How do I do a HIPAA Audit?
Conducting internal HIPAA audits in your place of business helps to assure your establishment is HIPAA compliant. HIPAA, or the Health Insurance Portability and Accountability Act of 1996, was designed to protect consumer's privacy of their health information. The U.S. Department of Health and Human Services' Office for Civil Rights enforces the act and investigates any complaints and potential violations. Conducting an audit of your business will show areas that need improvement or where implementations of new procedures are needed.
Other People Are Reading
Instructions
-
-
1
Research HIPAA by visiting the U.S. Department of Health and Human Services' website where you can read about HIPAA, enforcement of the Act, and download training materials. This will prepare you for what to look for during your audit.
-
2
Read your company's current written policies and procedures on privacy, personal health information such as medical records and HIPAA-related matters. Identify policies that need modification and edit these or create new policies that follow HIPAA regulations.
-
-
3
Review your computer system to audit how personal health information is accessed. Evaluate if this information is password protected and who has access to it. Meet with your information technology leadership to determine if your software is HIPAA compliant and that any exchange of health information is covered under the appropriate business agreements.
-
4
Complete site visits to all of your offices and facilities to assure they are HIPAA compliant. Note where files containing personal health information are kept and investigate sign-in sheets, fax machines, printers and copiers to assure there is no identifying health information exposed.
-
5
Complete random checks around your office to assure files are appropriately locked and only accessible to those with a need for them. Audit employee's desks, offices and stations to assure no personal health information is left in the open.
-
6
Review your company's internal and client's quarterly and annual reports to assure that any personal health information is de-identified and does not contain any identifiable health information.
-
1
