IT Audit

Article Autumn Hines

Updating HIPAA regulations is a gradual process, starting with feedback requests from the Department of Health and Human Services (HHS) to address outdated or burdensome aspects of the law. Following this, a Notice of Proposed Rulemaking (NPRM) is issued, inviting industry comments before a Final Rule is released. Significant changes proposed for 2024 include changes to the HIPAA Privacy Rule and new requirements for patient access to their Protected Health Information (PHI).

Notably, the timeframe for responding to access requests is shortened, and mandates around electronic health records are clarified. Although these updates aim to streamline processes, they pose implementation challenges for healthcare organizations, including necessary training and policy adjustments. Additionally, the HHS plans to propose new cybersecurity regulations by the end of 2024 to bolster patient data protection amid rising cyber threats.

Recent and Proposed Changes

Proposed New HIPAA Privacy Rule Changes

  • Patients can inspect their PHI in person and take notes or photos.
  • Access to PHI must be provided within 15 days (reduced from 30).
  • Transfers of ePHI to third parties are limited to what’s in an EHR.
  • Individuals can request PHI transfers to personal health applications.
  • Individuals should receive ePHI at no cost in certain situations.
  • Covered entities must inform individuals of their rights regarding PHI summaries.
  • Estimated fee schedules for PHI access must be posted online.
  • Individualized fee estimates for PHI copies are required.
  • A pathway is created to direct the sharing of PHI among entities.
  • Providers must respond to records requests directed under the HIPAA Right of Access.
  • The requirement for written confirmation of privacy notice provision is removed.
  • PHI can be disclosed to prevent reasonably foreseeable threats to health or safety.
  • Certain uses of PHI can be made in good faith for the individual’s best interest.
  • A minimum necessary standard is established for care coordination disclosures.
  • The definition of healthcare operations now includes care coordination.
  • Armed Forces can use or disclose PHI to all uniformed services.
  • A definition for electronic health records is added.

Transaction Code Set Update Adds Three New Codes to enable electronic transmission of healthcare attachment transactions

HHS Healthcare Sector Cybersecurity Strategy Report

  1. Establish voluntary cybersecurity goals for the healthcare sector
  2. Provide resources to incentivize and implement cybersecurity practices
  3. Implement an HHS-wide strategy to support greater enforcement and accountability
  4. Expand and mature the one-stop shop within HHS for healthcare sector cybersecurity

In 2019, OCR maintained robust enforcement efforts, concluding the year with 10 settlements and civil monetary penalties amounting to $12,274,000. Toward the end of the year, OCR launched a new initiative to ensure compliance with the HIPAA Right of Access, which mandates that individuals receive timely access to their medical records for a reasonable, cost-based fee.

Penalty Structure for HIPAA Violations in 2024

Annual Penalty LimitAnnual Penalty LimitMinimum Penalty per ViolationMaximum Penalty per ViolationAnnual Penalty Cap
Tier 1Lack of knowledge$137
$34,464$34,464
Tier 2Reasonable cause$1,379$68,928$137,886
Tier 3Willful neglect$13,785$68,928$344,638
Tier 4Willful neglect (not corrected within 30 days)$68,928$68,928$2,067,813

Article Dean Dorton

No one wants their data to be hacked and used for nefarious gain. Employees, customers, clients, patients, students, and vendors are depending on your organization to protect their data. You have been entrusted with it and they have a reasonable expectation you are going to take steps necessary to keep it out of the wrong hands.

We all understand there is no such thing as 100% secure, therefore “reasonable” is a much more practical goal. Ideally, every organization would prioritize investing time and resources into having an adequately mature cyber security program. However, there are myriad pressures and objectives facing every organization. Sometimes cyber security does not get the attention it needs.

