[{"innerBlocks":[],"name":"core\/freeform","postId":126582,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"The HIPAA spotlight is beginning to shine brightly on business associates. Covered entities have long had their time to star, so it is only fair to share the stage now. It is likely that covered entities are only too happy to have the Office for Civil Rights and others focus attention on business associates, with all the consequences that come with such attention.

A potentially non-punitive form of attention are the soon to begin desk audits of business associates. Recent statements from individuals in OCR, including Deputy Director for Health Information Privacy Deven McGraw, say that the desk audits are to begin this month. Unlike covered entities who received emails confirming information first, business associates will be thrown right into the response fire.

As many will recall, entities only received up to 14 days to submit response information to the desk audits. This means that business associates must be ready to roll now and cannot afford to play catch up if an audit notice is sent. One small sliver of comfort is that only 40 to 50 business associates will be audited (for now), although it is nearly impossible to know how extensive OCR\u2019s database of business associates really is and just who is in that database.

The first round of business associate audits will hopefully provide some level of insight into the compliance preparedness of business associates. Such insight is dependent upon OCR publishing results from the audits. No public, or easily findable public, statement has been made as to when or if results will be published. Even though there are no apparent statements on that front, OCR\u2019s recent history of pushing out compliance guidance bodes well in favor of getting such information.

The second action directed at business associates is another non-compliance settlement resulting from a breach. The target, this time, was Care New England Health System (CNE). CNE is the parent company to a number of hospitals in Massachusetts and Rhode Island. As the parent, CNE provides centralized support services, whereby CNE received or accessed protected health information of its subsidiaries. The setup is nothing out of the ordinary.

The aspect that cost CNE $400,000 was that the business associate agreement with each subsidiary was executed in 2005 and then not updated until the middle of OCR\u2019s investigation in 2015. Remember, the Omnibus Rule required updates (for the most past) as of September 2013.

Disregard for updated compliance requirements will not be tolerated. The CNE settlement is only the most recent example. As has been stated many times before, each OCR settlement is used to emphasize a particular point under HIPAA. The CNE lesson is this: do not put an agreement into place and then forget about it, to never be touched again. That is a sure road to a fine at some point.

Given the second business associate-related settlement and very near audits, how comfortable do business associates feel with compliance efforts? For a long time, compliance was not necessarily a significant concern for business associates. Such a situation cannot continue. Now is the time to evaluate, update and do what needs to be done.","saveContent":"The HIPAA spotlight is beginning to shine brightly on business associates. Covered entities have long had their time to star, so it is only fair to share the stage now. It is likely that covered entities are only too happy to have the Office for Civil Rights and others focus attention on business associates, with all the consequences that come with such attention.

A potentially non-punitive form of attention are the soon to begin desk audits of business associates. Recent statements from individuals in OCR, including Deputy Director for Health Information Privacy Deven McGraw, say that the desk audits are to begin this month. Unlike covered entities who received emails confirming information first, business associates will be thrown right into the response fire.

As many will recall, entities only received up to 14 days to submit response information to the desk audits. This means that business associates must be ready to roll now and cannot afford to play catch up if an audit notice is sent. One small sliver of comfort is that only 40 to 50 business associates will be audited (for now), although it is nearly impossible to know how extensive OCR\u2019s database of business associates really is and just who is in that database.

Why OCR is turning up the heat on business associates

More for you