OIG slams CMS for lack of HIPAA compliance enforcement
 | |
| CMS needs to take a more proactive approach to enforcing HIPAA. Image Source: MediScribe Inc. |
Although authorized by federal regulations, OIG said that CMS has not conducted any HIPAA compliance reviews of covered entities. To fulfill its oversight responsibilities, the report found that CMS relied on complaints to identify any non-compliant covered entities that it might investigate.
As a result, “CMS had no effective mechanism to ensure that covered entities were complying with the HIPAA Security Rule or that ePHI [electronic protected health information] was being adequately protected,” OIG said.
Although reliance on complaints alone was ineffective for identifying non-compliant covered entities, OIG noted that CMS has “an effective process” for receiving, categorizing, tracking and resolving complaints. The report said that CMS has developed and implemented detailed procedures for receiving complaints, communicating with filed-against entities, coordinating with the Office for Civil Rights for complaints that potentially violate both the HIPAA security and privacy rules, developing corrective action plans and remediating complaints.
Based on its findings, the OIG said that “CMS needs to become proactive in overseeing and enforcing implementation of the HIPAA Security Rule by focusing on compliance reviews.” The office also recommended that CMS establish policies and procedures for conducting HIPAA compliance reviews of covered entities.
CMS did not agree with the OIG’s findings because it said that “its complaint-driven enforcement process has furthered the goal of voluntary compliance.” However, CMS agreed that compliance reviews are a useful enforcement tool as part of a more comprehensive enforcement strategy that also includes complaint investigation and resolution, outreach, education and working closely with industry to identify and correct security issues, according to the OIG.