In this lesson, we'll be covering what an audit by the Office for Civil Rights could entail, ways to help prevent an audit or make one go more smoothly, and why having a Book of Evidence is so vital. At the end of the lesson, we'll stick with our recent looks at HIPAA violations with a Word about criminal penalties for HIPAA violations.
An audit by the Office for Civil Rights requires you to provide the following:
- A copy of your last risk assessment
- A copy of your last risk report
- Your HIPAA compliance training logs
- Your Book of Evidence
Pro Tip #1: When it comes to HIPAA in general, and particularly with audits, it's imperative for all business associates and covered entities to be as proactive (rather than reactive) as possible. What does being proactive look like? Great question!
You can be proactive, first and foremost, by covering all your bases regarding the following:
- Conduct annual risk assessments.
- Conduct annual compliance training.
- Stay current with all of your policies and procedures.
Rely on Your Book of Evidence
As we've stated before, your Book of Evidence is a HIPAA requirement (and not a suggestion). A good Book of Evidence must include, but isn't limited to, the following:
- Your policies and procedures for how to handle PHI and ePHI
- Your business continuity plan
- Your data breach plan
Pro Tip #2: Having your Book of Evidence ready at all times can help an audit process go much more smoothly and hopefully speed things up a bit as well, especially if your Book of Evidence is up-to-date and all of your training records are current.