The Office of Civil Rights (OCR) at the U.S. Department of
Health and Human Services recently published its findings from audits conducted in
2016 and 2017 of covered entities' and business
associates' compliance with selected provisions of
HIPAA's Privacy, Breach Notification, and Security Rules. The
audits included health care providers, health plans, health care
clearinghouses, and business associates. In short, OCR found
material noncompliance with HIPAA's Notice of Privacy
Practices (NPP), right of access, breach notification, and security
risk analysis and risk management requirements.
Key findings from the report include:
- Content of
NPP. Of the covered entities audited,
only 2% fully met the content requirements of a valid NPP. Most
covered entities failed to provide required content related to
individual rights or, in some cases, failed to provide an NPP
written in plain language.
