Pre Test – Be Prepared: Value of HIPAA Risk Assessment

A HIPAA risk assessment has benefits beyond HIPAA rule compliance.

A HIPAA risk assessment can be used as a resource for conducting an internal mock OCR audit.

HIPAA violations do not create exposure to administrative, civil or criminal penalties.

Training and ongoing reviews are not a part of HIPAA compliance.

HIPAA privacy rules govern use and disclosure of protected health information.

HIPAA security rules involve administrative, legal and technical “safeguards”.

A HIPAA risk assessment is an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information.

A whistle blower is a person permitted to bring an action against a Covered Entity with potential for sharing portion of recovery.

Under HIPAA, workforce includes personnel acting on behalf of a Covered Entity on a paid or volunteer basis.

HIPAA fines are capped at $10,000 per occurrence.

An OCR audit does not involve any on-site visits by auditors.

A HIPAA risk assessment satisfies at least 2 federal HIPAA rule requirements.

A Covered Entity’s HIPAA suites of privacy and security policies, procedures and forms are the only types of documentation examined during an OCR audit.

HHS’ Office of Civil Rights does not give Covered Entities notice of OCR audits.

State attorneys general have no authority to bring HIPAA actions against Covered Entities.

HHS often requires a Corrective Action Plan from Covered Entities for HIPAA violations.

HITECH HIPAA significantly expanded the reach of HIPAA requirements and increased HIPAA fines and penalties.

There are no immediate steps a Covered Entity can take to reduce or eliminate exposure to HIPAA violations.

Failure to completely implement policies and procedures often leads to HIPAA fines and sanctions.

HIPAA laws were enacted in 1996 in legislation governing portability of employees’ health insurance.