HIPAA may show up in areas you haven’t seen before. If you are assessed by any other organization or for any other reason, HIPAA questions may start showing up.
We have heard or seen HIPAA showing up in many new areas like:
- Insurance Policy Applications
- Partnership Negotiations
- Funding discussions
- URAC accreditation (formerly known as the Utilization Review Accreditation Commission)
This episode is a discussion on why HIPAA is showing up in other places and why we expect that trend to continue.
HIPAA Assessments In Other Places Now, Really?
Don’t think it is just the OCR or HHS who may be asking you about your HIPAA compliance. The times they continue to change. More places keep showing up where HIPAA is creeping into the mix. It is like a ooze of compliance filling holes that people didn’t know existed.
[2:19] HIPAA Ooze. Maybe like the Mutant Ninja Turtle Ooze. [5:19] Utilization Review Accreditation Commission (URAC) audit now asking for specific HIPAA compliance evidence.- Updates every 3 years
- 3 years ago little if any HIPAA references
- Risk Analysis and other specifics included now
- Prospects and Clients for BAs asking for HIPAA compliance proof.
Multiple requests for details on the compliance and security programs for software companies.
[9:36]BA due diligence questions from long standing clients are going to be showing up for BAs, that are going to be surprised. HIPAA assessments will start to matter much more than many of them think they do today.
Venture capital folks will be asking to see HIPAA compliance evidence for healthcare IT companies before their investment. HIPAA assessments will help them have some indication of the breach liabilities they may be taking on with an investment or loan.
[14:43] Just a matter of time before patients will be asking about it as they vet you against other providers. Do you really work miracles so spectacular that I am willing to give up my privacy? [20:08] What about a potential new hire or partner asking about it. Would you want to join an organization that isn’t doing the work? What if you tied yourself to a group and never asked about it. Three months after you start there is a major breach. Years of legal responses to OCR, dealing with reputation issues and monitoring protections for patients, fines and CAPs will be required. It is worth asking before making those commitments.As we mentioned before: The climate of data breaches will only continue moving more businesses under the requirement to meet these types of obligations.
