Client Alerts & Insights
Be Prepared – HIPAA Audits are Coming in 2014
January 27, 2014
Authored By:
I. Background
Later this year, the Department of Health and Human Services (“DHHS”) is expected to launch its permanent HIPAA Audit Program. The HIPAA Audit Program is authorized under Section 13411 of the HITECH Act, and is designed to test entities’ compliance with the Privacy Rule, Security Rule, and Breach Notification standards.
Historically, the HIPAA regulations have been sparingly enforced. In recent years, however, the DHHS Office of Civil Rights (“OCR”) has demonstrated an increased willingness to levy heavy fines against entities for non-compliance. This trend is expected to continue, and will be further supported by the launch of the permanent HIPAA Audit Program. While all of the details surrounding the mechanics of the HIPAA Audit Program are unknown at this time, providers should expect that the program will operate similar to the pilot program that was conducted in 2012.
II. Pilot Program
During the pilot program, OCR engaged a professional accounting firm, KPMG, to conduct audits of 115 providers. The providers included entities of all types and sizes, including hospitals, pharmacies, physician practices, health plans, and dentists, among others. To facilitate the audit process, OCR developed a set of instructions (the “Audit Protocol”), that is designed to measure entities’ compliance efforts. The Audit Protocol is organized around three main modules that focus on compliance with the Security Rule, Privacy Rule, and Breach Notification Standards. A complete copy of the Audit Protocol can be accessed here.
While the complete results of the pilot program have not yet been made public, OCR has discussed the results at several conferences and through various interviews. As a result of these conversations, we learned that KPMG uncovered a wide variety of compliance failures, across a wide variety of subjects, including the following: (i) outdated policies and procedures; (ii) failure to properly implement policies and procedures; (iii) failure to conduct regular risk assessments; and (iv) lack of awareness of compliance requirements.
III. The Audit Process
In order to properly prepare for a HIPAA Audit, it is important for entities to understand the audit process. First, OCR has explained that a HIPAA Audit is not an investigation, and does not indicate that a complaint has been filed against the respective provider. Instead, audits are intended to be random, and are designed to test and improve compliance across all provider types.
With respect to logistics and timing, the audit will be commenced with a letter from OCR. Next, providers will be requested to provide documentation to the contractor to facilitate the review. In the pilot program, the request for documentation was followed by a site visit. It is not yet clear whether a site visit will be a component of all audits in the permanent program. In any event, the audit will be concluded with the issuance of a report from the contractor to OCR. OCR will then assess whether to open a separate compliance review in cases where an audit indicates serious compliance issues (which compliance review could result in fines, corrective action plans, etc.).
IV. Assess your Current HIPAA Compliance Program
As an initial matter, one of the most important things that you can do to prepare for a HIPAA Audit is to conduct a comprehensive examination of the effectiveness of your current HIPAA compliance program. For example, consider the following list of initial activities that can help you to gauge the effectiveness of your existing program:
- Review your HIPAA policies and procedures – Do they accurately reflect the realities of your business? Do they meet legal requirements? If not, how can you address that shortfall? Can you modify your HIPAA policies and procedures, or do you need to modify your current business practices?
- Talk to your Compliance Officer – Do they have any concerns? Do they understand patients’ rights to request information? What are they doing to prepare for HIPAA Audits?
- Review your Notice of Privacy Practices – When were they last updated? Are they posted in a prominent location? Under the HIPAA Omnibus rule that was passed in 2013, certain updates to the Privacy Practices are required.
- Evaluate your HIPAA Training – Has your entire staff received HIPAA training? How is this training documented? When was the last HIPAA refresher training? HIPAA training should be an ongoing activity, not a one-time event at the time of initial hire.
V. Preparing for an Audit
In addition to evaluating the effectiveness of your existing compliance program there are additional steps that entities can take to prepare for a HIPAA Audit. A good first step in preparing for a HIPAA Audit is to prepare a master HIPAA reference manual, that includes at least the following elements:
- The Audit Protocol;
- List of important people and their contact information (IT, Privacy Officer, etc.);
- Risk Assessment;
- Policies and Procedures; and
- Notice of Privacy Practices.
Making certain that all of these components are updated and contained in a central location will make responding to a request for documents in connection with a HIPAA Audit much easier, and hopefully less stressful.
If you have any questions concerning the new HIPAA Audit Program, or general HIPAA compliance, please do not hesitate to contact a member of Benesch’s Health Care Department.
Gregory G. Binford, Esq. at 216.363.4617 or gbinford@beneschlaw.com
Harry M. Brown, Esq. at 216.363.4606 or hbrown@beneschlaw.com
Frank Carsonie, Esq. at 614.695.9828 or fcarsonie@beneschlaw.com
Janet K. Feldkamp, Esq. at 614.223.9328 or jfeldkamp@beneschlaw.com
Katherine Frech, Esq. at 614.223.9361 or kfrech@beneschlaw.com
Jim Hill, Esq. at 216.363.4444 or jhill@beneschlaw.com
Ari J. Markenson, Esq. at 914.682.6822 or amarkenson@beneschlaw.com
Daniel Meier, Esq. at 914.682.6819 or dmeier@beneschlaw.com
W. Clifford Mull, Esq. at 216.363.4198 or cmull@beneschlaw.com
Daniel J. O’Brien, Esq. at 216.363.4691 or dobrien@beneschlaw.com
Alan E. Schabes, Esq. at 216.363.4589 or aschabes@beneschlaw.com
Kelly J. Skeat, Esq. at 216.363.4182 or kskeat@beneschlaw.com
Martha J. Sweterlitsch, Esq. at 614.223.9367 or msweterlitsch@beneschlaw.com
Latest News
Social Media Might Have to Rethink Platform Design and Features as Courts Reject Communications Decency Act, Section 230 Defense
On April 10, 2026, on appeal from a motion to dismiss, the Massachusetts Supreme Judicial Court held that section 230 of the Communications Decency Act did not bar Massachusetts’s claims that Meta engaged in unfair business practices by creating a platform that was addictive to teens and failing to warn the public about it.
SDNY Bankruptcy Court: Solvent Debtors Face Higher Hurdle to Avoid Default Interest Under 11 U.S.C. § 506(b)
Key Takeaways Following a recent decision from the U.S. Bankruptcy Court for the Southern District of New York, solvent debtors …
$2B Trade Secrets Verdict Overturned by the Virginia Supreme Court
Recently, the Virginia Supreme Court vacated a $2B jury award and ordered a new trial in a state trade secrets action. The justices held that the circuit court judge made four significant errors leading to Virginia’s largest jury award. Significantly, according to the justices, the circuit court judge put an improper burden of proof on defendants to show that its sales were unrelated to the misappropriation to avoid plaintiff being awarded defendant’s full sales revenue as opposed to the plaintiff having the burden to show defendant’s actions proximately caused plaintiff’s damages.
Ohio Senate Introduces Bipartisan Bill to Establish Paid Family and Medical Leave
On April 23, 2026, a new bipartisan bill was introduced in the Ohio Senate that would provide paid family and medical leave to Ohio workers. Sponsored by Democrat Beth Litson and Republican Louis W. Blessing III, Senate Bill 396 largely mirrors programs already established in several other states, including California and New York.