Question 1

What is HIPAA?

Accepted Answer

HIPAA stands for the Health Insurance Portability and Accountability Act, a federal law enacted in 1996 that sets national standards for protecting sensitive patient health information. It requires healthcare organizations and their partners to implement physical, administrative, and technical safeguards to ensure the confidentiality, integrity, and availability of protected health information (PHI). Non-compliance can result in civil and criminal penalties ranging from $100 to $1.9 million per violation category per year.

Question 2

Who needs to comply with HIPAA?

Accepted Answer

HIPAA applies to two main groups: Covered Entities (CEs) and Business Associates (BAs). Covered Entities include healthcare providers who conduct electronic transactions (doctors, dentists, hospitals, pharmacies), health plans (insurance companies, HMOs), and healthcare clearinghouses. Business Associates are vendors or contractors who handle PHI on behalf of a Covered Entity — including billing companies, IT providers, cloud storage vendors, and consultants. If your organization touches PHI in any way, HIPAA likely applies to you.

Question 3

What does One Guy Consulting (OGC) do?

Accepted Answer

One Guy Consulting provides an end-to-end HIPAA compliance platform through a web-based portal. The platform guides your organization through the full compliance lifecycle: Security Risk Assessment, gap analysis, policy and procedure management, employee training, vendor/BAA management, physical and IT audits, and incident response. OGC combines expert-curated content with practical tools so small and mid-sized healthcare organizations can achieve and maintain HIPAA compliance without hiring a full-time compliance team.

Question 4

How long does HIPAA compliance take?

Accepted Answer

For most small practices, we expect about 30 days time until completion. No worries if it goes a bit long or short of that; We're still doing our 'due diligence' in the eyes of the law.

Question 5

What is the difference between a Covered Entity and a Business Associate?

Accepted Answer

A Covered Entity (CE) is an organization that directly provides or pays for healthcare — physicians, dentists, hospitals, health insurance plans, and clearinghouses. A Business Associate (BA) is any third party that creates, receives, maintains, or transmits PHI while performing services for a CE — think your EHR vendor, cloud backup provider, or billing service. BAs must sign a Business Associate Agreement (BAA) and are directly liable under HIPAA. Subcontractors of BAs who touch PHI are also considered BAs.

Question 6

Do I need a designated Privacy Officer?

Accepted Answer

Yes. HIPAA's Privacy Rule requires every Covered Entity to designate a Privacy Officer responsible for developing and implementing privacy policies and procedures. The Security Rule also requires a Security Officer to oversee the security program. In small practices these roles are often held by the same person — frequently the practice owner or office manager. The OGC portal has a dedicated Privacy Officer dashboard to support whoever holds this role.

Question 7

What is the first step to becoming HIPAA compliant?

Accepted Answer

There are numerous ways to become HIPAA compliant, so this answer pertains to our process and how we recommend organizations go about implementing it. When using the OGC Portal, the first step is to name a Privacy Officer. You will be locked out of the next steps until this crucial element is satisfied.

Question 8

What does the OGC compliance portal do?

Accepted Answer

The One Guy Consulting Compliance Portal is a web-based SaaS platform that supports your organization's HIPAA compliance journey from start to finish. Features include formal role governance, security risk assessment, automatic gap analysis and remediation tracking, policy and procedure management, employee training (HIPAA 101 plus cybersecurity awareness) with policy attestation, a Privacy Officer training tracker for employees, automated business associate agreement workflows, and a 24/7 incident reporting system, all in a single dashboard.

Question 9

Is my data secure in the OGC portal?

Accepted Answer

Yes. The OGC portal is built on Supabase, which uses industry-standard AES-256 encryption at rest and TLS 1.2+ in transit. Access is role-based, meaning employees only see what they need to see. OGC does not store actual patient records — the portal handles compliance documentation, not clinical data. A signed BAA is available for organizations that require one for their vendor records.

Question 10

What is a Security Risk Assessment (SRA)?

