Are You Ready for a HIPAA and ACA Audit?

It’s no secret that the Office of Civil Rights of the Department of Health and Human Services has been expanding its enforcement activity under the privacy and security standards of HIPAA. And it’s not surprising that enforcement activity is in the offing under the Affordable Care Act as well, and at more than one federal agency. But be advised that the Department of Labor appears to be pursuing its own robust approach to group health plan examinations, covering the HIPAA portability requirements, wellness programs, and Affordable Care Act compliance.

Here is a copy of the document request that one of our clients recently received to kick off a DOL examination that will include an on-site visit. Note that the HIPAA-related items focus on the portability and discrimination aspects of HIPAA, with questions about special enrollment rights, Certificates of Creditable Coverage, the provision of required notices, and the like. The DOL has also requested materials regarding wellness programs to assess compliance with the wellness program requirements of the HIPAA regulations (particularly as they relate to standards-based programs). The Affordable Care Act questions focus on documents that would be relevant to establish and support grandfathered status, the provision of certain mandated benefits, and related notices and disclosures. Although not specified in the document request, the time frame under review generally is 2010 through 2012 (except as otherwise noted).

In the audit context, an employer that adheres to sound documentation and recordkeeping practices will be rewarded, and a timely and comprehensive response to the pre-examination document request is the best way to start an audit going in the right direction. In this case, the documents requested by the DOL should be relatively easy to produce from internal records or obtain from third party administrators (or other consultants). For that reason, a failure to provide any of these documents (to the extent applicable to the subject plan) could be taken by a DOL investigator as an indication of an employer’s poor compliance status.

On the theory that to be forewarned is to be forearmed, we commend the attached list to your attention.