What You Need To Know

In October, The Health and Human Services Office for Civil Rights (OCR) shared that future health-care privacy and security audits will shift from an educational focus to an enforcement focus. Previously, OCR performed these audits to educate providers on patient privacy and HIPAA. But now, the priority is enforcement. Instead of relying on complaints and breach notifications, the OCR will be more proactive in identifying problem providers. It’s important for all healthcare provider entities to have a HIPAA compliance plan actively in use. (We can help!)

As all health care providers know, the HIPAA Privacy Rule applies to their practice. But because many providers outsource some of their health care activities and/or functions, the HIPAA Privacy Rule also applies to these “business associates".” It is important that providers have assurances in writing that all business associates are appropriately safeguarding patient information and following all HIPAA provisions. The HHS Office for Civil Rights has issued a new fact sheet that lays out all provisions where the business associate would be held directly liable for HIPAA Rule violations.