What to Do

• Look out for an OCR e-mail
  • Notification letters were sent to covered entities on July 11, 2016
• Ensure that an OCR e-mail is legitimate
• Respond and prepare

HIPAA Audit Resource Center

How We Can Help

• • What to expect and how to prepare for the HIPAA audit program
• Self-assessment toolkit
  • A checklist that covered entities and business associates can use to conduct a preliminary self-assessment (complimentary offering)
• Primer/CLE Presentation
  • Overview of the audit process and steps that can be taken to prepare for it (complimentary offering)
• Hotline/Helpdesk
  • Monthly bank of hours dedicated to counseling on general HIPAA compliance and/or preparation for pending audits (offered at a fixed fee)
• Policy Audit and Gap Analysis
  • Review of your company’s existing policies for HIPAA privacy compliance gaps and suggested steps for improving compliance and mitigating risks (offered at a fixed fee)
• Model Policies and Procedures
  • Suite of HIPAA privacy and security policies, including data breach notification policies, privacy procedures and training materials (offered at a fixed fee)

Ropes & Gray Analysis

• HHS OCR Offers New Materials for Covered Entities to Promote Compliance with the Affordable Care Act’s Nondiscrimination Provisions Now in Effect (September 1, 2016)
• OCR Announces Initiative to Amplify Investigations of Breaches Affecting Fewer than 500 Individuals (September 1, 2016)
• Health Care Attorneys Examine Ransomware Attacks and the HIPAA Breach Notification Rule (August 1, 2016)
• HHS Issues New Guidance on Ransomware (July 19, 2016)
• OCR Launches Phase 2 HIPAA Audits (July 19, 2016)

OCR Resources

• $2.5 million settlement shows that not understanding HIPAA requirements creates risk
• HIPAA settlement demonstrates importance of implementing safeguards for ePHI
• Permitted Uses and Disclosures: Exchange for Public Health Activities Fact Sheet 
• New Guidance on HIPAA and the FTC Act
• OCR’s Phase Two HIPAA Audits Have Begun
• HIPAA Privacy, Security, and Breach Notification Audit Program
• HIPAA Guidance Materials
• Breach Notification Guidance