Numerous regulatory bodies have established requirements with the intent of attempting to ensure organizations are adhering to common measures of cyber standards. These requirements vary based on elements such as industry, type of data and geographic location. Once an organization finds themselves falling under data protection regulations, it is common to have multiple, applicable regulatory requirements. Compliance can get complex and seemingly overwhelming quickly. Below are examples of data protections requirements:

Japan – APPI
Brazil – LGPD
Canada – PIPEDA
China – PIPL
European Union – GDPR

CMMC
GLBA
FFIEC
HIPAA
PCI
SOX

Data Break Notification Laws
Data Privacy Laws
State Grants & Contracts

For organizations that want to comply, there are two paths typically taken when faced with this complexity. The first path involves a process that looks good on paper. All the boxes are checked but no value has been provided to the organization other than dodging the penalty and fine bullet for another year. This approach has been common with credit card compliance requirements.

The second path involves a process not only addressing compliance requirements, but also recognizes there are many other objectives that can be accomplished that bring value to the organization. For example, most data regulatory standards require a risk assessment be performed. However, each standard typically narrows the scope to just the applicable processes, systems and data being regulated. If you are performing a risk assessment, why not make it enterprise-wide? The resulting information not only assists with compliance but helps identify other initiatives that are needed.

As previously mentioned, the phrase adequately mature is intended to recognize that each organization has different cyber security needs. Even though this is the case, there are fundamental steps applicable to all organizations that are beneficial to data protection. These steps will help deal with the complexities and provide a clear path forward. See the demonstration below:

https://deandorton.com/wp-content/uploads/2021/10/Cyber-Pyramid-e1635186352566.jpg

Data Inventory
Determine what data you have, where it resides, and who is interested in the data. The “who” element can include internal stakeholders, but for the purposes of compliance make sure to identify external stakeholders. I.E., regulatory bodies. Relevant information to include in your data inventory:

Application/System Name
Version #
Vendor
System Owner
Data Owner
Function/Purpose
Users of System
Primary/Secondary Locations
Sensitive Data Elements*

Alumni/Students
Applicants/Employees
CUI
DOB/SSN/Passport/Visa
Name/Address/Telephone/ID
Patients/Customers/Vendors

Based on the sensitive data elements, identify the applicable regulatory bodies governing data protection.

Cybersecurity Control Framework
Many regulatory bodies recommend or require specific control frameworks. A control framework helps create a vision of what your organizational security program should look like. It provides a path and eliminates the need to create everything from scratch due to the many resources available. Your data inventory will drive selecting the right framework.

See example of cyber security control frameworks:

https://deandorton.com/wp-content/uploads/2021/10/Screenshot-2021-10-20-151610.png

To summarize, one path does take more work and effort, but the results speak for themselves. Subscribe to Dean Dorton Insights to stay up-to-date with the latest regulatory changes.

Explore IT Audit and Compliance Services

Kevin W. Cornwell | IT Audit Associate Director
kcornwell@ddaftech.com
502.566.1011

Article Dean Dorton

Outsourced/Co-sourced IT Internal Audit Solutions

Addressing external or internal compliance requirements is nothing new to public companies, but the requirements are changing at a swift pace. Whether you are looking to accelerate the establishment of an internal IT audit function or realize cost savings by moving to an outsourced model, Dean Dorton can provide your organization with a complete outsourced solution to see rapid results. Many organizations large enough to have an internal audit department are often not large enough to employ full-time IT audit resources—we can fill your need for the IT internal audit function. The breadth and depth of our skilled IT internal audit professionals makes your business more efficient, ensures objectivity, and allows you to focus on your core functions.

Consider these questions:

  • Are you having difficulty finding Internal IT Audit talent?
  • Are you struggling to stay educated on various IT compliance requirements?
  • Are there key IT controls that should be tested regularly but aren’t?
  • Are you relying on an external audit firm to perform testing of IT controls?
  • Have you identified areas of concern regarding your IT controls?
  • Have there been, or will there be, significant changes to systems and/or processes?

If you answered “Yes” to any of these questions, Dean Dorton’s team of IT Audit and Compliance professionals can add value to your organization through our outsourced/co-sourced internal IT audit solutions.

