Phase 2 HIPAA audits delayed due to slow web portal development

Posted: Oct 07, 2014
Share This:

A spokesperson for the U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) has announced that OCR has not only postponed the start of phase 2 of its HIPAA Audit Program, but also changed its plans.

The Phase two HIPAA audits by the OCR are part of the department’s resolute focus on continually monitoring compliance with the health information privacy and security program. In our recent post What to expect from Phase 2 HIPAA audits‘ we outlined key changes following the 2012 audits, in which it was revealed Business Associates (BAs) would have greater accountability.

OCR originally announced that phase 2 audits would take place in fall 2014, with both Covered Entities (CEs) and BAs qualifying for audits. The audits were set to primarily focus on:

  • Privacy rule – Notice of privacy practices and access rights.
  • Security rule – Risk analysis and risk management.
  • Breach notification rule – Content and timeliness of breach notification.

In recent weeks, OCR has revealed that in addition to delaying the start of phase 2, there will also be fewer desk audits and more extensive on-site audits.

The reason? The development of a new web portal.

The pre-audit survey has been delayed until entities can submit information to the OCR through a new web portal. The spokesperson couldn’t reveal when the surveys would take place or when phase 2 would officially begin, but urged entities to remain patient.

It is expected that, once made available, the portal will help to streamline the pre-audit survey process. The tool will collect and collate audit information, consequently helping to save OCR time when analyzing the data.

While the start of the phase 2 audits has been delayed, it is expected that once the new web portal is in place, the more efficient process will enable OCR to conduct additional on-site audits. In the near future, CEs and BAs can expect to receive the pre-screening survey to determine eligibility.

It is essential that all CEs fully prepare for the possibility of a pre-screening survey, in particular OCR advises that contact information and the services provided by any business associates is readily available.