The Healthcare Hub

HIPAA Audit: Best Defense is Preparation for Business Associates

Wednesday, June 7, 2017

The threat of security breaches is no small problem in healthcare. Because of the sheer volume and variety of information contained in healthcare systems, the industry is one of the largest targets for thieves, especially for those who want to gain access to valuable protected health information (PHI).

To shield this sensitive health information, the U.S. Department of Health & Human Services (HHS) Office for Civil Rights (OCR) is increasingly assessing compliance with the HIPAA Privacy, Security, and Breach Notification Rules with an audit program. The OCR audits help ensure adherence to data protection regulations, especially as they relate to business associates (BAs), who have access to millions of patient records.

GHX Vice President of Product Management, Chris Luoma provides guidance to organizations on how best to prepare for and navigate a successful OCR audit in this Health Management Technology article.

Chris emphasizes that audit compliance begins with preparation. It requires organizations to know, possess, and verify a significant amount of information quickly, particularly information related to its BAs.

The process of tracking a BA’s compliance with industry procedures is one of the biggest challenges associated with managing BA-generated risks. In the article, Chris shares insight about operationalizing BA policies into procedures -- making it easier to track BA-related tasks as part of the vendor relationship management process. Relying on obsolete manual processes leaves organizations with limited access to information that is often outdated or even unavailable and gathering and documenting the necessary information within the audit’s 10-day timeframe becomes virtually impossible.

With a BA management system that centralizes documentation, organizations can more easily acquire, organize, and maintain important information. A centralized, automated system also helps organizations gain greater insight into the BAs with whom they work. It all comes down to creating effective processes combined with technology solutions that manage vendor information.

Click here for additional resources around vendor and BA management.