Careers

Experiences

Industries

Offices

Our Firm

Pages

Our People

Updates

Practices

Warner Norcross + Judd LLP is a corporate law firm with over 230 attorneys serving clients in nine offices throughout Michigan. Among the largest law firms in Michigan, Warner works in virtually all areas of business law.

Michigan Law Firm - Warner Norcross + Judd LLP

Last week the U.S. Department of Health and Human Services Office for Civil Rights (OCR) launched Phase 2 of its HIPAA compliance audits, and this time around every covered entity and business associate, no matter its size or function, is eligible for an audit. Check your spam folders: OCR has started sending initial emails to verify contact information for potential auditees, and organizations only have fourteen days to respond to the OCR’s information request (click <a href="http://www.hhs.gov/sites/default/files/ocr-address-verification-email.pdf" target="_blank" rel="noreferrer noopener">here</a> to view a sample OCR email). Failure to respond may result in OCR using publicly available information about your organization to create its audit pool.    

contentpilot/introduction

Receiving an email at this stage does not mean OCR has selected your organization for an audit, but from the responses it receives OCR will create a pool of organizations for Phase 2 audits. These audits will target implemented policies and procedures, likely with a sharp focus on business associate agreements. The first set of audits will be desk audits for covered entities, followed by a second set of desk audits for business associates. If your organization is selected for a desk audit, you will be notified by email and must submit the requested information to OCR within ten business days of the notification. A third set of audits will be conducted onsite and will cover a broader scope of requirements from the HIPAA rules than desk audits. It is anticipated that the results of a desk audit may trigger a subsequent onsite audit and potential investigations if deficiencies are uncovered.  

core/paragraph

core/heading

Due to the tight deadlines imposed by OCR, we recommend that you take the steps below to prepare yourself for a potential audit:

core/list

Further information about the Phase 2 audit process is available on <a href="http://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/index.html" target="_blank" rel="noreferrer noopener">OCR’s website</a>. If you have any questions about the Phase 2 audit process or HIPAA compliance generally, please contact Norbert F. Kugele (616.752.2186 or <a href="mailto:nkugele@wnj.com">nkugele@wnj.com</a>), Kelly Hollingsworth (616.752.2714 or <a href="mailto:khollingsworth@wnj.com">khollingsworth@wnj.com</a>), or any other member of the Data Solutions Practice Group at Warner Norcross &amp; Judd LLP.

Partner

Kelly R. Hollingsworth

Of Counsel

Norbert F. Kugele

Data Analytics and eDiscovery

Check Your Email: HIPAA 2016 Phase 2 Audits Are Underway

Warner Norcross + Judd LLP is responsible for the contents of our advertising and this website. Please read our full <a href="/privacy-policy/" aria-label="see privacy policy">privacy policy</a> available on our website. If you have any questions or comments about our website or our Privacy Policy please contact us at <a href="mailto:info@wnj.com">info@wnj.com</a> or 616.752.2000. 