Keep your HIPAA program documented and ready to show.
- Your yearly security risk assessmentSecurity risk assessment. The review HIPAA requires of where patient information lives in your practice, what could go wrong, and what you are doing about it. Most practices redo it every year., guided, with a list of risks and who owns each one
- Policies your staff read and sign by link, with every version kept
- Training records, vendor BAAsBusiness associate agreement. The contract HIPAA requires with every vendor that handles patient information for you, such as your EHR, billing service or IT support. and incidents in one binder for an auditor
Compliance Center comes with Pro. Start with free Policy Monitoring.
The yearly HIPAA paperwork, in one place.
Most small practices keep this in a binder, a shared drive and the manager's memory. The hard part is rarely having a policy. It is proving the work was done.
Guided risk assessment
Questions grouped by the HIPAA Security Rule, each with its CFR citation. Answers that need work become risks with an owner and a date.
Policies with staff sign-off
Starter policies you adapt with your counsel. Staff read and sign through a link, and every version is kept for six years.
Training records
Who was trained, on what and when, for your whole roster, including people who do not need a login.
Vendors and BAAs
Every vendor that handles patient information and whether its BAABusiness associate agreement. The contract HIPAA requires with every vendor that handles patient information for you, such as your EHR, billing service or IT support. is signed.
Incident log with the notice dates
Log what happened without patient names, answer the four breach risk questions, and see the federal notice dates worked out from the day you found out.
OIG program and one binder
The seven elements of an OIG compliance program, the status from OIG Screening, and the whole year exported as one binder.
What it looks like when something goes wrong.
A situation a practice manager hopes never to face, and needs to get right when it happens.
A laptop is left in a taxi
Log the incident: what device, what was on it, and the day you found out. No patient names go in.
Decide whether it is a breach
Answer the four risk questions from the HIPAA breach rule. If it is a breach, you see the federal dates, such as notice to the people affected no later than 60 days after discovery.
Keep the proof
The assessment, the decision, the notices you sent and the sign-off stay with the incident and go into the binder.
Built on the rules themselves.
Each item cites the rule it comes from, so you and your counsel can check it.
- State breach laws can set different deadlines. We show the federal dates and remind you to check your state.
- OIG exclusion screening runs in OIG Screening. Compliance Center shows its status and adds the evidence to the binder.
Compliance Center helps you organize and document your program. It is not legal advice and does not certify compliance with any law.
Which plans include it
Everything is by plan. There are no add-ons.
Compliance Center questions
What is an OIG compliance program, and is it required?
The HHS Office of Inspector General publishes guidance on what an effective compliance program looks like, organized as seven elements: written policies and procedures, a compliance officer and oversight, training and education, open lines of communication, enforcement and discipline, auditing and monitoring, and responding to problems with corrective action. For most practices it is voluntary, but it is the standard regulators and payers measure you against, and a working program can lower penalties if something goes wrong. Some state Medicaid programs require one. Compliance Center tracks all seven elements for your practice.
Does this make us HIPAA compliant?
No software can do that for you. Compliance Center organizes the work HIPAA asks for and keeps the proof that it was done. Whether you comply depends on what your practice actually does, so talk to your counsel about your situation.
What is an SRA?
Security risk assessment. The review HIPAA requires of where patient information lives in your practice, what could go wrong, and what you are doing about it. Most practices redo it every year. Compliance Center walks you through it and turns the answers that need work into a list of risks with owners and dates.
What is a BAA?
Business associate agreement. The contract HIPAA requires with every vendor that handles patient information for you, such as your EHR, billing service or IT support. Compliance Center keeps the list of those vendors and whether each agreement is signed.
Do my staff need logins?
No. Staff sign policies and confirm training through a link. Only the people who run the program need a seat.
Do you store patient information?
No. Compliance Center stores facts about your practice: systems, vendors, policies and staff. Incident notes are checked for things that look like patient details before they are saved, so describe what happened, not who it happened to.
Something else? Contact us.
Be ready the day someone asks.
Part of Pro.