol to build your own compliance plan by relating your compliance activities directly to the questions that might be asked, and discuss what information and documentation must be prepared in advance so that you can be ready for an audit at any time. Sample information request forms and questions asked at prior audits will be reviewed.
• We will discuss the HIPAA audit and enforcement regulations and processes, and how they apply to HIPAA covered entities and business associates. We will explain the recent changes that increase fines and create new penalty levels, including new penalties for willful neglect of compliance that begin at $10,000.
• The results of prior HHS audits (and their penalties) will be discussed, including recent actions involving multi-million dollar fines and settlements. In addition, new trends in information security risks will be discussed so you can start to plan for the work you'll need to do to stay in compliance and keep patient information private and secure.

• The random HIPAA Compliance Audit program had a year of trial audits in 2012. The US Department of Health and Human Services has reviewed the results of that work and the HIPAA audit program is being restarted in 2014 based on what was learned from the 2012 audits. Areas of weakness as shown in the 2012 audits and as shown by breach reports are likely targets for the next round of audit questions, and HHS is sending out requests for information to 1200 covered entities and business associates to determine their suitability to be audited.
• While in the past, audits had been performed only at entities that reported a breach or had a compliant filed against them, the new rule calls for audits whether or not there is a complaint or breach. The HHS Office for Civil Rights (OCR) can ask to perform an audit on short notice, and your organization will need to provide a response in less than ten business days. Knowing what questions are likely to be asked and have been asked at prior HIPAA compliance audits can make preparing for and surviving a HIPAA audit much easier.
• USDHHS has published the protocol used for the 2012 HIPAA audits, so it is possible to know much better now how to prepare for an audit. Nearly any health care covered entity may be subject to an audit; all entities need to know what kinds of questions they’ll be asked, what information they'll need to provide and how to prevent issues that could lead to violations and fines.
• If your organization is not ready, the HIPAA rules have new, significantly higher fines, including mandatory minimum fines of $10,000 for willful neglect of compliance. In addition, HIPAA enforcement has taken on a new importance at HHS; officials have publicly stated that enforcement is now a priority, and that means being ready for an audit is more important than ever.
• If you don't take the proper steps to ensure your patients' health information is being protected according to the HIPAA Security Rule, you can be hit with significant fines and penalties. With the increased HIPAA fines beginning at $10,000 in cases of willful neglect, providing good information security and being in compliance are more important than ever.
  

• The HIPAA Random Audit program is being refocused and redefined to make it more relevant to finding and correcting some of the most prevalent security and privacy compliance issues, based on the experience gained in the 2012 audits and in HIPAA Breaches
• We will discuss the HIPAA audit and enforcement processes and how they apply to covered entities and business associates. We will explain the enforcement regulations and their recent changes that increase fines and create new penalty levels, including new penalties for willful neglect of compliance that begin at $10,000. We will discuss what information and documentation needs to be prepared in advance so that you can be ready for an audit without notice.
• Sample information request forms and questions asked at prior audits will be presented.
• The HIPAA Privacy, Security, and Breach Notification regulations (and the recent changes to them) and how they will be audited will be explained. Documentation requirements for compliance will be explained.
• The results of prior HHS audits (and their penalties) will be discussed, including recent actions involving multi-million dollar fines and settlements. A plan for attaining compliance will be presented. The steps to follow to prepare for an audit and respond to an audit request will be outlined. In addition, upcoming trends in information security risks will be discussed.
• Find out what you'll need to think about to deal with future threats to the security of patient information.
• Learn what HHS OCR is likely to ask you if you are selected for an audit, and what you'll have to have prepared already when they do.
• Learn how having a good compliance process can help you stay compliant more easily.
• Find out what you'll need to have documented to survive an audit and avoid fines.

• CFO
• Privacy Officer
• Security Officer
• Information Systems Manager
• HIPAA Officer
• Chief Information Officer
• Health Information Manager
• Healthcare Counsel/lawyer
• Office Manager