Q&A: Evaluating your HIPAA compliance program

Q: How should HIM leaders evaluate whether their current privacy risk analysis process would stand up under scrutiny from HHS’ Office for Civil Rights (OCR)?

John F. Howard, senior attorney with Clark Hill in Scottsdale: Look at guidance and tools that OCR has published on the topic, and determine whether your organization’s current process aligns with them.

Then, look at recent enforcement actions and determine if there are any failings of other entities that sound familiar or a little too close to home. These are all great clues.

Of course, making sure to utilize a subject matter expert to align efforts with existing industry frameworks is also a good idea. Just make sure you are not operating in a silo, and be open and aware.

Q: What are key indicators that an organization’s HIPAA compliance program looks good on paper but is weak operationally?

Howard: Every time I have encountered a “paper only” HIPAA compliance program, the biggest red flag was the lack of suspected or actual HIPAA violations being reported to the privacy office by the workforce.

There is never going to be an entity that is perfect and does not have some form of HIPAA violations occurring. Every entity has humans working for it, and no matter how hard we try, humans make mistakes. There can be a lot of different reasons why an ineffective compliance program, no matter how pretty the paper it is written on, fails to identify potential violations and areas where mitigation and remediation need to occur—but, guaranteed, the program with no reports is not operating correctly.

Editor’s note: This Q&A was excerpted from our HIM Briefings newsletter.