* Name:
* Email:
* Phone No.:
* Quiz: 4+6 ?
* Query:
* Mandatory:  

The OCR Audit Process

The Office for Civil Rights has published the audits protocols for Privacy and Security.  For Covered Entities and now Business Associates alike, there is no longer any reason to delay establishing full compliance.  The recently issued Omnibus Rule makes clear that enforcement of HIPAA compliance standards has arrived and will be vigorously pursued.  Penalties and fines will be forthcoming for those that put off establishing compliant operations and the now published Privacy and Security Audit Protocols make equally clear what each entity can expect.

We have taken these protocols and molded them into our collaborative, consultative process.  This ensures that we obtain all the required information but in a manner that is neither painful nor adversarial.  Our goal is to gain the facts and insight through which to tailor changes to your work processes to bring them smoothly into compliant performance.  The result is constructive changes and adjustments where and as needed with minimal disruption.

Our Audit Process

OCR does not need to understand your environment:  they simply need to confirm that you are doing all you are required to do, and fine you if you aren’t.  They have no interest in your operations beyond this determination and result.  Other audit firms are likewise driven.  Neither are concerned with the burden this can create, or whether any efficiencies can be cogenerated along with achieving compliance to offset it.  This is precisely where we are different from all the rest.  We do care.

We understand the escalating costs you face, the mounting bureaucracy of regulations and paperwork, the increased drive to automate and the disruptive change that can cause.  Most firms do not grasp this because they have no direct experience themselves.  We know the challenges you face because we have been there ourselves.  That is why we work with and for you to achieve these goals:  get you compliant and set it up to stay that way by building it into your processes.

Our techniques are the industry-standard, time-proven methods used by all firms:

  • Interview
  • Examination
  • Observation
  • Substantive Testing

We interview your in-house experts to determine their knowledge, awareness, and engagement with the importance of these requirements to gain a sense of the environment.  We share with them our knowledge about the regulations to enhance their knowledge.

We examine your policy and guidance documentation to ensure that the regulatory requirements and properly embodied in them so that you have established the correct framework for performance, internal enforcement, and corrective action when needed.

We observe your staff at work as part of our gaining familiarity with your environment and to ensure that what we found in your documentation we actually find being practiced by your workforce.

We substantively test various parts of your automated systems to ensure that the stated specifications to support privacy and achieve the requirements of the Security Rule are in place and functioning correctly.

Our process verifies that all the requirements are being met regularly and reliably so that your expectations are being met and so that you can be confident by knowing rather than trusting that things are working properly. 

The process is the same for both Covered Entities and Business Associates.  One standard for all appropriate to each operational context means  the Covered Entity can have the needed assurance that their Business Associates are meeting the requirements just as they are, thus have greater peace of mind and greater risk control at all levels.