COVID: Expanded Medicare Telehealth Coverage

Expanded Medicare Telehealth Coverage

Enables beneficiaries to receive a broader range of telemedicine healthcare
Written by Caleb Knight, Flaherty Sensabaugh Bonasso PLLC

To promote continuity of care and to help minimize exposure and spread, on Monday, March 16, 2020, the Trump Administration announced expanded Medicare telehealth coverage that will enable beneficiaries to receive a broader range of healthcare services from their doctors without having to travel to a healthcare facility. Beginning on March 6, 2020, Medicare will temporarily pay clinicians to provide telehealth services for beneficiaries residing across the entire country.

For more information regarding the actions of the Centers for Medicare & Medicaid Services (“CMS”) in this regard, please visit: www.cms.gov/newsroom/fact-sheets/medicare-telemedicine-health-care-provider-fact-sheet.

On Tuesday, March 17, 2020, CMS issued further guidance, which can be accessed at: www.medicaid.gov/medicaid/benefits/downloads/medicaid-telehealth-services.pdf. The homepage for general Medicaid Telehealth Guidance can be found at: www.medicaid.gov/medicaid/benefits/telemedicine/index.html.

COVID: Interstate Medical License Compact

Interstate Medical License Compact

Not a new effort, but offers a pathway for establishing a multi-state practice

Written by Luke Schmitt, Flaherty Sensabaugh Bonasso PLLC

Even before the COVID-19 pandemic, efforts were made within the United States to facilitate the borderless practice of medicine in our country.  However, now more than ever, these measures are necessary even if temporarily.  To effectively combat this public health crisis, we need to be able to mobilize resources efficiently and effectively.

The Interstate Medical License Compact (the “Compact”) offers a voluntary, expedited pathway to licensure for qualified physicians who wish to practice in multiple states.  The mission of the Compact is to increase access to health care for patients in underserved or rural areas and to allow them to connect with medical experts through telemedicine technologies more efficiently.  In addition to making it easier for physicians to obtain licenses to practice in multiple states, the Compact also seeks to strengthen public policy by enhancing the ability of states to share investigative and disciplinary information.

The Compact is not a federal program or administered by a federal agency.  Nor was it a product of Congressional action or the result of executive or administrative order.  Rather, it is an agreement among states with the Commission functioning as an independent organization.  The Commission is based in Littleton, Colorado, and is governed by the terms of the Compact, which empowers the Commission to create bylaws, rules, and policies.

In West Virginia, in 2015, the Legislature passed House Bill 2496, adopting the Interstate Medical Licensure Compact.  West Virginia Code 30-1C-1 codifies the Interstate Medical Licensure Compact Act. West Virginia Code 30-1C-3 outlines eligibility requirements, West Virginia Code 30-1C-5 governs applications and the issuance of expedited licenses, and West Virginia Code 30-1C-6 sets forth the application fees.

The efficacy of the Compact may not move the needle much in our current situation, but its goals and purposes are something to keep in mind for the future.

More information about who may qualify to participate in the Compact and how to apply is available at the Interstate Medical Licensure Compact website at: https://imlcc.org/.

In addition, to directly combat COVID-19, on Wednesday, March 18, 2020, the Trump Administration announced that the Department of Health and Human Services (“HHS”) would allow all physicians and other medical personnel to practice in states other than those in which they are currently licensed to practice. The HHS regulation is designed to mobilize doctors across state lines to meet the needs of hospitals as they arise during this public health crisis.

However, it is crucial to recognize that the federal medical licensure waivers by HHS are limited in scope to conditions of participation and payment for federal health care programs such as Medicare, Medicaid, and the Children’s Health Insurance Program (CHIP).  HHS and CMS accomplished these waivers according to Section 1135 of the Social Security Act, which authorizes the Secretary of HHS to waive certain Medicare, Medicaid, and CHIP program requirements and conditions of participation once the President declares a public health emergency (“PHE”). HHS Secretary Alex M. Azar issued a PHE on January 31,2020, and President Trump declared an emergency on March 13, 2020.

These waivers do not waive the requirement for physicians and other healthcare providers to maintain licensure in states where they are practicing a licensed profession, including via telehealth.  State laws continue to govern whether a provider is authorized to provide professional services in that state without holding an active license from that state’s medical board.  However, some states are working to ease these restrictions.

