Tuscaloosa Medical Center has just been notified via letter that they have been selected for a security audit by the OCR. This review is not due to a compliant but rather a random review. The letter states that they will receive additional information and instructions within the next month. Tuscaloosa Medical Center is a 400-bed hospital with a wide range of services. They frantically begin reviewing their security plan and all of the actions they have taken over the past few years as they wait for the additional information.
- Identify actions that the medical center should review as they prepare for the audit.
- Describe the audit process they should expect.
Full Answer Section
This situation at Tuscaloosa Medical Center is understandable. A random OCR (Office for Civil Rights) audit regarding HIPAA Security Rule compliance can be a significant undertaking. Here's a breakdown of the actions they should review and the audit process they can likely expect:
1. Actions Tuscaloosa Medical Center Should Review in Preparation for the Audit:
The medical center should conduct a thorough internal review of its HIPAA Security Rule compliance efforts. This should include, but not be limited to, the following actions:
-
Review and Update the Security Plan: This is the cornerstone of HIPAA security. They should ensure their Security Plan is current, comprehensive, and reflects their current environment and risks. Key elements to review include:
Sample Answer
This situation at Tuscaloosa Medical Center is understandable. A random OCR (Office for Civil Rights) audit regarding HIPAA Security Rule compliance can be a significant undertaking. Here's a breakdown of the actions they should review and the audit process they can likely expect:
1. Actions Tuscaloosa Medical Center Should Review in Preparation for the Audit:
The medical center should conduct a thorough internal review of its HIPAA Security Rule compliance efforts. This should include, but not be limited to, the following actions:
-
Review and Update the Security Plan: This is the cornerstone of HIPAA security. They should ensure their Security Plan is current, comprehensive, and reflects their current environment and risks. Key elements to review include:
- Risk Analysis and Management: Verify that they have conducted thorough and recent risk analyses to identify potential threats and vulnerabilities to Electronic Protected Health Information (ePHI).