Skip to Main Content

HIPAA Phase 2 Audits Are Here. Are You Ready?

Social Logo Social Logo Social Logo

These audits seek to enhance industry awareness of HIPAA compliance obligations and the information obtained will be used to develop OCR’s permanent audit program. All Covered Entities and Business Associates are eligible to be audited.

Employer-sponsored plans providing health care benefits are generally considered to be Covered Entities, and this may include arrangements such as health care flexible spending accounts. Some employers with insured health care plans may be successful in taking a “hands off” policy as part of a strategy for avoiding the need to take the many steps necessary to satisfy the rules. But others with insured health care plans, and employers with self-insured plans (unless self-administered and with fewer than 50  participants), need to take the steps necessary to ascertain that the Covered Entity, its Business Associates, their subcontractors, and the employer are complying with the applicable rules.  In essence, they need a HIPAA compliance program.

OCR has assessed some substantial penalties against a number of organizations, including non-profit organizations. While we have not yet seen penalties assessed with respect to employer-sponsored health care plans, that does not mean these arrangements are immune from audit or investigation. Further, in the event of a privacy or data security incident, the response team needs to have in place and be ready to execute its incident response plan. No one wants to experience the consequences with failing to properly investigate a privacy or security incident that turns out to be a breach.

Categories: Cybersecurity – EB/ERISA, Health Care
Perspectives on employee benefits, executive compensation and ERISA litigation to help you attract and retain talent.
Libation Law Blog
Alcoholic beverage and cannabis regulatory and legal updates.
lingua negoti
The language of business.
Ohio Environmental
Insights and commentary for the business and legal community.