As you may know, the Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH) requires that the U.S. Department of Health and Human Services (HHS) conduct periodic audits of covered entities and business associates to assess compliance with the HIPAA rules. Phase 2 audits were completed in 2016 and 2017.

On December 17, 2020, the HHS Office for Civil Rights (OCR) published its Industry Report with the results of the Phase 2 audits. Of the 166 covered entities and 41 business associates audited in this Phase, 150 were health care providers. Skilled nursing facilities and “elder care facilities” represented 3% of the providers audited on the selected provisions of the Privacy and Breach Notification Rules, or the Security Rule provisions.

The OCR summarized the audit findings, categorized generally as achievements and weaknesses as follows:

The full 2016-2017 Industry Report may be accessed here: https://www.hhs.gov/sites/default/files/hipaa-audits-industry-report.pdf

Providers should take note of the findings published in this Report to conduct self-assessments of compliance with the HIPAA rules. OCR intends to continue its HIPAA enforcement initiatives and stresses that health care entities need to “get serious about identifying security risks to health information in their custody and fulfilling their duty to provide patients with timely and reasonable, cost-based access to their medical records.”

Should you need assistance modifying or improving your HIPAA policies and procedures please do not hesitate to contact a member of our Post-Acute Care practice.

Authored By: Kally Goodwin-Ratzloff and John Paul Hessburg

Any information included here or through our web site is presented solely for general informational purposes and is not in any way intended as legal advice, is not a substitute for getting actual legal advice from an attorney, and should not be acted upon as legal advice without first seeking qualified professional counsel specific to your needs and situation. Additionally, by providing this general information and the information on our web site, no attorney client relationship is created.

The Office of Civil Rights Published the HIPAA Audit Industry Report

Key Contacts

Related Services