Our Methodology

1. Determine Approach and Scope

We will conduct interviews with management and the Audit Committee to assess the scope of the internal audit plan and how our testing should be performed to best benefit your organization. Our previous internal audit experiences will help drive the questions and provide focus for the internal audit plan.

2. Develop Work Programs

We will develop work programs. The work programs will be consistent with your needs or any regulatory compliance and will also include key dates and reporting requirements. The work programs will list out the objectives and steps to be performed.

3. Perform Audit

We form a best-in-class team to meet the audit needs and work with you to create a schedule that fits your desired timeline. We work very hard to maintain continuity of the engagement team to enhance efficiencies of the work. We use a collaborative, online project management tool to actively manage, share status updates and communicate throughout the project.

4. Reporting to Audit Committee and Management

At the completion of our testing we provide a draft report to management for its review. The report includes the objectives, findings, and recommendations of the project. If appropriate, management will have a chance to respond to any recommendations prior to the report’s submission to the Audit Committee.

Learn More

Article Dean Dorton

The challenges posed by the coronavirus (COVID-19) continue to grow and evolve with each passing day. Organizations require timely information and a sophisticated approach to manage the pandemic’s impacts on employee health and productivity, fiscal implications, supply chain disruptions, cybersecurity vulnerabilities, the health of local and global markets, and more.

We are seeing internal audit efforts being pushed off or delayed by many organizations. Many internal audit departments are struggling with the decision to either continue with scheduled internal audits, or change their plans and audit areas that may be easier to manage remotely. Some are even considering if they should cancel the audit all together and not bother the organization at all. We believe that internal audit has an important role to play in supporting organizational efforts and will help management navigate the many challenges they are facing. 

As most companies transition to having a remote workforce, there are many controls that might change in the process. Internal audit needs to review these controls to ensure they are working efficiently and effectively.

Controls to be reviewed and/or tested include:

  • Cash disbursements: Are there two levels of approval for all disbursements? Is there proper supporting documentation for all disbursements? Do you still have proper segregation of duties?
  • Cash receipts: Are cash receipts still being deposited timely? Is someone monitoring customer situations and payments to ensure bad debts do not increase greatly? Do you still have proper segregation of duties?
  • Monthly reconciliations: Are all monthly reconciliations still being completed timely and properly?
  • Vendors: Who and how is the organization updating mission critical vendors and understanding how COVID-19 has impacted them? If they go away or are substantially impacted how does that impact your organization?

Internal auditors also need to determine where fraud risk has increased and perform testing in those areas. The current situation might increase the risk of fraud because there may be more opportunities to commit fraud due to controls not being adequate and employees feeling increased financial pressure due to significant other losing their job. Additionally, cybersecurity threats and frauds have increased due to more people working remotely and relying more heavily on electronic communications instead of face-to-face or phone conversations.

Internal auditors should also provide assistance and value to management in other areas:

  • Review loan applications for accuracy
  • Relative to compliance with stimulus loans, the internal audit team should assess any new controls needed to track the administration of loan proceeds to ensure compliance and possible forgiveness under the payroll protection loan program. The internal audit team should also have visibility and input on the development of any new controls to help with compliance.
  • Review of cash forecasts and budgets

Lastly internal audit departments need to ensure they have the proper processes, procedures and protocols in place to perform “remote audits.” Internal audit departments should communicate thoroughly with the Audit Committee to see how COVID-19 is being addressed by the organization  in order to accurately update risk assessments and document changes.

We know many of these things are hard to do remotely, especially if you are facing dramatic staffing changes. Dean Dorton’s internal audit team can provide short-term assistance as well as long-term planning guidance as you prepare for things to get back up and running. It is vital that you have a plan before acting, in order to stay compliant but also make it easier on yourself for analyzing and reporting in the long run. Please do not hesitate to reach out with any questions.

For more information on how the Coronavirus is impacting businesses across multiple industries, visit our COVID-19 resource page:

COVID-19 Resources