With only 2 weeks (15 days) left to meet the HIPAA Omnibus Rule, let’s say you
have done everything you could possibly do, to be in full compliance with every
part of HIPAA:
1. Finish a current HIPAA Risk Analysis – CHECK
2. Rewrite Business Associate agreements – CHECK
3. Rewrite Policies & Procedures – CHECK
4. Get PHI off the office copiers – CHECK
5. Gather Documentation in one place – CHECK
6. Start HIPAA Security Awareness Program – CHECK
7. Update HR Sanctions Policies – CHECK
8. Finalize Contingency Plans – CHECK
9. Add more encryption – CHECK
10. Implement Plan for Smartphones & Mobile Devices – CHECK
11. Have staff sign new Affirmation Agreements – CHECK
And in spite of your careful preparation, you walk into work on Monday, and the OCR
regulators are sitting in the Lobby, and they’ve been there since 7:00 AM!
No matter what else you have done, or started, and have not done, your insurance policy is to be
able to pull out your most current (in months, not years) HIPAA Risk Analysis and then pull out all
your supporting documentation including:
1. All information, including network diagrams, on where the PHI is on your network, and the
automated network controls you have implemented.
2. A record of every application, every database, etc. that hold PHI, are used to create,
manage, or share PHI, in both electronic and paper form.
2. Rosters going back 3 years of everyone in the organization who’s taken HIPAA training.
3. A copy of the Policies and Procedures, and Security Plans, printed out and labeled in 3-ring
Binders.
4. List of all HIPAA controls that are currently in place and verification documents.
5. Copies of all Business partners agreements and contracts
6. A notarized statement signed by the Board Director, CEO or Administrator formally
stating the organization’s Commitment to HIPAA Security & Privacy & Omnibus Rules.
7. Copies of recent employee surveys validating their stated compliance with all HIPAA
Security, Privacy, and Omnibus Rules.
All of these elements should be printed in their most current versions and put in D-Ring
binders, which you will pull out of a cabinet designed for high security. Nothing thrills a regulator
or auditor more than getting everything you ask for in a neatly labeled, giant 3-ring binder.
It says “PREPARED” in a way that having files on the network never will.
And, BTW, you HAVE completed all these steps – right?
For More Information, Contact Caroline Hamilton at caroline@riskandsecurityllc.com