Congress is currently considering additional Legislation that would apply to covered health services by private payors.  We are continuing to monitor these developments.

COVID: The Health Care Law Blog Restart

These unprecedented and uncertain times have all of us worried, seeking data/information, thinking in new ways as a result of our world being turned upside down in the past month due to the ongoing COVID-19 crisis. The law is largely built around precedent and written law/regulations. However, no time during my legal career have I see so much change and fluid movement in the law as I saw this past week.

As we stay home and shelter with our families and communities, I thought it was time to restart my blogging at the Health Care Law Blog as a way to share health care and legal information and content relevant that may be helpful to my health care clients, other health care providers, hospitals, nursing homes, physicians/physician practices, home health agencies and other providers. My last post on this blog was in 2012 - but it is time to dust off the blogging keyboard again in light of these worldwide events that impact us all from every direction. I started the Health Care Law Blog back in 2004, the infant hears of blogging and social media. At that time, there were only a handful of bloggers who connected nationally/globally. It was such an eye opening experience as a young lawyers sitting in little old wild and wonderful West Virginia - through this platform I was immediately connected with health care industry, health care lawyers and other technology interested lawyers around the world. Many of those individuals I still follow today via my Twitter feed at @BobCoffield and other social media platforms. In fact, much of my "trusted content" on the developing COVID crisis comes from these same health care blogging resources who I have trusted over the years. 

So with these opening comments, this health care regulatory, transactional and technology lawyer who practices out of Charleston, West Virginia at Flaherty Sensabaugh Bonasso PLLC is starting up the posts today. In the coming days, I plan to share my own thoughts and health care/legal related content along with content prepared by other health care lawyers in our firm's health care practice group, including, Caleb Knight, Shereen Compton McDaniel, Amy McLaughlin, Luke Schmitt, and others at our firm. This past week a few of us were brainstorming how we can help our clients, our communities, our state of West Virginia, our country and our globe during these difficult times. I think we all are struggling with what role we can and should play. Maybe through efforts to write, document, share content and commentary we can find some balance to what are likely difficult days and months to come for us and so many. 

Stay home, stay safe.

WVHCA Issues Policy Statement for Public Witnesses

On April 11, 2012, the West Virginia Health Care Authority announced a new policy regarding the testimony for witnesses from the public before the Authority at certificate of need and rate hearings. The policy statement issued by James L. Pitrolo, Jr. Chairman, is effective from April 11, 2012 and states as follows:

I. PURPOSE
To establish procedures and guidelines governing the testimony for witnesses
from the public.

II. CANCELLATION
This policy cancels and supersedes all prior memoranda regarding testimony for
witnesses from the public.
 
III. POLICY
In order to ensure an orderly public hearing, all witnesses from the public
shall register in person during the first day of the hearing. If a witness fails to
register during the first day of the hearing, the witness will not be allowed to
testify during the hearing. If multiple witnesses are present on behalf of one
party, the group can elect up to three representatives. The representative's
comments will be limited to five minutes each up to a maximum of 15 minutes.
Individual comments will be limited to five minutes each. Further, a witness in the
hearing that has provided testimony shall not testify as a witness from the public
in the same hearing.

MSBCBS of TN Settles HIPAA/HITECH Violation for $1.5M

The HHS Office for Civil Rights (OCR) announced a settlement of $1.5M with Blue Cross Blue Shield of Tennessee (BCBST) relating to potential violations under the HIPAA Privacy and Security Rules. According to the OCR press release, the enforcement action by OCR is the first reported as resulting from a breach report required under the new Breach Notification Rule implemented as a result of the HITECH provisions of HIPAA.

The breach involved 57 unencrypted computer hard drives that were stolen from a facility leased by BCBST in Tennessee. The hard drives contained protected health information of approximately 1 million individuals. The breach was reported by BCBST to OCR under the HITECH provisions and regulations that require reporting of potential breaches. The press release indicates that OCR’s investigation found that BCBST failed to implement appropriate administrative safeguards to adequately protect information remaining at the leased facility by not performing the required security evaluation in response to operational changes. In addition, the investigation showed a failure to implement appropriate physical safeguards by not having adequate facility access controls; both of these safeguards are required by the HIPAA Security Rule.

For more information check out the HHS press release "HHS settles HIPAA case with BCBST for $1.5 million" which includes a link to the HHS Resolution Agreement entered into between OCR and BCBST.

