A March 2 article in Bloomberg BNAs Privacy Law Watch and other publications, Privacy and Security Audits May Be Moving From Education to Enforcement, reported that the Department of Health and Human Services Office for Civil Rights (OCRs) ongoing HIPAA privacy and security audits may be shifting focus from provider education to enforcement. All healthcare providers and business associates, not only OCR audit subjects, must ensure that their compliance and operational teams are working together to detect vulnerabilities. Day Pitneys Eric Fader was quoted in the article.
While OCRs official statements have consistently referred to the HIPAA audits as being primarily educational, for OCR to determine the industrys overall level of compliance and identify problem areas, Eric has long stated his belief that if in the course of an audit OCR discovers an egregious violation, the audit will be swiftly converted into an enforcement action. He told Bloomberg BNA, If and when the phase two desk audits results reveal other types of problems that OCR hasnt yet considered, were likely to see those problems highlighted in settlements, perhaps with some sort of guidance published by the OCR either previously or concurrently.
Eric predicted that the increased number and size of HIPAA settlements that we saw throughout 2016 will continue through 2017, and that it would not be surprising to see OCR increase cooperation with other agencies, like the U.S. Food and Drug Administration and the Federal Trade Commission, to expand the breadth of HIPAA enforcement and education.
Eric also noted that Deven McGraw, OCRs Deputy Director for Health Information Privacy, recently acknowledged that the onsite audit portion of the Phase 2 audits wont begin until the end of 2017 at the earliest, and may even “slip into 2018. McGraw stated that OCR would like to review the results of the desk audit portion of Phase 2, and also obtain input from new HHS Secretary Tom Price, before starting the onsite audits.