A HIPAA audit is based off a set of regulations, standards and implementation specifications. The audit is an analysis that helps to pinpoint the organization’s current state and what steps need to be taken to get the organization compliant. An evaluation is part of the audit – a company must perform an evaluation and undergo periodic evaluations once a year at minimum. As technology changes, different components are added to an organization’s infrastructure and they should be re-evaluated. While covered entities need to undergo HIPAA audits, third-party business associates also need to comply. This includes any company that might provide services for a covered entity, for example, an application hosted in a cloud and provided to a covered entity.

FAQs Archive

Q: What type or form of documentation of parental agreement is required under the Privacy Rule in order for a health care provider to be permitted to disclose proof of a child’s immunizations to a school that is subject to a school entry law? For how long must such documentation be maintained?

The Privacy Rule does not prescribe the nature and form of the documentation, allowing covered entities the flexibility to determine what is appropriate for their purposes and to address the varied circumstances in which parental agreement may be obtained. The documentation must only make clear that agreement was obtained as required by 45 CFR 164.512(b) (1)(vi) of the Privacy Rule. For example, if a parent or guardian submits a written or email request to a covered entity to disclose proof that his or her child has been immunized to the child’s school, a copy of the request would suffice as documentation of the agreement. Likewise, if a parent or guardian calls the covered entity and requests over the phone that proof of his or her child’s immunization be disclosed to the child’s school, a notation in the child’s medical record or elsewhere of the phone call would suffice as documentation of the agreement. The documentation for these purposes need not include the signature of a parent or guardian or any of the other elements required under the Privacy Rule for a written HIPAA authorization. As with other documentation required under the Privacy Rule, documentation of parental agreement for these purposes must be maintained for six years. See 45 CFR 164.530(j) .

Q: Is a health care provider permitted to disclose proof of a child’s immunizations directly to a school without a HIPAA authorization?

Yes, provided the school is required by law to have proof of immunizations in order to admit the child, and a parent, guardian, or other person acting in loco parentis has agreed to the disclosure. See 45 CFR 164.512(b) (1)(vi). Where the individual who is a student or prospective student is an adult or emancipated minor, the provider may make the disclosure with the agreement of the student herself. In either case, the agreement may be obtained orally or in writing, but must be documented (e.g., by placing in the medical record a copy of a written request, or notation of an oral request, from a parent for the provider to disclose the proof of immunization to the school).

Q: Who enforces the health information privacy and security standards established under the Health Insurance Portability and Accountability Act (HIPAA)?

The HIPAA Privacy and Security Rules are enforced by the Office for Civil Rights (OCR). View more information about complaints related to concerns about protected health information. The Office of E-Health Standards and Services within the Centers for Medicare & Medicaid Services (CMS) enforces the Transactions and Code Sets and National Identifiers (Employer and Provider identifiers) regulations of the Health Insurance Portability and Accountability Act (HIPAA). Complaints regarding the Transactions and Code Sets and National Identifiers regulations may be submitted electronically or via paper form - PDF . CMS also enforces the insurance portability requirements under Title I of HIPAA. View more information about portability and how to obtain information or assistance.

Q: Is the Security Rule under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) suspended during a national or public health emergency?

No, the Security Rule is not suspended during a national or public health emergency. The Secretary of HHS may waive sanctions and penalties arising from certain provisions of the Privacy Rule under the Project BioShield Act of 2004 (PL 108-276) and section 1135(b)(7) of the Social Security Act if the President declares an emergency or disaster and the Secretary declares a public health emergency. However, these provisions have no application to the Security Rule. The Security Rule includes requirements for covered entities to ensure the confidentiality, integrity and availability of all electronic protected health information they create, receive, maintain or transmit. The rule further requires that covered entities protect against any reasonably anticipated threats or hazards to the security or integrity of such information. Other provisions of the Security Rule require covered entities to implement security measures that specifically contemplate emergency conditions. For example, covered entities must have contingency plans that establish policies and procedures for responding to an emergency or other occurrence (fire, system failure and natural disaster) that damages systems that contain e-PHI ( 45 CFR §164.308(a) (7)(i)). As with all HIPAA-related complaints, the Office for Civil Rights will evaluate complaints that arise during the course of a national or public health emergency on a case-by-case basis and exercise its discretion in taking enforcement action. For more information on suspension of the Privacy Rule during a national or public health emergency, please see FAQ #1068.