surviving an ocr/cms audit · recommendation: conduct a mock audit. 17 • using the published ocr...

CONFIDENTIALThis document may not be reproduced, transmitted,

or distributed without the prior permission of SPHER Inc.

Surviving an OCR/CMS AuditLessons Learned in Preparing & Responding

Presented by: Raymond Ribble

CEOSPHER, Inc.

Presented at:

HIPAA Privacy & Security Summit 2019

© 2019 SPHER Inc. 2

Disclosure:

The information presented is not meant to constitute legal advice. Consult a

healthcare attorney for any advice on any specific HIPAA incident.

© 2019 SPHER Inc.

Topics and Objectives

3

1. Introduction to Audit types2. Analyze steps required: OCR HIPAA Audit processes3. Present tips to respond Accurately and Efficiently4. Demonstrate Tools & Techniques to help assess your ability to respond 5. Lessons Learned from past Audits

© 2019 SPHER Inc.© 2019 SPHER Inc.© 2019 SPHER Inc.

Often begins with a Letter

4

The Audit Program, mandated by Section 13411 of the ARRA of 2009, required OCR to periodically evaluate Covered Entities and Business Associates compliance with the HIPAA Privacy and Security Rules.

Note:

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwjAiurF19rhAhVCn-AKHeqeCBcQjRx6BAgBEAU&url=https://www.anesthesiallc.com/publications/blog/entry/anesthesia-practices-may-be-subject-to-the-phase-2-hipaa-audits&psig=AOvVaw2HW-_7QdzN8MjIdgX_Y3Ll&ust=1555711997297325

© 2019 SPHER Inc.

Tightening the Noose

5

Audits are primarily a complianceimprovement activity. OCR will review andanalyze information from the finalreports. The aggregated results of theaudits will enable OCR to betterunderstand compliance efforts withparticular aspects of the HIPAA Rules.

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwio6a2BvdzhAhUnh1QKHYXYAg4QjRx6BAgBEAU&url=/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=&url=https%3A%2F%2Fwww.slideshare.net%2Fehr20%2Foffice-of-inspector-general-study-on-ocrs-hipaa-audit-program&psig=AOvVaw3Q6s4jZ6ScKiiqAuclj2aN&ust=1555710653404059&psig=AOvVaw3Q6s4jZ6ScKiiqAuclj2aN&ust=1555710653404059

© 2019 SPHER Inc.

Audit Types & Approaches

6

OCR DeskAudit

Civil LiabilityAudit

OCR FieldAudit

Audit Checklists

OutsourcedAudit

MockAudit

Audits are based on all HIPAA Rules: i.e. Privacy, Security and Breach Notification

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwirrduJn93hAhUnneAKHfaYC1MQjRx6BAgBEAU&url=https%3A%2F%2Fredeapp.com%2Fwhy-red-e-app%2F&psig=AOvVaw2zHLONYkIWK6iqdzpM15TE&ust=1555800578333023

© 2019 SPHER Inc.

OCR Compliance Audits – Sample Timeframe

7

Notification Letter sent to Covered Entity

Final Audit Report

Covered Entities Review and Comment on Draft Audit

Reports

Draft Audit Report

Onsite fieldwork

Receiving and Reviewing

Documentation and Planning

the Audit Field Work

1 Day

30+ Days

10 Days

30+Days

5 – 10Days

Minimumof 10 Days

Day 1 Day 10 Day 30/90 Dependent on completion of fieldwork

Estimated Elapsed Time

Image credit: Department of Health & Human Services

“HIPAA compliance is not a destination, it’s a journey.”


Random Selection - Desk Audits Past HITECH MU Participation Patient Complaints Class Action Lawsuits HIPAA Violations – Breach Notification Protocol MACRA/MIPS Reporting/Compliance Cyber-Insurance Liability Coverage

OCR Audit - Triggers

© 2019 SPHER Inc.

If it isn’t documented,It didn’t happen!

9

Automated UserMonitoring

Practice:Policies & Procedures

Security RiskAssessment

What? Where? How?

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwix9cqy3uThAhUNZd8KHXY_BF0QjRx6BAgBEAU&url=https%3A%2F%2Fwww.policymedical.com%2Fhow-to-write-effective-policies-and-procedures-manuals%2F&psig=AOvVaw0dGEQOWqsBhM35gw3cdMTs&ust=1556056720611368


https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwjzgLXFtOTiAhVIw1QKHeTABYoQjRx6BAgBEAU&url=%2Furl%3Fsa%3Di%26rct%3Dj%26q%3D%26esrc%3Ds%26source%3Dimages%26cd%3D%26ved%3D2ahUKEwjzgLXFtOTiAhVIw1QKHeTABYoQjRx6BAgBEAU%26url%3Dhttps%253A%252F%252Fwillowheartllc.com%252Fsecurity%26psig%3DAOvVaw1Ak3SFp4wsjlSfjLhDtyKy%26ust%3D1560441476567811&psig=AOvVaw1Ak3SFp4wsjlSfjLhDtyKy&ust=1560441476567811


© 2019 SPHER Inc.© 2019 SPHER Inc.