Accepted Answer

A Security Risk Assessment is a formal evaluation of the threats and vulnerabilities that could compromise the confidentiality, integrity, or availability of your electronic Protected Health Information (ePHI). It is the foundational requirement of the HIPAA Security Rule (45 CFR § 164.308(a)(1)) and must be completed before any other security safeguard work is considered meaningful. The SRA identifies what data you have, where it lives, what could go wrong, and how serious those risks are.

Question 11

How often must I perform a Security Risk Assessment?

Accepted Answer

HIPAA requires the SRA to be conducted on an ongoing basis — not just once. HHS OCR guidance recommends completing a full SRA at least annually, and also any time a significant change occurs: moving to a new EHR, adding a cloud service, opening a new location, or experiencing a breach. In practice, most organizations should plan for a formal annual review and update the SRA whenever the environment changes materially.

Question 12

What happens if I fail the Security Risk Assessment?

Accepted Answer

There is no 'pass' or 'fail' in the traditional sense — the SRA is not graded by HHS. What matters is that you completed it thoroughly, documented your findings honestly, and developed a remediation plan to address identified risks. An SRA that reveals many high risks is not a problem as long as you are actively working to reduce them. What regulators penalize is the absence of an SRA or evidence that findings were ignored with no corrective action.

Question 13

How do I answer SRA questions I don't understand?

Accepted Answer

The OGC portal includes plain-language explanations for every SRA question — just click the help icon next to any item. If you are still unsure, it is better to answer conservatively (treat the risk as higher) than to guess incorrectly in the other direction. You can also flag questions for follow-up within the portal and return to them. When in doubt, contact OGC support for guidance before submitting your final assessment.

Question 14

How long does completing the SRA take?

Accepted Answer

Most small-to-mid-size practices complete the OGC SRA in 2–4 hours of focused work. The length depends on how many systems, locations, and user roles your organization has. The portal lets you save progress and return, so you do not need to finish in one session. Larger organizations with multiple locations or complex IT environments may need 8–12 hours spread across a few sessions.

Question 15

What is the difference between a risk and a vulnerability?

Accepted Answer

A vulnerability is a weakness in your environment — for example, using weak passwords or leaving workstations unlocked. A risk is the combination of that vulnerability with a threat that could exploit it and the likelihood and impact if that happens. Not every vulnerability becomes a high risk: a server in a locked room with no internet access has vulnerabilities, but those risks are low because the likelihood of exploitation is low. The SRA helps you score each combination so you know where to focus first.

Question 16

Do I need to fix everything the SRA identifies?

Accepted Answer

No — you need to address everything, but 'addressing' does not always mean 'fixing immediately.' HIPAA allows organizations to accept certain risks when the cost of mitigation is disproportionate to the likelihood and impact. What is required is that you document your risk decisions: which risks you are remediating, which you are mitigating with compensating controls, and which you are formally accepting with documented rationale. The OGC remediation plan module captures all of this.

Question 17

Can I do my own Security Risk Assessment?

Accepted Answer

Yes, organizations can self-administer an SRA. The OGC portal is specifically designed for this — it guides you through every required element without needing a cybersecurity background. HHS also provides a free SRA Tool, though it produces a spreadsheet rather than a structured action plan. For complex environments or organizations that have recently had a breach, engaging an outside consultant to validate the SRA may be worthwhile, but it is not required.

Question 18

What documentation do I need for a HIPAA audit?

Accepted Answer

Auditors will want to see: a completed and dated SRA, a remediation or risk management plan, evidence that identified risks are being addressed, current and signed policies and procedures, training completion records for all workforce members, executed BAAs with all Business Associates, and incident response logs. The OGC portal stores and timestamps all of this automatically, so if you are audited you can export a complete compliance package.

Question 19

What are the most common SRA findings?

Accepted Answer

The most frequently identified risks in small practice SRAs are: lack of multi-factor authentication on systems containing ePHI, unencrypted laptops and mobile devices, no formal password policy or enforcement, missing or expired BAAs, inadequate audit logging and access controls, and insufficient workforce training. These are also the items OCR most commonly cites in enforcement actions, which is why the OGC portal highlights them prominently.

