Kali Systems News

Don’t get caught unprepared!

On November 8^th, the Office for Civil Rights (OCR) officially unveiled its long anticipated audit program. These audits, mandated by Section 13411 of the HITECH Act, are intended to “ensure covered entities and business associates are complying with the HIPAA Privacy and Security Rules and Breach Notification standards.”[1]

If your organization has not been keeping up with recent changes to HIPAA Privacy and Security Rules, you may be unaware of significant new requirements for covered entities and business associates, such as breach notification, and the drastic overhaul of the enforcement process including a tiered penalty plan.

Audit 101

Beginning November 2011, and concluding December 2012, OCR will complete a pilot audit program of 150 covered entities to “assess privacy and security compliance.” If selected for an audit (and OCR indicates they intend to audit a broad range of covered entities and business associates), the organization will be notified in writing and provided with an initial documentation request. All documentation must be submitted within 10 business days. The audit will include an onsite visit expected to take 3 to 10 business days. The auditor will generate a report, which the organization will review and will have 10 days to submit their written response, including actions they have taken to resolve any compliance issues. A final report will be submitted to OCR, which will develop recommendations and evaluate the need for corrective actions. Note: Compliance audits may also occur as a result of a Privacy or Security Rule complaint.

How to be prepared

1. Your compliance officer should review your HIPAA compliance plan. Have you implemented the new requirements, such as Breach Notification, enacted by the HITECH Act?
2. Review and update policies and procedures. These documents are required and are a primary method to demonstrate compliance with the Rules.
3. Review and/or complete a Risk Assessment as required. This should include a technical and nontechnical review of the information system. Failure to complete the required analysis may be considered willful neglect under the new tiered penalty plan.
4. Review or develop a process to identify, document, mitigate and report privacy and security incidents including the required breach notifications.
5. Review and update Business Associate contracts. Remember that Business Associates are now required to comply with portions of the Privacy and Security Rules.

This week’s news highlights the growing need to take proactive steps to protect sensitive data. It’s time to take notice, before your organization has to give notice of a data breach.

The Office of Civil Rights (OCR), responsible for enforcing HIPAA regulation, has announced the hiring of KPMG of McLean, VA to implement an audit program of covered entities and business associate compliance with the HIPAA privacy and security standards. This action marks the first time proactive “periodic audits”, as required by the HITECH Act, will be implemented. Until now, investigations have been in response to complaints.[1] Continue reading →

For the second time this week, the Department of Health and Human Services (HHS) has announced stiff penalties for HIPAA violations. This may signal the start of stronger HIPAA enforcement action by the Office for Civil Rights (OCR) and a sign of things to come when HHS rolls out its HIPAA compliance audit program as mandated by the Health Information Technology for Economic and Clinical Health (HITECH) Act.

On February 22^nd, HHS announced a landmark civil monetary penalty (CMP) against Cignet Health of Prince George’s County, Md., for violations of the Privacy Rule. The $4.3 million penalty was imposed for failing to provide 41 patients with copies of their records in the time frame required by HIPAA, and for failing to cooperate with the OCR investigation. It was the first time a penalty was assessed for Privacy Rule violations, and the first time the increased penalty amounts authorized by Section 13410(d) of the HITECH Act were applied. Continue reading →

As I reviewed the provisions of HIPAA Security and Privacy provisions with a lead surgeon who heads a small but bustling medical practice, I could tell he would rather be in a treatment room with a patient than sitting in the lunch room with me discussing one of a legion of requirements and regulations. “Do other doctors really do this?” he asked, his head buried in his hands.

Protecting sensitive data is a hot button. Criminal data theft and fraud have grown alongside the explosion of day-to-day dependence on the internet, wireless and mobile technology. The Identity Theft Resource Center reported 662 data breaches in 2010, affecting 16,167,542 records. 76% of these records included Social Security numbers.

Continue reading →