Pre Test – The OCR Auditors Are Coming- What To Expect-How To Prepare

Performing a self OCR HIPAA audit has benefits beyond HIPAA rule compliance.

Performing a self OCR HIPAA audit can be used as a resource for conducting an internal mock OCR audit.

HIPAA violations do not create exposure to administrative, civil or criminal penalties.

Training and ongoing reviews are not a part of HIPAA compliance.

HIPAA privacy rules govern use and disclosure of protected health information.

HIPAA security rules involve administrative, legal and technical “safeguards”.

A HIPAA risk assessment is an accurate and thorough assessment of potential risks and vulnerabilities to the confidentiality, integrity and availability of electronic protected health information.

No notice is given to a provider about an OCR HIPAA audit.

OCR HIPAA audits do not involve on-site visits by auditors.

OCR HIPAA audit protocols are published in advance.

An OCR HIPAA audit covers only HIPAA privacy and HIPAA security.

Performing a self-audit satisfies at least 2 federal HIPAA rule requirements.

A Covered Entity’s HIPAA suites of privacy and security policies, procedures and forms are the only types of documentation examined during an OCR HIPAA audit.

There is no need to assign an audit team in connection with an OCR HIPAA audit.

Rehearsing the responses to OCR HIPAA auditors’ areas of inquiry is a best practice.

Best results in an audit situation occur when the provider couples a mock OCR HIPAA audit with a HIPAA risk assessment.

HITECH HIPAA significantly expanded the reach of HIPAA requirements and increased HIPAA fines and penalties.

There are no immediate steps a Covered Entity can take to reduce or eliminate exposure to HIPAA violations.

Failure to completely implement policies and procedures often leads to HIPAA fines and sanctions.

HIPAA laws were enacted in 1996 in legislation governing portability of employees’ health insurance.