Question 20

What is a compliance gap?

Accepted Answer

A gap is the difference between what HIPAA requires and what your organization currently does. For example, HIPAA requires a formal sanction policy for employees who violate privacy rules — if you don't have one documented, that's a gap. Gaps are identified through your SRA findings, policy review, and audit results. Not all gaps carry the same weight; some are technical deficiencies, others are administrative, and they vary significantly in potential risk.

Question 21

How are gaps scored in the OGC portal?

Accepted Answer

Gaps are scored using a risk-based matrix that considers two factors: likelihood (how probable is it that this gap will be exploited or result in a violation?) and impact (how serious would the consequences be?). Each factor is rated Low, Medium, or High, and the combination produces an overall risk score. High-impact, high-likelihood gaps appear at the top of your remediation queue. This prioritization helps you allocate limited time and resources to the most important issues first.

Question 22

How are remediation plans generated?

Accepted Answer

When the OGC portal identifies a gap, it automatically generates a suggested remediation task with a plain-English description of what needs to be done, why it matters, and which HIPAA rule section it satisfies. You can assign the task to a team member, set a due date, add notes, and track progress. The system does not auto-fix anything — compliance actions require human decisions — but it does eliminate the guesswork about what to do next.

Question 23

Do I need to fix every gap immediately?

Accepted Answer

No. HIPAA does not require instantaneous compliance — it requires reasonable and appropriate safeguards and documented progress toward addressing known gaps. The key is to prioritize high-risk gaps, have a written plan for medium and lower-risk items, and show consistent forward movement. Regulators understand that remediation takes time and resources; what they look for is evidence that the organization is taking compliance seriously and not ignoring known problems.

Question 24

What is a reasonable remediation timeline?

Accepted Answer

For critical gaps (e.g., unencrypted PHI stored on an internet-facing system), 30 days or less is appropriate. High-risk gaps typically warrant a 60–90 day remediation window with interim compensating controls in place. Medium-risk items can reasonably be addressed within 6 months, and low-risk items within 12 months. The important thing is that timelines are documented, assigned, and actually met. The OGC portal sends reminders for overdue remediation tasks.

Question 25

How do I document remediation progress?

Accepted Answer

In the OGC portal, each gap has a task card where you can update the status (open, in progress, resolved), add notes, attach evidence, and mark completion with a timestamp. For audit purposes, this creates a clear chain of evidence showing what was found, what was done, and when. Best practice is to update task status at least monthly so the record reflects ongoing effort rather than a one-time snapshot.

Question 26

What if a gap genuinely cannot be fixed?

Accepted Answer

Some gaps cannot be fully remediated — for example, a legacy medical device that cannot be updated may not support encryption. In these cases, HIPAA allows for compensating controls and formal risk acceptance. You document the gap, explain why full remediation is not feasible, describe the compensating controls in place (like network isolation), and formally accept the residual risk with a management signature. The OGC portal includes a risk acceptance workflow for exactly this scenario.

Question 27

Who should own remediation tasks?

Accepted Answer

Remediation tasks should be assigned to the person with the authority and knowledge to actually complete them — not just to the Privacy or Security Officer. IT-related tasks belong to the IT lead or managed service provider. Policy tasks belong to the Privacy Officer or practice administrator. Training tasks belong to HR or a department manager. The OGC portal lets you assign tasks to specific team members and track accountability. Distributing ownership prevents one person from becoming a bottleneck.

Question 28

Do I write my own HIPAA policies, or does OGC provide templates?

Accepted Answer

OGC provides a complete library of HIPAA-required policy templates covering both the Privacy Rule and Security Rule. These are professionally written, legally accurate templates that you customize to reflect your organization's specific practices, names, and workflows. You are not expected to write policies from scratch. The key is that policies must be tailored to your organization — a policy that says 'Employee X' or 'System Y' is far more defensible than a generic template left unedited.

Question 29

How do I customize policy templates in the portal?

