2 min read

How to avoid a HIPAA corrective action plan

Sara Nguyen October 22, 2020

Risk management

How to avoid a HIPAA corrective action plan

What is a HIPAA corrective action plan? - Paubox

HIPAA violations can end up taking a costly toll on your organization. Not only are you looking at hefty fines, but the Office of Civil Rights (OCR) may also determine that you need a corrective action plan and several audits to ensure compliance. The best strategy is to avoid a CAP in the first place by maintaining HIPAA compliance before experiencing a data breach.

What is a HIPAA corrective action plan (CAP)?

When a covered entity or business associate violates HIPAA, the OCR wants assurances that it won’t happen again. SEE ALSO: The Complete Guide to HIPAA Violations After an investigation, the OCR will create a resolution agreement that will probably include fines. They may also ask you to submit a corrective action plan (CAP). A CAP’s purpose is to find the underlying security issues within your organization and make you correct them. The timeline for a CAP can potentially last for several years. You will regularly report to the OCR on your progress and submit your organization to audits during this time. It’s not unheard of for the OCR to require you to hire a third-party to monitor your organization’s compliance with HIPAA. If you’re not compliant with the CAP, you will violate your resolution agreement and possibly be fined further.

What is in a HIPAA CAP?

A HIPAA CAP is a security risk analysis and risk management plan. Depending on the violation, the OCR may ask you to correct policies and procedures, or how you manage business associates or reporting failures. Part of the plan may also include training your employees on security measures or policies. The CAP will also cover what the OCR expects from your organization while you’re being monitored, including implementation reports and annual reports of your efforts. CAPs cost a healthcare organization a lot of money, time, and work. It’s a considerable effort that most likely could have been avoided.

How to avoid a CAP

There is nothing in a CAP that shouldn’t already be implemented within your healthcare business. The best way to avoid HIPAA violations and a CAP is to be HIPAA compliant. A healthcare provider should always be actively monitoring for security risks and safeguarding protected health information (PHI). Conduct a risk analysis to find any gaps in your security systems before a breach occurs. Then you can develop your own risk management plan to fix it. Even if you are HIPAA compliant, you could still get an audit by the OCR, and they will want to see well-documented risk analyses. Proactively pursuing HIPAA compliance is far less expensive than spending millions of dollars in fines and implementing a corrective action plan. SEE ALSO: Anthem Settles with 44 States for Additional $40M Over 2015 Breach One of the most common security violations is insecurely transmitting electronic PHI ( ePHI )—PHI held or transferred electronically. When it comes to HIPAA compliant email , a healthcare provider must take reasonable steps to ensure the protection of ePHI to a recipient’s inbox. Email encryption is an effective safeguard against a data breach because no one besides the intended recipient will be able to access the email. Paubox Email Suite comes with blanket TLS email encryption . In fact, we just upgraded to TLS 1.3, the newest and most secure version of the Transport Layer Security (TLS) protocol. With our solution, your healthcare business sends email directly to your recipients’ email boxes in a HIPAA compliant manner—no password or portal required. Paubox Email Suite is an easy and secure way to protect your valuable data during electronic transmission.

Try Paubox Email Suite for FREE today.

Start for free