Please support Telehealth.org’s ability to deliver helpful news, opinions, and analyses by turning off your ad blocker. What to Do if You’re Contacted by OCR
When the Department of Health and Human Services (HHS) or the Office for Civil Rights (OCR) reaches out to health care organizations in response to a potential HIPAA investigation, auditors follow a very specific path toward contact, investigation, and resolution. Once a complaint is received and OCR has determined that it is legitimate, it will issue letters of notification to both the complainant and the recipient. These letters will outline a timeline for the investigation and will explicitly identify the investigating party as the OCR.
Once the investigation begins, OCR will collect and review documentation submitted by both parties. They may use any number of investigative methods including interviews and onsite visits to determine if there is sufficient evidence to support the allegations. Once again, OCR will send a letter explaining their findings. Resolutions will then vary depending on the outcome of their investigation.
HIPAA Audit Survival
HIPAA audit survival starts with keeping informed about OCR procedures. Knowledge is power. In this case, being aware and prepared is the best way to prepare your practice for a potential investigation. OCR will only contact you directly via a certified letter or email. Disreputable parties regularly attempt to lure unsuspecting practitioners into buying “certification” services that are fraudulent.
FACT: There is no certifying body for HIPAA compliance by any federal or private entity–any organization that claims otherwise is using misleading or potentially fraudulent language.
HIPAA Audit Survival 1: Your best defense then is to keep in mind the above described process, and stop communicating with any party that suggests a deviation from the standard procedure outlined.
HIPAA Audit Survival 2: Next, if you’re unsure if you’ve been contacted by a federal agency or not, ask the sender to confirm the identity of their organization, then verify them with a google search about their services
HIPAA Audit Survival 3: If your organization receives an email or call from an entity claiming that you need to have a “Mandatory HIPAA Risk Assessment Review with A Certified HIPAA Compliance Adviser” be on full alert. This deviation from the official procedure described above will let you know that the caller is not providing a legitimate notice from a federal or state regulatory agency. Do not feel obligated to provide or share any of your information if you receive such notice.
HIPAA Audit Survival 4: Check the source of the email. These fraudulent emails are being sent from sources such as ‘OSOCRAudit@hhs-gov.us‘, while a legitimate OCR email will be sent from ‘OSOCRAudit@hhs.gov‘. The distinction is subtle, but that’s characteristic of scams such as these.
To protect yourself, be leery of misleading language and marketing efforts targeted at health care professionals by such third party organizations. Some such advertising will occasionally try to leverage the threat of a federal offense to garner a sale of technology that isn’t legal. This type of fraud has become so widespread that OCR has responded to this unlawful conduct with a statement telling health care officials not to follow any of the links in the email. For more information on how to mitigate HIPAA breaches and fines, check out these upcoming HIPAA educational webinars brought to you by Telemental Health’s HIPAA compliance affiliate, the Compliancy Group. Simplify HIPAA today with TMHI’s HIPAA Compliance Resource, the Compliancy Group!*
*TBHI is affiliated with the Compliancy Group and earns a small fee when you make a purchase.
Essential Telehealth Law & Ethical Issues
Bring your telehealth practice into legal compliance. Get up to date on inter-jurisdictional practice, privacy, HIPAA, referrals, risk management, duty to warn, the duty to report, termination, and much more!
BCTP®-I Telehealth Training & Certificate
Clinicians seeking an orientation to legal, ethical, technical, and clinical issues will find this program a good place to start.
Advanced Telehealth Regulations & Ethical Issues: Best Practices & Informed Consent
Essentials of practice guidelines published by the leading professional associations, explained with a focus on what-to-do rather than theory that leaves you empty-handed.
This is great information. I went to the hhs site before reading this and was surprised at how easy it can be to be scamed in this arena.
Indeed!