The Desk AuditCMS/OCR Initiated

© 2019 SPHER Inc.

What gets Examined?

1. Violations of simplest standards/documentation processes2. Can you account for ALL your Business Associates (BA)3. Year-to-Year improvements in processes: Addressing Gaps4. Not planning to “air less than clean white laundry” 5. BA audits will be reviewed on Security Rule and breach response 6. Onsite for both CE & BA7. BA should review CE audit info, it will basically be the same

11


Audit Focus: By the Book

12

Requirements Selected for Desk Audit Review

Privacy Rule

Notice of Privacy Practices & Content Requirements [ 164.520(a)(1)&(b)(1)]

Provision of Notice – Electronic Notice [ 164.520(c)(3)]

Right to Access [164.524a)(1), (b)(1), (b)(2), (c)(2), (c)(3), (c)(4), (d)(1), (d)(3)]

Breach Notification RuleTimeliness of Notification [164.404(b)]

Content of Notification [164.404(c)(1)]

Security RuleSecurity Management Process – Risk Analysis [ 164.308(a)(1)(ii)(A)]

Security Management Process – Risk Analysis [ 164.308(a)(1)(ii)(B)]

© 2019 SPHER Inc.

Desk Auditing Reporting Process

13

After review of submitted documentation:

• Draft findings are shared with the CE

• CE may respond in writing

Final Audit Reports will:

• Describe how the Audit was conducted

• Present any findings, and

• Contain any written CE responses to the draft

Under OCR’s separate, broad authority to open compliance reviews:

OCR could decide to open a separate compliance review in a circumstance where significant threats to the Privacy and Security of PHI are reviewed through the Audit

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwirrduJn93hAhUnneAKHfaYC1MQjRx6BAgBEAU&url=https%3A%2F%2Fredeapp.com%2Fwhy-red-e-app%2F&psig=AOvVaw2zHLONYkIWK6iqdzpM15TE&ust=1555800578333023



© 2019 SPHER Inc.

Contents of a Desk Audit - Drivers

14

✓

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwjzkPnumefhAhViU98KHTjmDDYQjRx6BAgBEAU&url=%2Furl%3Fsa%3Di%26rct%3Dj%26q%3D%26esrc%3Ds%26source%3Dimages%26cd%3D%26ved%3D2ahUKEwjzkPnumefhAhViU98KHTjmDDYQjRx6BAgBEAU%26url%3D%252Furl%253Fsa%253Di%2526rct%253Dj%2526q%253D%2526esrc%253Ds%2526source%253Dimages%2526cd%253D%2526ved%253D%2526url%253Dhttps%25253A%25252F%25252Fwww.complianceonline.com%25252Fresources%25252Fhow-to-prepare-for-hipaa-audits.html%2526psig%253DAOvVaw0G0RhVUNsmU1ZzPulLs4L8%2526ust%253D1556141792495915%26psig%3DAOvVaw0G0RhVUNsmU1ZzPulLs4L8%26ust%3D1556141792495915&psig=AOvVaw0G0RhVUNsmU1ZzPulLs4L8&ust=1556141792495915


Field AuditOCR Auditor On-Site

© 2019 SPHER Inc.

What to have Prepared

16

Security RiskAssessment

DisasterRecovery Plan

Action Plan

Gaps &Vulnerabilities

UserMonitoring

Policies & Procedures

EducationPlan

HIPAA

You will be given a chance to correct any discrepancies

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwidzK283eThAhWBl-AKHdBfCDEQjRx6BAgBEAU&url=https%3A%2F%2Fwww.solutionica.com%2Fservices%2Fwebsite-security-gap-analysis&psig=AOvVaw0QlsceGES7MPR6MS-SHQ6O&ust=1556057839550636

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwiA8rjz3eThAhWsdd8KHUxJBTAQjRx6BAgBEAU&url=https%3A%2F%2Fwww.csrbox.org%2FIndia_CSR_news_CSR-Spend-in-India-in-FY-2017--Rise-in-Actual-CSR-Spend%2C-Mild-Improvement-in-Compliance_70&psig=AOvVaw0slhYNwNdWgCqEX5IlHvID&ust=1556057919357978

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwje9I2J3uThAhUwTd8KHXD-De8QjRx6BAgBEAU&url=http%3A%2F%2Fwww.cloudoye.co.uk%2Fbackup-disaster-recovery&psig=AOvVaw2jv_OZ4KKscqPuGACfPu6q&ust=1556058035129133



https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwjl39XW5eThAhVJKKwKHQSOC5oQjRx6BAgBEAU&url=https%3A%2F%2Fwww.iconfinder.com%2Ficons%2F1209527%2Faccountable_attainments_biography_candidate_case_cources_criteria_curriculum_debrief_education_examine_individual_patient_performance_management_personal_plan_position_profiling_program_responsibility_routine_skills_survey_syllabus_tasks_vacancy_icon&psig=AOvVaw2mxQmLWhiWwKlXkl0Wwv20&ust=1556060078490589





© 2019 SPHER Inc.

