Home health agencies and other entities subject to federal privacy laws now are under more scrutiny, as the Health and Human Services Department Office for Civil Rights (OCR) now has launched Phase 2 audits.
In this phase of audits, OCR will review policies and procedures that covered entities and their business associates have in place to comply with requirements of the Health Insurance Portability and Accountability Act (HIPAA). In the first, pilot phase of audits in 2012, OCR assessed 115 covered entities. Now, the agency is undertaking its long-awaited Phase 2 audits, OCR announced Monday.
The first step in Phase 2 audits will be verifying an entity’s address and contact information. To accomplish this, OCR is sending emails to covered entities and their business associates, requesting this information. Entities that do not respond to this request still could be subject an audit, so OCR is urging providers and other affected organizations to review their email filters and check their spam folders for OCR emails.
After obtaining address verification, OCR will send a more detailed screening questionnaire to covered entities, and from there will create audit pools to represent a range of health care providers, health plans, and other types of covered entities. A random sample of entities in the pool will be selected for audits.
Both desk audits and on-site audits will be done in Phase 2. OCR posted details about audit timelines on its website. All desk audits are expected to be completed by the end of December 2016.
Audit reports will be used to develop tools to improve compliance and prevent breaches, and to determine “what types of corrective action would be most helpful,” according to OCR. The agency may launch a compliance review if an audit turns up a serious issue, resulting in penalties for the covered entity.
The OCR has only levied civil monetary penalties for a HIPAA violation two times—and one of those instances involved Lincare, which provides in-home respiratory care and other services.
The agency did not disclose how many audits it intends to do overall in Phase 2.
Written by Tim Mullaney
