If OCR asks for our HIPAA documents, then what should we have ready?

Start

OCR has asked for our HIPAA documents, or may

This flow works from what the Security Rule requires to be in writing and from what the pack lists. The pack does not say what OCR asks for in a request, so nothing here predicts its list or its dates. A request names what it wants and by when, and the deadline sits in that letter. If you need more time, ask in writing and early. Background only, not a forecast: OCR's Risk Analysis Initiative focuses select investigations on the risk analysis provision. Use the flow to see what you could hand over today, and what you could not.

• Then: Log the request and tell counsel the same day

Step

Log the request and tell counsel the same day

If a request has come, write down when it arrived, who sent it, what it asks for and the date it names, and keep the request itself. If none has come yet, start at the next step. Tell legal counsel before anything leaves. Counsel decides what may be given, to whom, and whether and how you answer. If it concerns an incident or a possible breach, the incident procedure applies as well.

• Then: Match each part of the request to the pack's list of records

Step

Match each part of the request to the pack's list of records

Match each part of the request to a row on your evidence list. Where a part matches no row, ask what is meant and do not guess. The list is what the Rule and HHS guidance say should be written down. It is not a list of what any authority will ask for. The checks below take the main groups, the Rule's own words first. Work through the other rows on your list the same way.

• Then: Are our policies and procedures in writing, approved and current?

Decision

Are our policies and procedures in writing, approved and current?

The Rule asks you to maintain the policies and procedures in written form, which may be electronic. Check that the current version of each is approved and in force, and that earlier versions are kept with the date each stopped being in effect. If you cannot show an approved current version, or you are not sure, answer No.

• Yes, seen and checked: Is the risk analysis signed and current, with a risk management plan?
• No, or not known: Log the policy gap on your own tracker and rank it

Step

Log the policy gap on your own tracker and rank it

Add a row for each missing or unapproved policy to your own gap tracker, with what is missing, one named owner and a date. Rank by exposure: a required duty with nothing in place is Priority 1, a duty in place that cannot be shown is Priority 2. The pack's days for each rank are its own defaults, and the Rule sets no deadline for closing a gap.

• Then: Is the risk analysis signed and current, with a risk management plan?

Decision

Is the risk analysis signed and current, with a risk management plan?

Look for the latest risk analysis report, signed and approved, with each earlier version kept. Look for the ePHI inventory it rests on. Look for the risk management plan, with treatments, owners, dates and progress. Answer No if the analysis is unsigned, was not reviewed after a change that called for it, or has no plan beside it. “How do we run and record a HIPAA security risk analysis?” covers how to run the analysis.

• Yes, seen and checked: Is a decision on record for each addressable specification?
• No, or not known: Log the risk analysis and plan gaps and rank them

Step

Log the risk analysis and plan gaps and rank them

A missing or unsigned risk analysis is a blocking gap in the pack's terms, because the Rule requires the analysis. Tell the executive sponsor in writing at once, as the pack's escalation steps say, give the gap an owner and a date, and report it at each management review until it is closed. Do not sign an old analysis today as if it had been signed then.

• Then: Is a decision on record for each addressable specification?

Decision

Is a decision on record for each addressable specification?

An addressable specification is assessed, never optional. Each needs a record: whether it is reasonable and appropriate, what you decided, why, who decided and when. If you did not implement it as written, the record also says what equivalent alternative you implemented, if one was reasonable and appropriate. Encryption is one of the 22. “Is an "addressable" HIPAA safeguard optional?” explains addressable safeguards. Answer No if any decision is missing.

• Yes, seen and checked: Is every business associate agreement signed, with a full register?
• No, or not known: Log each missing decision on your own tracker and rank it

Step

Log each missing decision on your own tracker and rank it

Make the assessment now, with today's date, and file the record under that date. The tracker shows the gap and its closure. The record must not say or suggest it was made earlier, and when you hand it over its date shows it was made today. Where you did something other than the specification, say that, with the real reason.

• Then: Is every business associate agreement signed, with a full register?

Decision

Is every business associate agreement signed, with a full register?

List every business associate and subcontractor that can reach ePHI on a register. Each needs a signed agreement with its security terms checked. If you are a group health plan, the plan documents also need amending. An unsigned agreement, a supplier missing from the register or an unchecked term all mean No.