Accepted Answer

The policy editor in the OGC portal lets you edit template text directly in the browser. Placeholder fields (like your organization name, Privacy Officer name, and effective date) are highlighted so you can fill them in quickly. You can also add organization-specific sections, update procedure steps to match your actual workflows, and save version history. Once finalized, policies can be published to employees for acknowledgment and signature.

Question 30

How often should I update my HIPAA policies?

Accepted Answer

HIPAA requires policies to be reviewed and updated periodically — at minimum annually — and whenever there is a material change to your environment or operations. Material changes include: adopting a new EHR or cloud system, hiring a new Privacy Officer, opening or closing a location, experiencing a breach, or changes in applicable law. The OGC portal tracks the last-reviewed date on each policy and flags any that are more than 12 months old.

Question 31

What is the difference between a policy and a procedure?

Accepted Answer

A policy states what your organization will do — the high-level commitment or rule. A procedure explains how you will do it — the specific step-by-step actions, responsibilities, and timelines. For example, a policy might say 'All workforce members must receive HIPAA training upon hire.' The corresponding procedure would specify the training modules required, who assigns them, the completion deadline, and how completion is recorded. Both are required by HIPAA and both should be documented.

Question 32

What policies are explicitly required by HIPAA?

Accepted Answer

The Privacy Rule requires policies covering: use and disclosure of PHI, minimum necessary standard, patient rights (access, amendment, accounting of disclosures), Notice of Privacy Practices, complaints, and sanctions. The Security Rule requires policies covering: access control, audit controls, information system activity review, workstation use and security, device and media controls, incident response, contingency planning, and Business Associate management. OGC's policy library includes templates for every required area.

Question 33

How do employees access the policies assigned to them?

Accepted Answer

Employees log into the OGC portal with their own credentials and see a personalized dashboard showing policies they need to review. Each policy includes the full text so employees can read it before acknowledging. Once they click 'Acknowledge,' the system records their name, the date, and the policy version — creating a permanent audit trail. The Privacy Officer dashboard shows real-time completion rates and can send reminder notifications to employees who haven't completed their acknowledgments.

Question 34

What is policy attestation?

Accepted Answer

Policy attestation is the formal process by which an employee confirms they have read and understood a policy. It is the digital equivalent of signing a paper form saying 'I have received and read this policy.' HIPAA requires that workforce members be trained on and acknowledge key policies. The OGC portal captures attestations electronically with a timestamp and stores them permanently so you can demonstrate compliance to auditors or investigators.

Question 35

How do I track who has read which policies?

Accepted Answer

The Privacy Officer's Policies dashboard in the OGC portal shows every policy, which employees it has been assigned to, and who has and has not completed their attestation. You can filter by department, policy, or individual. For employees who haven't acknowledged, you can send a reminder directly from the dashboard. Reports can be exported for audit purposes. This replaces paper sign-off sheets and manual spreadsheet tracking.

Question 36

What HIPAA training is required for employees?

Accepted Answer

HIPAA requires that all workforce members receive training on policies and procedures relevant to their job functions, and that this training is provided upon hire and periodically thereafter. The Security Rule also requires security awareness training for all workforce members. In practice, this means every employee who handles PHI — or works in an environment where PHI is present — needs training. This includes clinical staff, administrative staff, IT personnel, and contractors.

Question 37

How often must HIPAA training occur?

Accepted Answer

HIPAA mandates training upon hire and periodically thereafter — the regulation does not specify a fixed interval. Industry best practice and most compliance frameworks (including those recommended by HHS) treat annual training as the standard. Training should also be provided whenever policies change significantly, after a security incident, when new systems are adopted, or when an employee moves to a role with different PHI access.

Question 38

What are the 3 training modules employees must complete in the OGC portal?

Accepted Answer

The OGC portal requires employees to complete three core training modules: (1) HIPAA 101 — foundational concepts covering what PHI is, employee rights and responsibilities, the minimum necessary rule, and common violations; (2) Cybersecurity Awareness — practical guidance on password hygiene, phishing recognition, safe device use, and incident reporting; and (3) Policies — reading and attesting to the organization's specific HIPAA policies. Together, these three fulfill both the Privacy and Security Rule training requirements.

