Getting Started on Developing a Culture of Compliance: Self-Audits

        I think a HIPAA privacy refresher course -- even though the rule has been in effect for 8 years -- is probably pretty wise, and it’s a good catapult to getting ready for the new and enhanced privacy regulations through HITECH. -- Tennant

One method for ensuring your covered entity is in compliance is to regularly review your HIPAA compliance program. Conducting a self-audit of policies and procedures can help covered entities identify what may have changed in their organization since they were implemented and what steps may need to be taken to adapt to those changes. For example, perhaps your practice or staff has new employees who need training on HIPAA obligations.

         I kept everything relating to training on HIPAA privacy. If anyone ever came in and asked: 'What did you train on?,' I could supply the fact sheets and the date when they went out: 'These are the employees who had targeted privacy training; based on their jobs, these are the policies that applied to them; this is what the training was, and when it was delivered to them. ' If policies are updated, or if there was a significant change, staff would be retrained and we would document that.

You don’t want to inundate people with emails, but we do a quarterly newsletter -- sometimes a tip of the month. As policies are updated or changed, we also target a specific group that may be affected, like business associates, so we don’t affect our entire workforce. --Diana Warner, Director of Professional Practice at the American Health Information Management Association (AHIMA) and a former privacy officer for a large physician practice

Look around your office. What has changed since you last developed your HIPAA training program and modified your policies and procedures? Have you purchased new equipment or software, such as an electronic health record? How do you go about applying physical and technical safeguarding to protected health information? Have you thought about all of the places where protected health information resides in your office, such as in your digital copiers and fax machines?

In assessing your organization's current compliance status and steps that need to be taken, a simple self-audit may include examining:

• Policies and Procedures: Identify current policies and operating procedures addressing Privacy Rule requirements, including medical record creation, maintenance, storage, moving, retrieval, release, and destruction, encryption, or both. Use version control and date any necessary revisions to your policies and procedures.
• Training: Review your training program and documentation of when your employees took training on the Privacy Rule requirements and your policies and procedures. Review for any updates that should have taken place.
• Tracking the Flow of Protected Health Information: Interview leadership and staff regarding your organization's practices related to the handling of protected health information, both internally and externally (uses and disclosures), such as medical management, billing, and patient accounts.
• Patients’ Rights: Review your organization’s policies and procedures, as well as tracking mechanisms for the release of information for purposes not related to health care and patients’ receipt of your notice of privacy practices. Review a representative sampling of your organization’s policies and procedures, as well as tracking mechanisms.
• Business Associate Agreements: Determine the number and types of BAAs with vendors and provider or managed care contracts or both, and any other contracts your organization has with persons or entities handling protected health information. Review a sample of signed BAAs on file to see whether they are up to date.
• Other Potential Business Associates: Review and discuss the status of other entities that your organization may be involved with, but with which you do not currently have a BAA, to determine the necessity of entering into contracts with such entities.
• Research (if relevant): For each of your research programs/departments, review IRB policies, procedures, and practices related to use and disclosure of health information, and review current forms used in such research.