Source: https://clearwatercompliance.com/hipaa-compliance-guides/hipaa-audit-tips-sample-notification-of-findings-and-recommendations-form-from-ocr-hipaa-audits/
Timestamp: 2017-06-22 18:36:54
Document Index: 123896813

Matched Legal Cases: ['art 16', 'art 5', 'art 4', 'art 3', 'art 5', 'art 4', 'art 3', 'art 2']

HIPAA Audit Tips – Sample Notification of Findings and Recommendations Form from OCR HIPAA Audits | Clearwater Compliance
HIPAA Audit Tips – Sample Notification of Findings and Recommendations Form from OCR HIPAA AuditsHome/Blog, HIPAA Audit Tips, HIPAA Compliance Guides/HIPAA Audit Tips – Sample Notification of Findings and Recommendations Form from OCR HIPAA Audits	HIPAA Audit Tips – Sample Notification of Findings and Recommendations Form from OCR HIPAA Audits
This entry is part 16 of 27 in the series HIPAA Audit TipsIn a single sentence in The HITECH Act at section 13411, the stature requires HHS perform periodic audits of covered entity and business associate with respect to compliance with the HIPAA Privacy and Security Rules and the related Breach Notification Rule (altogether, “the Rules”). The first 115 audits will be complete by the end of 2012. Here’s today’s big tip – Learn about the form used to receive management comments on findings and recommendations!
Sample Notification of Findings and Recommendations Form from OCR HIPAA Audits
The exact language in Section 13411 of The HITECH Act is:
When conducting the OCR HIPAA Audits, the auditors use the detailed OCR Audit Protocol which includes 78 HIPAA Security Key Audit Activities, 81 HIPAA Privacy Key Audit Activities and 10 HITECH Breach Notification Key Audit Activities. These audit activities fall under various Performance Criteria which are often simply a restatement of the relevant Standard or Implementation Specification in the regulation or more often a “copy/paste” of that Standard or Implementation Specification.
Findings from OCR HIPAA Audits
Findings take the form outlined in this example below:
Condition: XYZ Hospital has not performed a risk assessment to identify risk and Vulnerabilities to the confidentiality, integrity, and availability of ePHI.
Criteria: 164.308(a)(1)(ii)(A) – Conduct an accurate and thorough assessment of the Potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.
Cause: XYZ Hospital failed to ever complete a comprehensive HIPAA Security Risk Analysis. The Risk Analysis reviewed only include XYZ’s recently installed EHR system and do not include all other information assets that create, receive, maintain or transmit ePHI.
Effect: The lack of a formal risk comprehensive assessment process increases the potential that vulnerabilities and risks to ePHI data are not identified and mitigated. Further, an increased risk may exist such that the physical and logical locations of ePHI, and mechanisms used to protect and monitor ePHI are not completely identified and established.
Recommendation: XYZ Hospital should conduct periodic risk assessments in accordance with 164.308(a)(1)(ii)(A).
Management’s Opportunity to Comment on Findings from OCR HIPAA Audits
Organizations being audited are presented with a detailed listing of all deficiencies found with details as outlined above: Condition, Criteria, Cause, Effect and Recommendation. Upon receipt of the initial report, management must indicate a response by providing the appropriate supporting documentation within ten (10) business days from the date of this notification and indicating one of these three choices:
Management concurs with this finding.
Management does not concur with this finding.
Management partially concurs with this finding.
The form used to make comments as part of the OCR HIPAA Audits may be found here.
Subscribing to our eNewsletter:http://clearwaterc.wpengine.com/resources/newsletters/
Series Navigation<< HIPAA Audit Tips – Do a Privacy Assessment!HIPAA Audit Tips – Notification of Findings and Recommendations (NFR) Report >>
About Latest Posts Bob ChaputCEO at Clearwater ComplianceBob Chaput is widely recognized for his extensive and in-depth knowledge of healthcare compliance and cyber risk management, and is one of the industry’s leading authorities in healthcare information security today. As a leading authority safeguarding health data, Chaput has supported hundreds of hospitals and health systems to successfully manage healthcare’s evolving cybersecurity threats and ensure patient safety. Latest posts by Bob Chaput (see all)	HIPAA Risk Analysis Tip – Part 5 – Questions & Answers from May 3rd Conversation with Former OCR Director Leon Rodriguez - June 5, 2017	HIPAA Risk Analysis Tip – Part 4 – Questions & Answers from May 3rd Conversation with Former OCR Director Leon Rodriguez - May 29, 2017	HIPAA Risk Analysis Tip – Part 3 – Questions & Answers from May 3rd Conversation with Former OCR Director Leon Rodriguez - May 21, 2017	By Bob Chaput|2015-09-03T14:33:40+00:00November 24th, 2012|Blog, HIPAA Audit Tips, HIPAA Compliance Guides|0 Comments	About the Author: Bob Chaput	Bob Chaput is widely recognized for his extensive and in-depth knowledge of healthcare compliance and cyber risk management, and is one of the industry’s leading authorities in healthcare information security today. As a leading authority safeguarding health data, Chaput has supported hundreds of hospitals and health systems to successfully manage healthcare’s evolving cybersecurity threats and ensure patient safety.	Related PostsPermalinkGalleryHIPAA Risk Analysis Tip – Part 5 – Questions & Answers from May 3rd Conversation with Former OCR Director Leon RodriguezJune 5th, 2017|0 CommentsPermalinkGalleryHIPAA Risk Analysis Tip – Part 4 – Questions & Answers from May 3rd Conversation with Former OCR Director Leon RodriguezMay 29th, 2017|0 CommentsPermalinkGalleryHIPAA Risk Analysis Tip – Part 3 – Questions & Answers from May 3rd Conversation with Former OCR Director Leon RodriguezMay 21st, 2017|0 CommentsPermalinkGalleryHIPAA Risk Analysis Tip – #WannaStopCryingMay 17th, 2017|0 CommentsPermalinkGalleryHIPAA Risk Analysis Tip – Part 2 – Questions & Answers from May 3rd Conversation with Former OCR Director Leon RodriguezMay 14th, 2017|0 Comments	Leave A Comment Cancel reply	Stay Up-To-Date On Clearwater & Industry News | Subscribe to the Clearwater Newsletter	Testimonials	The Clearwater Compliance website has been a critical source of information for my HIPAA compliance efforts over many years. The information format is easy to read and understand, and it gets to the point. Clearwater Compliance obviously cares about helping us keep out of trouble!Tim Moser, Shawnee Township Fire Department