OHFLAC Announces New Independent Informal Dispute Resolution Procedure for West Virginia Nursing Homes

The latest West Virginia Health Care Association e-News Update announced that the Office of Health Facility Licensure and Certification (OHFLAC) has put into place a new Independent Informal Dispute Resolution (IIDR) review of disputed deficiencies for all nursing homes in West Virginia. The new IIDR procedure goes into effect immediately and three out of state vendors experienced in IDRs were selected to be the third party reviewers. The current Informal Dispute Resolution (IDR) will remain as an alternative option.

According to the e-News Update, the new procedure will be detailed in a letter to providers when OHFLAC returns the Statement of Deficiencies to the provider after a survey. The letter will contain instructions on how to request an IIDR. OHFLAC is proposing to use the following language in the letters:

INFORMAL DISPUTE RESOLUTION:
In accordance with 42 CFR 488.331, you have an opportunity to question cited deficiencies through an informal dispute resolution process. To request an informal dispute resolution, please submit in writing the specific deficiencies being disputed and an explanation of why you are disputing those deficiencies to:

                                    Informal Dispute Resolution Review Committee
                                    Office of Health Facility Licensure and Certification
                                    408 Leon Sullivan Way
                                    Charleston, WV 25301-1713

You may also send your request via email to DHHR.OHFLAC.@wv.gov. 
This request must be sent during the same ten (10) calendar days you have for submitting a Plan of Correction (POC) for the cited deficiencies and must be contained on a document separate from the CMS-2567L, which contains the POC. 
You may choose between an informal dispute resolution (IDR) and an independent informal dispute resolution (IIDR).  You must clearly indicate your choice in the attention line of your request and the subject line of your email. An IDR will be completed by OHFLAC staff not associated with the referenced survey event.

Per West Virginia State Code §16-5C-12a, an IIDR will be completed by an independent review organization.  If an independent informal dispute resolution process is selected, the matter will be assigned to one of three independent review organizations accredited by the Utilization Review Accreditation Commission.  The facility may be subject to certain costs such as:
•     The cost of a face-to-face conference if one is requested; and
•     The cost charged by the independent review organization, should the facility not be successful in its dispute.

Please call us at 304-346-4575 if you have any questions.

The new IIDR procedure will allow nursing homes an alternative option to the standard IDR process when questions arise during the survey process and related POC requirement. The new procedure will allow a nursing home provider to challenge the particular survey finding through an alternative/independent process. Whether this new alternative procedure will be valuable to nursing home providers is yet to be seen.

West Virginia Health Care Association Launches WV Senior Care Website

This past week health care colleague and CEO of the West Virginia Health Care Association, Patrick D. Kelly, advised me that the association has launched a new website to provide a resource for families and seniors who are researching residential and health care options in West Virginia. The website is called West Virginia Senior Care: Helping Seniors Make Informed Decisions About Senior Care and can be found at: http://www.wvseniorcare.com/.

The website is designed to help all of us find information and make better decisions regarding care for our parents and the elderly. The website includes everything from in home care services, such as home health, hospice, and other in home services, to care offered in assisted living facilities, residential care, nursing homes, hospitals, etc. The press release issued by the West Virginia Health Care Association provides additional details.

After looking around the website it looks like a great resource of health care information for West Virginia seniors.

CMS Issues proposed rule for Stage 2 Meaningful Use EHR Incentive Programs under HITECH

Yesterday the Centers for Medicare & Medicaid Services (CMS) announced the proposed rule for Stage 2 Meaningful Use under the the Medicare and Medicaid Electronic Health Record (EHR) Incentive Programs which is a part of the Health Information Technology for Economic and Clinical Health Act (HITECH).

The incentive program is part of the national health information technology reform effort under the American Recovery and Reinvestment Act of 2009 which provides incentive payments to eligible health care professionals, eligible hospitals and Critical Access Hospitals who adopt certified EHR technology and use it to demonstrate “meaningful use” of that technology to CMS.

The proposed rule also revised certain Stage 1 criteria, as well as criteria that apply regardless of the Stage, as finalized in the final rule titled Medicare and Medicaid Programs; Electronic Health Record Incentive Program published on July 28, 2010 in the Federal Register. The provisions included in the Medicaid section of the proposed rule (which relate to calculation of patient volume and hospital eligibility) would take effect shortly after finalization of this rule, not subject to the proposed 1 year delay for Stage 2 of meaningful use of certified EHR technology. Changes to Stage 1 of meaningful use would take effect for 2013, but most would be optional until 2014.

