{"id":4609,"date":"2015-10-01T01:43:00","date_gmt":"2015-10-01T01:43:00","guid":{"rendered":"https:\/\/www.healthlawpolicymatters.com\/?p=4609"},"modified":"2021-11-03T01:43:32","modified_gmt":"2021-11-03T01:43:32","slug":"just-in-time-for-the-phase-ii-audits-oig-criticizes-ocrs-enforcement-efforts","status":"publish","type":"post","link":"https:\/\/www.healthlawpolicymatters.com\/2015\/10\/01\/just-in-time-for-the-phase-ii-audits-oig-criticizes-ocrs-enforcement-efforts\/","title":{"rendered":"Just in Time for the Phase II Audits: OIG Criticizes OCR\u2019s Enforcement Efforts"},"content":{"rendered":"\n<p>As HIPAA-regulated entities anxiously await the commencement of the Phase II HIPAA audit program, the Office of the Inspector General (OIG) for the Department of Health and Human Services (HHS) has issued a report critical of the Office for Civil Rights\u2019 (OCR) HIPAA enforcement performance, effectively giving OCR \u201csomething to prove.\u201d<\/p>\n\n\n\n<p>The\u00a0<a href=\"http:\/\/oig.hhs.gov\/oei\/reports\/oei-09-10-00510.pdf\">report<\/a>, released on September 28, 2015,\u00a0examines whether OCR \u2014 the office within HHS charged with\u00a0enforcing\u00a0HIPAA \u2014 is sufficiently exercising its oversight\u00a0responsibilities. The OIG specifically focused on whether OCR is\u00a0sufficiently overseeing covered entities\u2019 compliance with HIPAA\u2019s Privacy Rule. \u00a0The OIG found a number of areas where OCR\u2019s oversight is\u00a0lacking.<\/p>\n\n\n\n<p>To reach its conclusion, the OIG examined&nbsp;statistical samples of privacy cases investigated by OCR, as well as surveys of OCR staff and interviews with OCR officials. After examining this data, the OIG reached the following conclusions:<\/p>\n\n\n\n<ul><li>OCR\u2019s oversight is primarily reactive, with OCR investigating&nbsp;possible noncompliance primarily in response to complaints.<\/li><li>OCR has not fully implemented the required audit program to proactively assess possible noncompliance from covered entities.<\/li><li>In 24 percent of cases where OCR requested corrective action, it subsequently failed to obtain&nbsp;complete documentation of corrective actions taken by the covered entities.<\/li><li>Some OCR staff rarely or never checked to see whether a covered entity had been previously investigated. The OIG found that the staff\u2019s failure to check for previous investigations may be due to the limited functionality of its case tracking system.<\/li><\/ul>\n\n\n\n<p>The OIG\u2019s report also sheds light on Privacy Rule compliance within the Medicare Part B provider community.&nbsp;According to the OIG\u2019s findings, over a quarter of Part B providers did not address all of the applicable Privacy Rule standards, and may therefore be failing to adequately safeguard protected health information. &nbsp;The OIG\u2019s findings are summarized below:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"alignleft\"><a href=\"https:\/\/web.archive.org\/web\/20171020143228\/https:\/\/www.healthlawpolicymatters.com\/wp-content\/uploads\/sites\/8\/2015\/09\/OIG_findings11.jpg\"><img decoding=\"async\" src=\"https:\/\/web.archive.org\/web\/20171020143228im_\/https:\/\/www.healthlawpolicymatters.com\/wp-content\/uploads\/sites\/8\/2015\/09\/OIG_findings11.jpg\" alt=\"OIG_findings\" class=\"wp-image-7360\"\/><\/a><\/figure><\/div>\n\n\n\n<p>Based on its findings, the OIG&nbsp;recommended that the&nbsp;OCR should:<\/p>\n\n\n\n<ul><li>Fully implement a permanent audit program;<\/li><li>Maintain complete documentation of corrective action;<\/li><li>Develop an efficient method in its case-tracking system to search for and track covered entities;<\/li><li>Develop a policy requiring OCR staff to check whether covered entities have been previously investigated; and<\/li><li>Continue to expand outreach and education efforts to covered entities.<\/li><\/ul>\n\n\n\n<p>OCR concurred with all five recommendations and described its activities to address them.<\/p>\n\n\n\n<p>The OIG\u2019s report comes amidst the impending start of OCR\u2019s Phase II audit program. Whether the OIG\u2019s report will impact how OCR conducts\u00a0its Phase 2 audits, if at all, remains to be seen. However, it is not inconceivable that OCR could feel pressured to more aggressively investigate potential Privacy Rule noncompliance, and covered entities would be well-served to ensure that they are ready to respond to\u00a0such audits. To assist covered entities in their response, we have made available a webinar entitled \u201cThe First Rule of How to Survive a HIPAA Audit: Be Prepared\u201d which can be viewed\u00a0<a href=\"http:\/\/www.mintz.com\/news-events\/events\/view\/event\/itemid\/1870\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>As HIPAA-regulated entities anxiously await the commencement of the Phase II HIPAA audit program, the Office of the Inspector General (OIG) for the Department of Health and Human Services (HHS) has issued a report critical of the Office for Civil Rights\u2019 (OCR) HIPAA enforcement performance, effectively giving OCR \u201csomething to prove.\u201d The\u00a0report, released on September &#8230; <a title=\"Just in Time for the Phase II Audits: OIG Criticizes OCR\u2019s Enforcement Efforts\" class=\"read-more\" href=\"https:\/\/www.healthlawpolicymatters.com\/2015\/10\/01\/just-in-time-for-the-phase-ii-audits-oig-criticizes-ocrs-enforcement-efforts\/\" aria-label=\"More on Just in Time for the Phase II Audits: OIG Criticizes OCR\u2019s Enforcement Efforts\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_generate-full-width-content":"","footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4609"}],"collection":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/comments?post=4609"}],"version-history":[{"count":2,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4609\/revisions"}],"predecessor-version":[{"id":4611,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4609\/revisions\/4611"}],"wp:attachment":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/media?parent=4609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/categories?post=4609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/tags?post=4609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}