How to Prepare for a HIPAA Audit in 3 Steps

Preparing some documents beforehand will make your HIPAA audit much more pleasant.

Ensuring the privacy and security of patient information is vital in the healthcare industry. Compliance with the Health Insurance Portability and Accountability Act (HIPAA) is not only a legal requirement but also essential in cultivating trust and protecting sensitive data. HIPAA Audits help healthcare organizations maintain security so they don't experience data breaches and the consequences that ensue.

There are a few reasons why your organization may be getting an audit.

• At random: the OCR conducts random audits on organizations to see how healthcare entities are doing with HIPAA compliance
• Complaints: A customer, or even an employee can file a complaint with the HHS, which may lead to an audit.
• Self-reported breach: If you have had a breach, you have a much higher chance of being audited.

In this blog post, we will outline three essential steps to help you effectively prepare for a HIPAA audit.

Map out your PHI flow

To protect PHI, you have to know where it is created, received, transmitted, and maintained in your organization. This is called your scope. To identify your scope, you have to understand how patient data flows within your organization.

Start with the assumption that everything is in scope until you’ve verified otherwise. Verifying that a system is out of scope requires that you confirm proper network segmentation and make sure necessary controls are in place.

There are four main parts to consider when defining your scope:

1. Where PHI is created or enters your organization
2. What happens to it in your systems (processing, storage, etc.)
3. Where PHI leaves your environment
4. Where potential or existing leaks may be

You need to document where PHI is created, how it enters your environment, what happens once PHI enters, and how PHI exits.

Have documentation ready

This is probably one of the most important things to prepare for your audit. Having the proper documentation ready will make your audit go much faster and help you avoid costly penalties.

You’ll want to have the following documents available for your audit:

Workforce member training documents ‍

Your workforce members are among your weakest links in your organization, so you should be devoting more time to training. And this training should all be written down.

Have things like employee manuals and policies ready for your auditors to see how your workforce understands HIPAA. The OCR will audit your workforce members to see if they actually know that information, so make sure your staff members are up-to-date with the information in training materials.

See also: SecurityMetrics HIPAA Guide‍

See also: HIPAA Training Video: Essential Healthcare Compliance Training

‍Security Policies and Procedures‍

Just like your organization needs security policies, you need to have them documented. These may include:

• Incident response policies
• Business continuity policy
• Firewall policies
• Physical security policy
• HIPAA Privacy and Security Rule policies

Not only will these policies help your company handle security efficiently, it will help show auditors how your organization handles security.

‍Risk analysis and Risk management documents ‍

These documents are required by HIPAA. A risk analysis finds potential security risks present in your organization, and a risk management plan addresses how you plan to handle these risks.

Having these documents shows your auditor you’re actually fulfilling the HIPAA requirements, you understand what risks may be present in your organization, and how you’re handling potential security issues.

Once the risk assessment is complete, review and update your organization's policies, procedures, and documentation. Make sure these policies are comprehensive, clear, and easily accessible to all staff members.

See also: 5 Steps to Making a Risk Assessment

Conduct internal audits

Conducting audits within your organization can help you find resolvable problems in your security before your audit. It’s best to do these audits periodically to find new issues that may appear.

Consider the following:

• ‍What vulnerabilities exist in your systems, applications, processes, or people?
• What threats exist that could exploit each of those vulnerabilities?
• What probability does each potential exploit carry?

Consider these categories in particular as you think about your vulnerabilities, threats, and risks:

• Digital (e.g., weak passwords)
• Physical (e.g., not shredding PHI)
• Internal (e.g., employees)
• External (e.g., hackers)
• Environmental (e.g., fires)
• Negligent (e.g., unknowing employee)
• Willful (e.g., disgruntled former employee)

I always advise entities to engage a third party security expert to help with conducting a proper security assessment. A security assessor will have experience in HIPAA (and many other security mandates) and will be able to see your organization from an external view (which is what malicious attackers are doing).

Conclusion

HIPAA audits can be difficult for both the auditors and the organization involved, but taking the proper steps to prepare yourself will help your audit become less of a headache.

Remember, the point of an audit is to help your organization become more secure, protecting you, your workforce members, and ultimately your patients.