CMS provides the following Fact Sheet summary of the Stage 2 requirements. The complete proposed rule can be found here and should be published in the Federal Register in the next week. If you are interested in submitting comments to the proposed rule the deadline for submission will be 60 days from the date of publication of the proposed rule in the Federal Register.

SCOTUS Overturns Supreme Court of Appeals of West Virginia Decision on Nursing Home Arbitration Agreements

On February 21, 2012, the U.S. Supreme Court vacated a ruling by the Supreme Court of Appeals of West Virginia in the matter of Marmet Health Care Center, Inc. v. Brown et al., 565 U.S.(2012). The Supreme Court of Appeals of West Virginia previously held that all pre-dispute arbitration agreements that applied to personal injury and wrongful death claims against nursing homes were unenforceable.  In a strongly worded opinion, the U.S. Supreme Court held that the West Virginia court misread and disregarded national precedent and controlling federal law regarding the Federal Arbitration Act. The litigation involved three negligence suits against nursing homes in West Virginia for the care they provided to three separate residents: Clayton Brown, Jeffrey Taylor, and Sharon Marchio. In each of the cases, a family member entered into a binding arbitration agreement on behalf of the resident with the respective nursing home. In all three cases, after the resident died, lawsuits were filed in state circuit courts alleging personal injury and wrongful death against the nursing homes. The Brown and Taylor cases were dismissed by the circuit courts based on the arbitration agreements. The Marchio case was consolidated with the other two cases when it was brought before the West Virginia Supreme Court on a certified question. In a decision concerning all three cases, the West Virginia Supreme Court held that "as a matter of public policy under West Virginia law, an arbitration clause in a nursing home admission agreement adopted prior to an occurrence of negligence that results in a personal injury or wrongful death, shall not be enforced to compel arbitration of a dispute concerning the negligence." Brown v. Genesis Healthcare Corp., No. 35494 (W.Va., June 29, 2011). The West Virginia Supreme Court found unpersuasive the U.S. Supreme Court's prior interpretation of the Federal Arbitration Act, calling it "tendentious" and "created from whole cloth." Brown v. Genesis Healthcare Corp., No. 35494 (W.Va., June 29, 2011). In vacating the West Virginia court's ruling, the U.S. Supreme Court held that the West Virginia court's interpretation of the Federal Arbitration Act was incorrect and inconsistent with its clear instruction and prior precedents. On remand, the West Virginia court was instructed to consider whether, absent the general public policy issue, the arbitration clauses in the Brown and Taylor cases are unenforceable under state common law principles that are not specific to arbitration and preempted by the Federal Arbitration Act. This leaves the possibility that certain arbitration clauses may be invalidated on such general contract grounds, such as fraud, duress, and lack of capacity, to name a few. For additional information you can review the documents filed in the matter the U.S. Supreme Court docket for the Marchio portion of the case. Also, the briefs filed in the Brown, Taylor, and Marchio matters filed before the Supreme Court of Appeals of West Virginia can be found here.   Thanks to Ryan A. Brown, a member of the Flaherty Sensabaugh Bonasso PLLC Health Care Practice Group who represents the defendant nursing home, Clarksburg Nursing & Rehabilitation Center, Inc., in the Marchio matter for the above summary of the decision. Also involved in the case was my partner, Mark Robinson.

HIPAA Privacy Action Filed Against University Health Associates

The West Virginia Record reports the filing of a medical record breach action against West Virginia University Medical Corporation dba University Health Associates (UHA) under the Privacy Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The action filed in Monongalia Circuit Court was filed by Jennifer M. McGinley on behalf of Randy Friend (11-C-774).

The complaint asserts that Mr. Friend received a letter from UHA indicating that an employee had accessed his medical record without authorization. Mr. Friend claims that his medical record was accessed multiple times by a former UHA employee and that this former employee related the medical information to several other people living in Mr. Friend's community causing him emotional distress and embarrassment.

Also, Jeff Drummond at the HIPAA Blog reports on an interesting lawsuit filed by the Minnesota AG against Accretive Health in Minnesota. The action involves Fairview Health and North Memorial who hired Accretive Health as its debt collection company. Accretive Health lost an unencrypted laptop with medical and other personal information. As Jeff indicates this has some interesting aspects including the question of direct liability of a business associate under the HITECH amendments to HIPAA and also whether the covered entities only disclosed the "minimum necessary" information to its debt collection company. Interesting case to watch develop.