Question 39

How do I track training completion as a Privacy Officer?

Accepted Answer

The Privacy Officer dashboard includes a Training section that shows completion status for every employee across all three modules. You can see a percentage complete by module, filter by department or individual, view exact completion timestamps, and export a full compliance report. Employees who have not started or completed training are flagged, and you can send reminder emails directly from the dashboard without leaving the portal.

Question 40

What topics should HIPAA training cover?

Accepted Answer

Comprehensive HIPAA training should address: what PHI and ePHI are, who is covered under HIPAA and why it matters, the minimum necessary rule, permitted uses and disclosures, patient rights, breach recognition and reporting obligations, physical safeguards (clean desk, screen privacy), technical safeguards (password policies, encryption, two-factor authentication), social engineering and phishing threats, and the organization's specific sanctions for violations. OGC's training modules cover all of these areas.

Question 41

Do contractors and temporary workers need HIPAA training?

Accepted Answer

Yes. HIPAA applies to anyone in your 'workforce,' which the regulation defines as employees, volunteers, trainees, and other persons whose conduct is under the direct control of the Covered Entity — regardless of whether they are paid. Contractors who access PHI are typically considered Business Associates and require a BAA, but if they are working on-site and could encounter PHI incidentally, HIPAA-awareness training is still appropriate. When in doubt, train them.

Question 42

What if an employee refuses to complete HIPAA training?

Accepted Answer

Refusal to complete required HIPAA training is a workforce conduct issue that should be addressed through your organization's sanction policy. HIPAA requires you to have and apply appropriate sanctions for employees who fail to comply with privacy and security policies — and refusing to complete mandatory training qualifies. Typical responses escalate from a verbal warning to written warning, and ultimately could warrant termination for repeated non-compliance. Document all actions taken.

Question 43

How long should HIPAA training take?

Accepted Answer

The OGC HIPAA 101 module takes approximately 20–30 minutes to complete. The Cybersecurity Awareness module takes 15–20 minutes. Policy attestation time varies based on how many policies an employee is assigned, but typically takes 10–20 minutes. Total initial training time for a new employee is generally 45–75 minutes. Annual refreshers for returning employees are shorter since they are already familiar with the material.

Question 44

What is a Business Associate Agreement (BAA)?

Accepted Answer

A Business Associate Agreement is a written contract required by HIPAA between a Covered Entity (or Business Associate) and any third party that creates, receives, maintains, or transmits PHI on their behalf. The BAA establishes the permitted uses of PHI, the safeguards the vendor must maintain, breach notification obligations, and what happens to PHI when the agreement ends. Without a signed BAA, sharing PHI with a third party is a HIPAA violation.

Question 45

When do I need a BAA with a vendor?

Accepted Answer

You need a BAA any time a vendor will have access to PHI as part of the service they provide. This includes: your EHR vendor, cloud storage providers (even if used to backup administrative data), billing companies, transcription services, IT managed services providers who might access systems containing PHI, email encryption providers, and accountants if they handle payment information tied to patients. The key question is: could this vendor ever see, handle, or have access to PHI? If yes, you need a BAA.

Question 46

What if a vendor refuses to sign a BAA?

Accepted Answer

If a vendor refuses to sign a BAA, you cannot legally share PHI with them — period. You have two options: find an alternative vendor who will sign a BAA, or restructure the relationship so that the vendor never has access to PHI. Many large vendors (Google Workspace, Microsoft 365, Dropbox Business) offer HIPAA BAAs as part of their enterprise or business plans. If a vendor says 'we don't sign BAAs,' that is a red flag indicating they are not prepared to handle healthcare data appropriately.

Question 47

What should a BAA include?

