What Triggers a HIPAA Audit?

If you only have time for one thing today, then make HIPAA compliance for counselors the topic you spend some time on.  Why? Besides the obvious, PHI (protected health information) is valuable. What do you do if that thing that makes you reach for the Tums and the Imodium happens and you recognize that you just accidentally released protected health client information? Get consultation, tell everyone who was impacted, (for more details check out the show notes from my interview with Vanessa Hillis here) and then get ready for a HIPAA audit.

HIPAA Compliance for Counselors After a Violation

When you go to the Health and Human Services website for professionals (and I just googled Breach Notification), you’ll see the definition of a breach is, and breach notification requirements. Preparing for the audit means proactively taking the steps to remediate and fix the problem. Document that you 

• Consulted with a trusted professional
• Notified those impacted according to HIPAA guidelines 
• Self-reported to your licensing board (if applicable). 
• Implemented a course of action that addressed the problem

How to Address a HIPAA Violation

Divide the problem (or problems) into ‘fix now,' ‘fix later,' and ‘fix never' categories. For example, let’s say in your office, your lock is broken. Well, yeah, that needs to be fixed right now. Go to Ace Hardware or call your landlord and get a new lock. On the other hand, Is this an email issue and you can’t afford a higher cost software? Document that this is a known issue and you’ve decided to fix it by not emailing clients anymore (see my You Tube Video When Good Software Goes Bad).

What is a Self-Audit?

If it is a known issue in your practice or with your system, and you are electing not to fix it now, and instead you’re going to train everybody in your office how to work around it, you will note this in your self-audit. Additionally, document how you will train new practitioners, because guess what? Any time you add new people; that’s a liability. It’s a known issue.

How To Learn More

This was a quick and dirty rundown about what triggers a HIPAA audit and what to do next. If you want to go deeper, click on the links I mention, and check out the HHS website. If you want resources just for counselors, check out my show notes, and my You Tube channel.

Blog post by Kate Walker Ph.D., LPC/LMFT Supervisor

Looking for resources for your supervision practice? Get the Essential Guide for Self-Employed Mental Health Professionals

Opt in Free Guide to SelfEmployed