Health Information Management

Address inadequate HIPAA Security Rule-required policies and procedures

HIM Connection, November 30, 2010

Want to receive articles like this one in your inbox? Subscribe to HIM Connection!

CMS detailed seven shortcomings, including old and inadequate policies and procedures, found in its 2009 audits of healthcare organizations to determine compliance with the HIPAA Security Rule. CMS detailed the findings in its 2009 HIPAA Compliance Review Analysis and Summary of Results report.

CMS conducted reviews of five HIPAA covered entities (CE) during 2009. In the past, CMS initiated reviews based on complaints filed, identification of potential Security Rule violations through the media, or recommendations from the Office for Civil Rights. This was the first time CMS reviewed CEs that had not been the subject of any complaints.
 
In the report CMS recommended solutions to help CEs increase compliance, including:
  • Develop and formally document a policy and procedures requiring that management periodically review policies and procedures. This policy should outline the maximum time frame between reviews and require management review when systems or the environment change significantly. One of a CE’s designated HIPAA security officers must be a permanent member of the team that develops policies and procedures. Procedures should allow management to conduct reviews in a timely manner that complies with documented policy. If possible, CEs should standardize this process for all departments or groups responsible for maintaining policies and procedures.
  • Develop a standard format for documenting policies and procedures. This format should accommodate multiple types of documents but should maintain information about document revisions, including all revision dates, the individual who revised the document, the date of the most recent approval of the document, and the individual who approved it.
  • Conduct periodic evaluations, either internally or through a third party, to assess the effectiveness of policies and procedures and compliance with the Security Rule. CEs can perform this assessment using various methods, including interviews, process walk-throughs, and assessment of the actual results of these processes.
Editor’s note: For additional tips see the November issue of Briefings on HIPAA.



Want to receive articles like this one in your inbox? Subscribe to HIM Connection!

Most Popular

Related Articles