You Need These Things When You Get HIPAA Audited!

Now Available:

Featured Resources:

I get a bit irritated when I see a vendor touting their "compliance solution" products as making organizations "HIPAA Compliant" or "PCI DSS Compliant" or whatever your regulation of choice happens to be, and then, upon inspection of their products, see that they are just taking something they already had, slapping some marketing language into the description, picking a few of the regulatory requirements that their product may do (fully or partially) and then calling it a "compliance solution."

Organizations need to understand that the regulatory oversight agencies typically communicate exactly what they will be looking for when they do a compliance audit. Look at those agency guidance documents before you invest huge amounts of money into some proclaimed compliance product.

For instance, consider HIPAA; the US Department of Health and Human Services (HHS) has provided an abundance of compliance information through the Centers for Medicare and Medicaid Services (CMS) and Office of Civil Rights (OCR) sites.

And even though the OCR is now responsible for both HIPAA Privacy Rule and Security Rule compliance, the guidance on the CMS site is still relevant and important to follow.

In fact, the following documents should be required reading for any HIPAA Covered Entity (CE) or Business Associate (BA)...

HIPAA Compliance Review Summary [PDF, 203 KB]: Provides summary of findings for Security Rule compliance audits. Quite revealing...learn from it!
Compliance Review Examples Covered Health Care Providers [PDF, 70KB]: These are great case studies to use for training...use them!
Information Request For Onsite Compliance Reviews [PDF, 43KB]: List of documents and other items you will be asked to provide to HIPAA oversight auditors...have them ready!

Considering the significant expansion of HIPAA responsibilities that resulted from the HITECH Act, the numbers of BAs has multiplied by several times the number of organizations who should be reading these valuable guidance documents!

Categories

Rebecca Herold's Bio:

Rebecca Herold, CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for the past two decades. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the world's best privacy experts and on their list of the best privacy consulting firms in both 2007 and 2008. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 13th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.

Now Available:

Featured Resources:

Realtime Communities

Newsletter

Monthly Archives

RSS

Ask the Expert