UPDATE: The complaint filed in the United States District Court District of Minnesota, State of Minnesota, by its Attorney General Lori Swanson v.Accretive Health, Inc.

WVHCA: 2012 CON Capital Expenditure Minimum

The West Virginia Health Care Authority has announced the 2012 certificate of need capital expenditure minimum threshold of $2,916,104. The new threshold is effective beginning January 1, 2012. The threshold is used as a part of the analysis by health care providers who must determine whether or not a certificate of need is required for a proposed project or health care acquisition. 

Pursuant to W.Va. Code 16-2D-2(h) and (s), the Authority is required to adjust the expenditure minimum annually and publish an update of the amount on or before December 31 of each year. The expenditure minimum adjustment isbased on the DRI inflation index published in the Global Insight DRI/WEFA Health Care Cost Review. The DRI inflation index as of December 31, 2011 is 2.9%.

Health Care Law Blog: Have a Wonderful Holiday Season!

Happy Holidays to my clients, health care and lawyer colleagues, and other readers of the 

Health Care Law Blog

 I appreciate your continued support and hope that 2012 

will be as exciting and wonderful as this past year.

See you in 2012! 

In years past I have sent out our standard Flaherty Sensabaugh Bonasso PLLC holiday card to thank my clients for trusting our firm with their business and my colleagues for all they do for me throughout the year. Instead, this year I decided to go GREEN and red by sending out an e-greeting and
do a holiday blog post with our firm's holiday greeting card.
We all play an important role in maintaining the environment.Thanks!

Thanksgiving 2011: Occupy The Dinner Table and Engage With Grace

The Engage with Grace Project is an effort to raise awareness of the importance of end of life care planning and discussing your wishes with your family and friends.

Dr. Bryan Vartabedian captures the simplicity of the project in his post, "It began with a simple idea: Create a tool to get people talking. Their tool is a slide with five questions designed to initiate dialog about our end-of-life preferences."  Take time during the Thanksgiving weekend to "occupy the dinner table" with your family and friends. Discuss the 5 questions below and share your thoughts and feelings.
 
This is my 4th year participating in the Engage With Grace Project. What prompted me to start participating? It was having the opportunity to watch Alexander Drane tell Za's story at the 2008 Health 2.0 Conference. Her story personally connected as I shared in my 2008 blog post.

West Virginia is often negatively portrayed nationally at the bottom or top in national health rankings. However, it is great to see West Virginia leading the way on end of life care planning. 49% of West Virginians have filled out at least one advance directive -- the highest among all states reporting these statistics. However, this statistic shows how few of us actually take the time and effort to document our wishes. More than 1/2 of the population have left these difficult decisions to be made by their family and health care providers. This statistic shows the importance of the Engage With Grace message.

For West Virginia readers who want to learn more about end of life care check out the resources provided by the West Virginia Center for End of Life Care. There is valuable information for health care professionals to "Why and how to have end-of-life discussions with your patients", "Accessing Decision Making Capacity", and POST (Physicians Order for Scope of Treatment) Forms.  The website also provides FAQs, educational videos, and forms, including the standard West Virginia Advanced Directive Forms.

West Virginia is also creating the e-Directive Registry in conjunction with the West Virginia Health Information Network (WVHIN), West Virginia's health information exchange (HIE). The e-registry will store advance directive forms, Physicians Orders for Scope of Treatment forms, and do not resuscitate cards. The registry will allow treating health care providers to access the stored information 24/7 from around the state through the WVHIN. Most importantly, the registry will be accessible by you and I as health care consumers to verify the accuracy of our wishes. 

Following is the 2011 blog post by the Engage With Grace Team -- Occupy With Grace. Help spread the word this Thanksgiving weekend by telling your end of life care story and posting the message below. You can get the HTML to post here.
 
Occupy With Grace
 
Once again, this Thanksgiving we are grateful to all the people who keep this mission alive day after day: to ensure that each and every one of us understands, communicates, and has honored their end of life wishes.
Seems almost more fitting than usual this year, the year of making change happen. 2011 gave us the Arab Spring, people on the ground using social media to organize a real political revolution. And now, love it or hate it - it's the Occupy Wall Street movement that's got people talking.
Smart people (like our good friend Susannah Fox) have made the point that unlike those political and economic movements, our mission isn't an issue we need to raise our fists about - it's an issue we have the luxury of being able to hold hands about.

