A look at the OCR Audit Protocol

OCR released the details of the HIPAA audit protocol. There aren’t a lot of surprises in their list of items they look for during an audit. The protocol looks like a summary of the HIPAA Privacy and Security Rules with the addition of the Breach Notification Rule. There are 77 items for HIPAA Security and 88 items for Privacy and Breach Notification. The audit protocol highlights the fact that an organization has to produce an enormous amount of information to demonstrate compliance with HIPAA and HITECH.

Below are the first 6 (out of 40) required security implementation specifications (click on any of the items below to go the OCR website). The remaining 71 specifications are addressable (which does not mean they are optional but an organization has to document how they are implementing the specification or why they are not implementing the specification.)

Section	Established Performance Criteria	Key Activity	Audit Procedures	Implementation Specification
§164.308	§164.308(a)(1):Security Management Process §164.308(a)(1)(ii)(a) – Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health infor…	Conduct Risk Assessment	Inquire of management as to whether formal or informal policies or practices exist to conduct an accurate assessment of potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Obtain and review relevant doc…	Required
§164.308	§164.308(a)(1)(i):Security Management Process – Although the HIPAA Security Rule does not require purchasing any particular technology, additional hardware, software, or services may be needed to adequately protect information. Consideration…	Acquire IT Systems and Services	Inquire of management as to whether formal or informal policy and procedures exist covering the specific features of the HIPAA Security Rule information systems §164.306(a) and (b). Obtain and review formal or informal policy and procedures and eval…	Required
§164.308	§164.308(a)(1)(ii)(D):Security Management Process – Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.	Develop and Deploy the Information System Activity Review Process	Inquire of management as to whether formal or informal policy and procedures exist to review information system activities; such as audit logs, access reports, and security incident tracking reports. Obtain and review formal or informal policy and p…	Required
§164.308	§164.308(a)(1):Security Management Process §164.308(a)(1)(ii)(c ) – Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity.	Development and Implement a Sanction Policy	Inquire of management as to whether a formal process or practice is in place to address system misuse and abuse and fraudulent activity. Obtain and review the formal documentation of the process or practices designed to address noncompliance with HI…	Required
§164.308	§164.308(a)(2):Assigned Security Responsibility – the responsibility for security should be assigned to a specific individual or organization to provide an organization focus and importance to security, and that the assignment be documented.	Select a Security Official To Be Assigned Responsibility for HIPAA Security	Inquire of management as to whether the organization has assigned responsibility for the HIPAA security to a Security Official to oversee the development, implementation, monitoring, and communication of security policies and procedures. Obtain and …	Required
§164.308	§164.308(a)(2):Assigned Security Responsibility – the responsibility for security should be assigned to a specific individual or organization to provide an organization focus and importance to security, and that the assignment be documented.	Assign and Document the Individual’s Responsibility	Inquire of management as to whether the roles and responsibilities of the assigned individual or organization are properly documented in a job description and communicated to the entire organization. Obtain and review the Security Official’s job des…	Required

Final thoughts

Organizations need to address the HIPAA and HITECH requirements now before they receive an audit letter. There is not enough time to put the 165 items in place after receiving an audit letter. What would you do if your organization was asked to demonstrate compliance with each of the 165 requirements?

A look at the OCR Audit Protocol

Leave a Reply Cancel Reply

Recent Posts

Recent Comments

Archives

Categories

Meta

A look at the OCR Audit Protocol

You also might be interested in

Introducing HIPAA Secure Now!

Huge security breach fines coming in 2011

Using patient record security as a competitive advantage

Leave a Reply Cancel Reply

Recent Posts

Recent Comments

Archives

Categories

Meta