U.S. Department of Health and Human Services’ Office for Civil Rights Archives

HHS Letter Reiterates Expectations for Language Accessibility

by Gregory Fosheim and Emily Curran | Dec 17, 2024 | Employee Benefits, Health and Welfare Plans

On December 5, 2024, the US Department of Health and Human Services Office for Civil Rights issued a “Dear Colleague” letter reiterating obligations that covered entities have under the May 2024 final rule related to language access requirements under Section 1557 of the Affordable Care Act. Section 1557 prohibits discrimination on the basis of race, color, national origin, sex, age, or disability in covered health programs and activities. The final rule strengthened many protections against discrimination in healthcare, including rules for providing language assistance to individuals with limited English proficiency (LEP) or disability. This Dear Colleague letter had the goal of outlining key requirements to ensure that covered entities provide meaningful language access to individuals in time for the June 5, 2025, deadline for full implementation.

OCR Launches Phase 2 HIPAA Audit Program with Pre-Audit Screening Surveys

by Edward G. Zacharias, Daniel F. Gottlieb and Ryan S. Higgins | May 26, 2015 | Health and Welfare Plans, Privacy and Data Security

HIPAA covered entities have reported that the HHS Office for Civil Rights recently sent pre-audit screening surveys to a pool of covered entities that may be selected for the previously delayed second phase of HIPAA compliance audits. This On the Subject describes the phase two audit program and identifies steps that covered entities and business associates should take to prepare for these audits.

Read the full article.

OCR to Begin Phase 2 of HIPAA Audit Program

by Edward G. Zacharias and Daniel F. Gottlieb | Aug 26, 2014 | Health and Welfare Plans, Privacy and Data Security

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) will soon begin a second phase of audits (Phase 2 Audits) of compliance with Health Insurance Portability and Accountability Act of 1996 (HIPAA) privacy, security and breach notification standards (HIPAA Standards) as required by the Health Information Technology for Economic and Clinical Health (HITECH) Act. Unlike the pilot audits during 2011 and 2012 (Phase 1 Audits), which focused on covered entities, OCR will conduct Phase 2 Audits of both covered entities and business associates. The Phase 2 Audit Program will focus on areas of greater risk to the security of protected health information (PHI) and pervasive noncompliance based on OCR’s Phase I Audit findings and observations, rather than a comprehensive review of all of the HIPAA Standards. The Phase 2 Audits are also intended to identify best practices and uncover risks and vulnerabilities that OCR has not identified through other enforcement activities. OCR will use the Phase 2 Audit findings to identify technical assistance that it should develop for covered entities and business associates. In circumstances where an audit reveals a serious compliance concern, OCR may initiate a compliance review of the audited organization that could lead to civil money penalties.

The following sections summarize OCR’s Phase 1 Audit findings, describe the Phase 2 Audit program and identify steps that covered entities and business associates should take to prepare for the Phase 2 Audits.

Read the full article.