HIPAA onsite auditWhen the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) investigates a potential HIPAA violation, auditors will usually instigate a HIPAA onsite audit.

HIPAA onsite audits are an essential part of the investigative process. OCR will notify you if your behavioral health practice is selected for an onsite audit. Auditors will schedule a visit to your physical site. An investigator representing OCR will conduct a thorough, in person analysis of your practice’s HIPAA compliance program.

It’s important to note that once OCR opens an investigation, they will require all of the necessary documentation in electronic format. OCR investigators will require:

  • Documentation of the practice’s most recent Security Risk Analysis
  • An IT Report on the practice’s server setup, router setup, firewall, and workstations
  • A Device Audit documenting all devices that access or store electronic protected health information (ePHI), along with details about device security
  • A Physical Site Audit analyzing hard copy PHI, alarm systems, building keys, document storage, and document shredding
  • A complete set of the practice’s HIPAA Policies with corresponding regulation numbers
  • Documentation of Employee Training and Attestation, including their HIPAA 101 training and policy review

The easiest way for behavioral health specialists to be prepared for a HIPAA onsite audit is to implement a HIPAA compliance program that addresses the full extent of the law. A robust compliance program also serves as the best way to stop HIPAA violations from occurring in the first place.