Accepted Answer

A compliant BAA must include: the permitted and required uses and disclosures of PHI, a requirement that the BA implement appropriate safeguards, a requirement to report breaches and security incidents, requirements to ensure subcontractors also sign BAAs, a requirement to make PHI available for patient access and HHS audits, and provisions for returning or destroying PHI when the agreement terminates. OGC provides a BAA template generator in the portal that meets all statutory requirements.

Question 48

How do I track BAA status with all my vendors?

Accepted Answer

The Vendors section of the OGC portal is your BAA registry. For each vendor, you can record the agreement status (pending, signed, expired), the effective date, the expiration or review date, and upload the executed BAA document. The dashboard flags any vendors with missing, pending, or expiring BAAs so nothing falls through the cracks. You can also send a vendor a digital BAA for e-signature directly from the portal.

Question 49

What is a vendor risk questionnaire?

Accepted Answer

A vendor risk questionnaire is a standardized set of questions you send to a potential or existing vendor to assess their security posture and HIPAA compliance practices. Good questionnaires ask about encryption standards, access control policies, breach history, employee training, subcontractor management, and incident response capabilities. The OGC portal includes a pre-built vendor risk questionnaire that you can send electronically, and stores responses for each vendor.

Question 50

When does a vendor become a Business Associate?

Accepted Answer

A vendor becomes a Business Associate the moment they perform a function or activity on your behalf that involves the use or disclosure of PHI. This is not about whether they 'see' PHI — it's about whether PHI could be accessible to them. If you give your IT provider admin access to a system that contains patient records, they are a BA even if they never open a patient file. A janitorial service that cleans your waiting room but has no access to records is not a BA.

Question 51

How often should I review vendor BAAs and relationships?

Accepted Answer

BAAs should be reviewed at least annually — and any time the scope of the vendor's access to PHI changes significantly. If a vendor undergoes a merger or acquisition, or changes the systems they use to process your data, that warrants an immediate review. The OGC portal sets default review reminders at 12 months from the BAA effective date. You should also review your vendor list whenever you adopt a new technology to ensure all new vendors are captured.

Question 52

What is a physical security audit under HIPAA?

Accepted Answer

A physical security audit evaluates the physical safeguards protecting locations where PHI is accessed or stored. HIPAA's Security Rule (45 CFR § 164.310) requires Covered Entities to implement facility access controls, workstation use policies, and device and media controls. A physical audit walks through your office or facility to assess: door locks and badge access, visitor management, screen visibility, paper PHI handling, and secure disposal of records and devices.

Question 53

How do I create an ePHI device inventory?

Accepted Answer

A device inventory lists every piece of hardware that stores, processes, or transmits ePHI. This includes desktops, laptops, tablets, smartphones, servers, network-attached storage, printers with hard drives, and medical devices with connectivity. For each device, record the device type, make/model, serial number, user assigned, operating system, encryption status, and location. The OGC Device Audit module provides a structured template for this inventory and tracks its review history.

Question 54

What does an IT risk assessment cover?

Accepted Answer

An IT risk assessment evaluates the technical safeguards protecting ePHI. It covers: network security (firewalls, intrusion detection, segmentation), access control (user accounts, permissions, multi-factor authentication), audit logging (who accessed what and when), encryption (data at rest and in transit), patch management (are systems up to date?), backup and recovery, remote access security, and anti-malware protections. The OGC IT Risk Assessment module walks through each of these areas systematically.

Question 55

How often should I conduct compliance audits?

Accepted Answer

At minimum, each audit type should be conducted annually. Physical security audits are typically done once a year and after any significant facility change (renovation, new location, change in security vendor). IT risk assessments should be done annually and after any major technology change. Device audits should be conducted at least annually, but device inventory should be updated continuously as devices are added or retired. More frequent audits are appropriate for higher-risk environments.

Question 56

What are common physical security audit findings?

Accepted Answer

The most common physical security findings in healthcare settings are: computer screens visible from waiting rooms or hallways, unlocked workstations left unattended, paper PHI left on desks rather than secured, visitor log not maintained or inadequate, server room access not properly controlled, medical records not stored in locked cabinets, and printed documents containing PHI not shredded before disposal. Many of these are low-cost fixes that significantly reduce risk.

