HIPAA Audit and Enforcement Updates for 2023

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law that protects the privacy of patients' health information and sets standards for the security of electronically protected health information (ePHI). The U.S. Department of Health and Human Services (HHS) is responsible for enforcing HIPAA and ensuring that covered entities (such as hospitals and insurance companies) and their business associates (such as third-party billing companies) are in compliance with the law.

In 2023, HIPAA audits and enforcement activities are likely to continue to focus on areas such as:

Data breaches: HIPAA requires covered entities and business associates to report data breaches involving ePHI to HHS and, in some cases, to affected individuals. HHS investigates reported breaches and may take enforcement action if it determines that the covered entity or business associate violated HIPAA rules.

Risk assessments: HIPAA requires covered entities and business associates to conduct regular risk assessments to identify potential vulnerabilities in their systems and to implement appropriate safeguards to protect ePHI. HHS may audit covered entities and business associates to ensure that they are conducting risk assessments and implementing appropriate safeguards.

Business associate agreements: HIPAA requires covered entities to have written agreements with their business associates that outline the business associates' responsibilities for protecting ePHI. HHS may audit covered entities to ensure that they have entered into appropriate business associate agreements.

HIPAA training: HIPAA requires covered entities and business associates to provide HIPAA training to their workforce members. HHS may audit covered entities and business associates to ensure that they are providing appropriate HIPAA training to their workforce.

It's important for covered entities and business associates to stay up to date on HIPAA audit and enforcement activities and to take steps to ensure that they are in compliance with the law. This can help to protect the privacy of patient's health information and to avoid costly fines and penalties.