Recommendation: Conduct a Mock Audit

17

• Using the published OCR Audit Protocol, conduct an internal, or solicit and external, Mock Audit

• Prepare an Audit Response Team• Follow the same process steps as OCR• Use a local or secure cloud-based portal to submit documents to a review

panel• Follow the 2016 Desk Audit Guide as your document request criteria:

https://www.hhs.gov/sites/default/files/2016HIPAADeskAudituditeeGuidance.pdf • Conduct and critique in-person interviews• Use activity scanning tools to assess ePHI vulnerabilities• Update mitigation pathways for HIPAA Risk Analysis


1. Prove you’ve set HIPAA Policy and Procedure Boundaries2. Focus on PHI/ePHI3. Conduct: Security Risk Assessment (SRA)4. Develop an Incident Response Plan5. Know Your Users (Employees and BAs)6. Identify High-Risk Assets (Technical and Non-Tech)7. Don’t skimp on Business Associate Agreements8. Implement Ongoing Training/Education

Best Practices to Prepare for an OCR HIPAA Audit

https://www.google.com/url?sa=i&rct=j&q=&esrc=s&source=images&cd=&ved=2ahUKEwj659HAot3hAhUDSN8KHf0cCJ8QjRx6BAgBEAU&url=https%3A%2F%2Fwww.dvphilippines.com%2Fblog%2Funderstanding-audits-the-four-types-of-audit-reports&psig=AOvVaw3V2QvrvwKPkxJlKEvuU7a1&ust=1555801497005764


Civil Liability AuditLawsuit Procedures

© 2019 SPHER Inc.

Civil Liability Audit Prompts

20

• Think: Patient Instigated Investigation• Ex: Delaware Online Privacy and Protection Act 2016• Ex: California Consumer Privacy Act – 2018

• Know what personal data is being collected about them.• Know whether their personal data is sold or disclosed and to whom.• Say NO to the sale of personal data.• Access their personal data

• Many States to follow: 17 States currently• Request for Information – Response required within 15 days

© 2019 SPHER Inc.

Audit: Findings to Date

21

• Lack of Business Associate Agreements• Incomplete or Inaccurate Security Risk Analysis• Not performing an organization-wide risk analysis• Lack of Transmission Security - No encrypting PHI on devices• No Patching of Software• Third-party disclosure of PHI• Improper disposal of PHI• Employees disclosing information• Employees illegally accessing patient files• Lost or stolen devices• Lack of training – No Incident Response Plan

Settlements leave money to allow you to fix things…

© 2019 SPHER Inc.

BECAUSE PRIVACY MATTERS

SPHER™ provides a scalable, SaaS-based compliance and risk management tool that utilizes AI technology to monitor 100% of daily user activity to detect

potential breaches of sensitive patient protected health records.

Audit Alert Manage

22

[email protected]

http://www.spherinc.com/


The Solution: PHI Cybersecurity Simplified

23

SPHER™ provides a scalable, SaaS-based compliance and risk management tool that utilizes AI technology to monitor 100% of daily user activity to detect potential breaches of sensitive patient health records.

© 2019 SPHER Inc.

Case Study: Surviving an OCR Audit

24

OCR initiated audits specific to User Access & System Monitoring Fault. Major HIPAA fines and penalties avoided via SPHER rollout across all MSO Covered Entities.

• SPHER™ + • Security Risk Assessment• Harris CareTracker ™• Internal P&S Training• Ongoing Education

• SPHER Monitors:• 60+ Clinics, • 1200+employees• 120+ physicians

• Now monitors 100% of all daily ePHI activities

• 17+ Subsequent follow-up audits. Clean bill of health across all businesses

• SPHER was the key component of the Argus privacy & securityprocedures overhaul

• Instilled a Culture of Compliance

• CEO and CISO provide references for SPHER

$1.7M in OCR fines avoided


Thank You!&

Stay SecureFor more information:

[email protected]/in/Raymond-F-Ribble

Tel: (310) 602-5140 x5513www.spherinc.com

surviving an ocr/cms audit · recommendation: conduct a mock audit. 17 • using the published ocr...

Documents