Question 57

What is the difference between the three audit types in OGC?

Accepted Answer

The OGC portal offers three distinct audit modules: Physical Audit — assesses facility access, workstation security, visitor management, and paper PHI handling; IT Risk Assessment — evaluates technical controls including network security, access management, encryption, and incident response; and Device/Data Audit — inventories all hardware and removable media that store ePHI, assessing encryption status and access controls for each device. Together, the three audits satisfy the full scope of HIPAA's physical and technical safeguard requirements.

Question 58

How do I track ePHI access on devices?

Accepted Answer

Tracking ePHI access requires audit logging at the application and system level. Your EHR should maintain access logs showing which user accounts accessed which records and when. Operating systems and servers can also generate event logs. The OGC Device Audit module asks you to document whether audit logging is enabled on each device and whether logs are reviewed regularly. HIPAA requires you to review activity logs on an ongoing basis — not just store them.

Question 59

What does a workstation security audit look for?

Accepted Answer

A workstation audit examines each computer that accesses ePHI and checks: whether the screen locks automatically after a defined period of inactivity, whether the drive is encrypted, whether the operating system and software are current and patched, whether anti-malware is installed and active, whether users have only the permissions they need (least privilege), and whether the physical placement of the screen prevents unauthorized viewing. The OGC physical audit form includes a workstation checklist for each device in your environment.

Question 60

Do I need to audit home offices and remote workers?

Accepted Answer

Yes. HIPAA's safeguard requirements apply regardless of where work is performed. If employees access ePHI from home — even occasionally — those home workstations and networks must meet the same safeguard standards as your office. This means encrypted hard drives, VPN use for accessing internal systems, locked screens, and secure disposal of any printed PHI. The OGC portal includes remote/home office assessment questions in the workstation audit section.

Question 61

What documentation do I need for each audit?

Accepted Answer

For each audit, you need: a completed audit form with findings documented, the date of the audit and who conducted it, a list of identified deficiencies and their risk ratings, a remediation plan with assigned owners and due dates, and evidence of follow-up for prior audit findings. The OGC portal generates a timestamped audit report for each completed audit that serves as your documentation. Retaining prior audit reports is important — they demonstrate the ongoing, evolving nature of your compliance program.

Question 62

What counts as a HIPAA breach?

Accepted Answer

Under HIPAA, a breach is an impermissible use or disclosure of PHI that compromises its security or privacy. Examples include: a laptop with unencrypted PHI being stolen, an email with PHI sent to the wrong patient, a ransomware attack that encrypts ePHI, an employee accessing records they have no need to access, or paper records being left in a public area. Breaches trigger notification obligations to affected individuals, HHS, and sometimes media outlets.

Question 63

What is the difference between an incident and a breach?

Accepted Answer

An incident is any event that could potentially compromise PHI — it requires investigation but may not rise to the level of a reportable breach. A breach is an incident that has been investigated and determined to be an impermissible disclosure of PHI. HIPAA presumes every incident is a breach unless you can demonstrate it meets one of three exceptions: the disclosure was not a significant risk of harm, it was an unintentional disclosure between authorized staff, or it was an inadvertent disclosure quickly corrected. Document your analysis either way.

Question 64

When must I report a breach to HHS?

Accepted Answer

All breaches affecting 500 or more individuals must be reported to HHS and local media within 60 days of discovering the breach. Breaches affecting fewer than 500 individuals must be logged and reported to HHS annually — the log is submitted no later than 60 days after the end of the calendar year in which the breaches occurred. Affected individuals must be notified within 60 days of discovering any breach regardless of size. Never delay notification waiting for an investigation to fully conclude.

Frequently Asked Questions

Getting Started

Security Risk Assessment

Gap Analysis & Remediation

Policies & Procedures

Employee Training

Vendor Management & BAAs

Audits (Physical, IT & Device)

Incidents & Breaches

Billing & Account

Privacy Officer Role

Still have questions?