Tips from this month’s issue
Conducting a phase two audit self-review (p. 1)
1.Although CE desk audits are complete, BA desk audits and comprehensive on-site audits of both CEs and BAs are coming up. Audited entities will have only a limited amount of time to submit documentation, and those that don’t prepare in advance might miss the deadline.
2.The audit protocols are useful beyond simply checking boxes for auditors. By reviewing the audit protocols, CEs and BAs can match their compliance efforts exactly against OCR’s expectations and rules.
3.Some organizations may put audits and other evaluations aside in favor of competing compliance demands. But as OCR increases enforcement and audit activity, and the number and cost of breaches rises, now is the time to review HIPAA compliance.
4.Conducting a self-review can help a BA identify what documents it is missing before an audit letter arrives. After that letter lands in a BA’s inbox, it’s too late to create missing policies or enforce them.
5.A self-review can usually be conducted by the staff who handle HIPAA compliance as part of their regular duties. Other staff, such as human resources, may need to be pulled in to provide additional documentation.
6.The self-review should look beyond policies and procedures on paper: Auditors will want to know if they’re actually followed, and an unenforced policy won’t be a defense if a breach occurs. Take a look at how policies and procedures are followed and whether they should be updated to reflect the actual working environment.
Staying HIPAA compliant on social media (p. 5)
7.Many people use social media for personal purposes, but it’s also a powerful part of many organizations’ marketing campaigns and is invaluable for professional networking and recruitment.
8.A social media’s security policies and terms of use should be carefully reviewed by the security officer before an organization opens an official account.
9.A social media policy is a must, whether an organization operates official social media profiles or if its staff just use social media for personal reasons. The policy should be specific about when and how staff can access social media sites and who is allowed to access the organization’s official social media profile, if applicable.
10.Social media best practices should be part of basic HIPAA training.
11.Staff should not post anything that contains patient names, pictures, or other identifiable information without explicit, HIPAA-compliant permission from the patient.