The first round of audits is now under way—167 covered entities (including health plans, health care providers and health care clearinghouses) were notified by email earlier this week that they had been selected for desk audits and have until July 22, 2016, to submit requested documents through a portal on the OCR website. As expected, these desk audits will focus on compliance with requirements relating to security risk analyses and security risk management, notices of privacy practices, affording patients access to their medical records, and content and timeliness of breach notification. OCR noted that these particular requirements are being targeted in these desk audits because OCR’s pilot audits and enforcement activities have indicated that these are frequent areas for noncompliance.
Even if your company was not selected in this wave of audits, more audits are coming, and even minor breaches can trigger regulatory scrutiny. Covered entities and business associates should check the OCR website regularly for updates relating to the audit process. Further, entities can cross-check their HIPAA policies and procedures against the audit protocols OCR has made available in connection with this audit process. Special attention should be paid to OCR’s articulated areas of interest in privacy, security and breach notification. With only 10 business days to respond to this audit request, whether you need these documents now to respond to an audit letter, or you may need them later to respond to a breach investigation, this is an excellent moment to prepare and shore up compliance.