HIPAA Self-Assessment Tool Kit

Understanding HIPAA Self-Assessments

A key component of HIPAA compliance is conducting annual self-audits within your practice or business to assess the status of your compliance.

These HIPAA self-assessments must address the full extent of HIPAA regulation. HIPAA is broken up into several rules, collectively called the HIPAA Rules. The HIPAA Rules are composed of implementation standards. When you conduct your annual audits within your practice, you must measure yourself against these standards. That’s where the real power of HIPAA self-assessments comes into play. By auditing your business across the full spectrum of HIPAA regulatory requirements, you can directly identify your areas of vulnerability.

HIPAA regulation sets standards for the use and transmission of protected health information (PHI). PHI is any demographic information that can be used to identify a patient. HHS lists eighteen identifiers that constitute PHI. Common examples include: name, date of birth, address, telephone number, Social Security number, health record, or full facial photo.

By using a HIPAA self-assessment toolkit to address these gaps in your compliance, you can remediate potential HIPAA violations before they happen.

How to Use HIPAA Software as Your HIPAA Compliance Toolkit

A good HIPAA compliance software will give you the tools you need to address all necessary HIPAA self-assessments.

These self-assessments should address all of the necessary HIPAA standards, roughly broken into 6 major categories. These self-audits include:

• Privacy Standards: this self-audit will only be completed by health care providers, clearinghouses, and insurance providers (covered entities, as per HIPAA regulation). These standards are found in the HIPAA Privacy Rule and have to do with patient access to their health records, in addition to uses, disclosures, and authorizations for said access.
• Security Standards: this self-audit will address the standards found in the HIPAA Security Rule, spanning across technical, physical, and administrative safeguards as outlined within the regulation.
• Asset and Device audit: this self-audit will take an inventory of all devices used by or within your organization that have access to PHI.
• Physical Site audit: this self-audit will assess the physical security of your offices, buildings, or sites that house PHI.
• Security IT Risk assessment: this self-audit will complete the necessary security risk assessment of your business in order to identify areas of risk that you will remedy through your HIPAA compliance program.
• HITECH Subtitle-D audit: this self-audit assesses the status of your organization’s preparedness for a data breach and breach notification process.

Keep this in mind as you attempt to craft your own HIPAA self-assessments–or turn the health care industry’s trusted HIPAA advisors to simplify the process for you. Compliancy Group provides ongoing, one-on-one support throughout the implementation of self-audits, and the entire process of creating an effective HIPAA compliance program to satisfy your federal requirements.