Your compliance program
Riverbend Family Medicine ProAudit readiness: 5 of 8 in place. Next: collect staff attestations.
Required officials
Privacy officialPriya CastellanSetSecurity officialMarcus OyelaranSetCompliance contactPriya CastellanHIPAA program
What the Security and Privacy Rules ask you to have on file- Security risk assessmentCurrent
- Privacy and security policies4 of 6 attested
- Workforce roster and training1 overdue
- Business associate agreements2 of 3 signed
- Incident and breach logNone open
OIG's seven elements
From OIG's General Compliance Program Guidance, mapped to your work here- Written policies and proceduresPartly
- Compliance leadership and oversightCovered
- Training and educationPartly
- Effective lines of communicationNot started
- Enforcing standardsPartly
- Risk assessment, auditing and monitoringCovered
- Responding to detected offensesCovered
Post the HHS OIG Hotline where staff can see it. The elements are voluntary guidance; they show what an investigator expects to find.
Corrective actions
- In 30 days
- In 10 days
- In 40 days
Audit readiness
5 of 8 in place. 2 partly.Quarterly report to the owner
OIG guidance for small practices suggests the compliance contact reports to the owner at least once a quarter. Record that it happened.
- 2026-Q3Priya Castellan, Oct 7, 2026. Risks reviewed, training on track, the fax incident closed.
- 2026-Q2Priya Castellan, Jul 7, 2026. Backup restore test passed.
Templates and tracking only. Not legal advice, and it does not certify compliance with HIPAA or any other law. Have your compliance officer review policies before adopting them.