The Office of Civil Rights (OCR) of the U.S. Department of Health and Human Services (HHS) has posted an alert (and a follow-up alert) warning health plans, health care providers, and their vendors of a mock communication involving the OCR audit program under the Health Insurance Portability and Accountability Act (HIPAA). The email falsifies HHS departmental letterhead and the signature of the OCR Director and directs individuals to a non-governmental website marketing the cybersecurity services of a firm that is not associated with HHS or OCR.

Even before it launched its new wave of HIPAA audits, OCR warned about the prospect of such fraudulent communications. Those who are subject to HIPAA need to be particularly vigilant to confirm that official-looking emails they receive about the HIPAA audit program actually do come from—and refer to—the appropriate OCR email address.

The follow-up alert also notes that OCR has begun contacting business associates as part of its HIPAA audit program. Business associates should be looking out for any emails they receive from OCR and, after first confirming that they are genuine, take prompt measures to meet audit response deadlines.

Ballard Spahr formed a HIPAA Compliance Team of attorneys from various disciplines to advise health care providers, health plans, and their business associates on the privacy and security requirements under HIPAA. Members of the team offer guidance and training on HIPAA rules; prepare HIPAA policies and procedures, notices and forms, business associate agreements, and other compliance documentation; perform security risk assessments; and otherwise help clients prepare for the eventuality of an OCR HIPAA audit.

If you have questions about the OCR alert, the HIPAA audit program, or HIPAA privacy and security requirements, please contact any member of our HIPAA Compliance Team. For more information about our team visit us at www.ballardspahr.com/HIPAA.


Copyright © 2016 by Ballard Spahr LLP.
www.ballardspahr.com
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, including electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This alert is a periodic publication of Ballard Spahr LLP and is intended to notify recipients of new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own attorney concerning your situation and specific legal questions you have.