HIPAA Audit Service

Health care organizations, depending on the circumstances, face fines of up to $1.5 million for each violation, in addition to the bad publicity of a HIPAA Audit Report. Between the initial document requests OCR will make, the follow-up questions they’ll ask, and the evidence they’ll seek, it can easily be several hundred items, and many hours of effort, to submit documents that address each point. At this point, investing in a qualified HIPAA security risk assessment can save a company thousands if not millions of dollars and massive headaches down the road.

To prepare for a HIPAA Audit, on the part of OCR or of a business partner, obtain your organization’s:

1. Information System Asset Inventory: What electronic protected health information (ePHI) does your organization hold, and on what systems is that information used, stored, or transmitted?
2. Security Violations Policy: When you discover a security violation, what will you do?
3. Risk Analysis Policy: How frequently will you perform a risk analysis? What methodology will you use? What criteria for risk determination will you use?
4. Risk Management Policy: What will you do with the risks that are discovered?
5. Sanctions Policy: When users misbehave, or are careless, what penalties will they suffer?
6. HIPAA Audit Log Requirements, including log-in monitoring (a/k/a Information System Activity Review Policy)
   
7. Security Official Contact Information: Name, title, and email.
   
8. Access Management Policy: How will you authorize, grant, modify, remove, and review Access Rights to PHI? Make sure this covers your own employees, and any non-employees with access, such as customers, contractors, and partners.
   
9. Security Awareness and Training: How and how frequently will your staff be trained? How will periodic security reminders be sent? Where will you keep the training records, and how will you audit your training requirements for HIPAA.
   
10. Antivirus Policy: What is your standard anti-virus software? How often will it update? What will be done upon detecting a virus?
11. Password Policy: How complex are your passwords? How often must they change?
12. Incident Management Policy: When some bad event happens, what will you do? This should include how you will comply with the Breach Notification Rule, should it be needed.
13. Disaster Recovery and Business Continuity Plans: How will you restore data and continue operations in an emergency?
14. Evaluation Policy: How will your internal audit process review your own safeguards? For example, how will you audit training requirements? HIPAA requires some training, but the specifics are left to the organization – but whatever the policy, it must be followed.
15. Business Associate Policy: How will you manage the risk from the third parties you work with?
16. Facility Security Plan: How will you secure your workspace from physical threats?
17. Device and Media Controls Policy: How will you add, manage, re-use, and dispose of hard drives and other electronic devices? Waving a magnet over them is not enough.
18. Access Control Policy, including Unique ID, Emergency Access Procedures, Automatic Logoff, and Encryption Policies: How will you protect your information from unauthorized use?
19. ePHI Integrity Policy: How will you keep your information accurate and valid? You don’t want to overlook an allergy to a medication, for example.
20. HIPAA Documentation Policy: How will you manage all these policies?

(This last item may seem deceptively simple. A HIPAA Documentation Policy should describe where to keep your HIPAA Documents, how long to keep them, when and how to review and update them, and who can view them. This should address not just your policies, but all the other documents these policies produce, such as your organization’s HIPAA audit logs retention requirements, risk management decisions, audit reports from your internal evaluations, and security decisions and their outcomes.)

For each of these HIPAA Audit Requirements, you should determine:

1. Do these required policies and procedures exist;
2. Are they followed; and
3. Are they reasonable and appropriate?

“Reasonable and appropriate” is a judgement call, but some things are self-evident. If your organization’s HIPAA audit trail requirements are “keep logs for 24 hours”, that’s not reasonable nor appropriate.

If your Password Policy states “users must have a password”, that isn’t either. The size and budget of your organization does effect what’s “reasonable”; that which is “reasonable” for Kaiser Permanente is not going to be reasonable for a solo physician practice, and vice versa.

Your organization’s HIPAA audit log retention requirements should be somewhere in between those two. In practice, most organizations without Kaiser’s budget keep HIPAA audit logs for as long as disk space is available, then overwrite the oldest events first.