• Yes, seen and checked: Do incident records and breach assessments show their outcomes?
• No, or not known: Log the agreement and register gaps and rank them

Step

Log the agreement and register gaps and rank them

Add each unsigned agreement, each supplier missing from the register and each unchecked term as its own row. A supplier with no agreement is a required duty with nothing in place, so it is Priority 1 in the pack's ranking. Sign the agreement with its real date, or stop sharing ePHI with that supplier. Counsel confirms the contract position.

• Then: Do incident records and breach assessments show their outcomes?

Decision

Do incident records and breach assessments show their outcomes?

Each security incident needs a record with its outcome. Each breach assessment needs the facts, the factors considered, the decision and any notices sent. These records can name patients, so counsel clears what leaves. “When does a security incident become a reportable HIPAA breach?” explains when an incident becomes a reportable breach. Answer No if any record lacks an outcome or a decision.

• Yes, seen and checked: Are the training, access, contingency and evaluation records there?
• No, or not known: Log the incident record gaps and rank them

Step

Log the incident record gaps and rank them

Add a row for each incident without a recorded outcome or each assessment without a decision. Complete a record only with what was known and done at the time, dated today as an addition. Do not reconstruct a decision as if it had been made then. A possible breach that you find while doing this follows your incident procedure and its own clocks.

• Then: Are the training, access, contingency and evaluation records there?

Decision

Are the training, access, contingency and evaluation records there?

Check for training plans, attendance and reminders; authorisation, access and termination records with access reviews; backup, recovery and emergency mode plans with test records; and evaluation reports with the triggers that called for them. The pack lists most of these because they show a readiness item, which is its practice and not a paragraph's; evaluation reports are there as the pack's practice: the Rule requires a periodic evaluation (164.308(a)(8)) but not that it be written; the OCR audit protocol tells auditors to obtain documentation of periodic evaluations, so keep the report. Counsel decides whether yours must be written down. Answer No if any set is missing or has gaps.

• Yes, seen and checked: Are records kept six years and open to those who use them?
• No, or not known: Log the missing records and rank them

Step

Log the missing records and rank them

Add one row for each missing set. If the activity happened but was never written down, record that fact today and start keeping the record now. If it did not happen, the gap is the activity itself, and closing it means doing it. Both go on your own tracker with an owner and a date.

• Then: Are records kept six years and open to those who use them?

Decision

Are records kept six years and open to those who use them?

The Rule's period is six years from creation or last effect, whichever is later. A replaced policy keeps its six years from the day it stopped being in effect, and a current policy has not started its six years. For records the pack lists only to show a readiness item, six years is the pack's practice. The Rule also makes documentation available to the people who carry out the procedures, and asks for periodic review (the pack defaults to 12 months). Another law or a contract may set longer retention; counsel confirms. Not sure means No.

• Yes, seen and checked: Did any check come back No or not known?
• No, or not known: Log the retention or availability gap and rank it

Step

Log the retention or availability gap and rank it

Note which records were disposed of too early, have no retention date, are hard to reach or are overdue for review. A disposed record cannot be recreated, so say so plainly when it is asked for. Set a retention date on each record in your document register, worked out from the later of its two dates, and publish the current version where its users work. Give each gap an owner and a date.

• Then: Did any check come back No or not known?

Decision

Did any check come back No or not known?

Not known counts as No. If you could not find a record, or you are not sure it is approved, complete or kept, treat it as missing until you have seen it. Open the record itself and do not rely on what people say. If every check came back Yes, you have a set you could hand over after counsel has cleared it.

• Yes, or not known: Describe each record as it is, with its real date
• No: You hold a set to hand over once counsel has cleared it

Step

Describe each record as it is, with its real date

Hand over a copy of what you have, with its true dates, and say which parts are missing. Do not change a date, backdate a document, or write a record to look as if it had always existed. Recreating a record to look older is not an option. The honest end state is the real date and the gap logged. Counsel advises on how to explain a missing record.

• Then: Hand over what exists, say what is missing, and fix the gaps

Outcome

Hand over what exists, say what is missing, and fix the gaps

Send what counsel agrees, by the route counsel agrees, and keep exactly what was sent. Work the logged gaps by priority. Tell the executive sponsor in writing at once of any blocking gap. Then repeat the readiness assessment: the pack's default is at least every 6 months, after a blocking gap is closed, and after a trigger. None of this says anything about the law, and the Rules provide no certificate.

Outcome

You hold a set to hand over once counsel has cleared it

Every check came back Yes with the record seen. Keep the request, a copy of exactly what was sent and the date, as long as the records themselves. Then enter any record that was slow to find as a gap, so the next request is quicker. This is the state of your records against the pack's list, which is not a finding about the law.