It's a mission that's driven by all the personal stories we've heard of people who've seen their loved ones suffer unnecessarily at the end of their lives.

It's driven by that ripping-off-the-band-aid feeling of relief you get when you've finally broached the subject of end of life wishes with your family, free from the burden of just not knowing what they'd want for themselves, and knowing you could advocate for these wishes if your loved one weren't able to speak up for themselves.

And it's driven by knowing that this is a conversation that needs to happen early, and often. One of the greatest gifts you can give the ones you love is making sure you're all on the same page. In the words of the amazing Atul Gawande, you only die once! Die the way you want. Make sure your loved ones get that same gift. And there is a way to engage in this topic with grace!

Here are the five questions, read them, consider them, answer them (you can securely save your answers at the Engage with Grace site), share your answers with your loved ones. It doesn't matter what your answers are, it just matters that you know them for yourself, and for your loved ones. And they for you.



We all know the power of a group that decides to assemble. In fact, we recently spent an amazing couple days with the members of the Coalition to Transform Advanced Care, or C-TAC, working together to channel so much of the extraordinary work that organizations are already doing to improve the quality of care for our country's sickest and most vulnerable.

Noted journalist Eleanor Clift gave an amazing talk, finding a way to weave humor and joy into her telling of the story she shared in this Health Affairs article. She elegantly sums up (as only she can) the reason that we have this blog rally every year:

For too many physicians, that conversation is hard to have, and families, too, are reluctant to initiate a discussion about what Mom or Dad might want until they're in a crisis, which isn't the best time to make these kinds of decisions. Ideally, that conversation should begin at the kitchen table with family members, rather than in a doctor's office.

It's a conversation you need to have wherever and whenever you can, and the more people you can rope into it, the better! Make this conversation a part of your Thanksgiving weekend, there will be a right moment, you just might not realize how right it was until you begin the conversation.
This is a time to be inspired, informed - to tackle our challenges in real, substantive, and scalable ways. Participating in this blog rally is just one small, yet huge, way that we can each keep that fire burning in our bellies, long after the turkey dinner is gone.
Wishing you and yours a happy and healthy holiday season. Let's Engage with Grace together.

To learn more please go to www.engagewithgrace.org.This post was developed by Alexandra Drane and the Engage With Grace team.

HIPAA/HITECH Audits: OCR Program to Audit 150 Covered Entities

Today the Office for Civil Right (OCR) announced details of a pilot program to perform up to 150 audits of covered entities to assess privacy and security compliance under HIPAA. OCR will be conducting the audits between November 2011 and December 2012.

The days of waiting for HIPAA privacy and security enforcement activities are over. The announcement of these planned audits will get the attention of health care providers who have failed to focus on HIPAA privacy and security compliance efforts. The announcement will remind all health care providers to maintain an active, current HIPAA privacy and security compliance program.

OCR provides more detail on the audit program on the OCR HIPAA Audit Program page, including this description of the program objectives:

The audit program serves as a new part of OCR’s health information privacy and security compliance program. OCR will use the audit program to assess HIPAA compliance efforts by a range of covered entities, Audits present a new opportunity to examine mechanisms for compliance, identify best practices and discover risks and vulnerabilities that may not have come to light through OCR’s ongoing complaint investigations and compliance reviews. OCR will broadly share best practices gleaned through the audit process and guidance targeted to observed compliance challenges via this web site and other outreach portals.

The OCR HIPAA Audit Program page also provides detail on when the audits will begin, who will be audited, how the audit process will work, and what will happen after the audit. The information indicates that they will select a broad range of covered entities for the first round of audits and that business associates will be included in future audits.

OCR provides the graphic below to help describe how the audits will be performed. Covered entities will be selected, notified, and asked to provide documentation of privacy and security compliance efforts within 10 business days. An onsite visit will occur and interviews will be performed. A draft report will be provided to the covered entity and there will be a procedure for the covered entity to discuss the areas of concern raised in the audit and describe any corrective action they may implement.



 The HIPAA audits are a requirement under the American Recovery and Reinvestment Act of 2009 (Section 13411). HHS awarded to KPMG a $9 million dollar contract earlier this year to assist OCR with the audits.