The following information provides a brief roadmap to achieving compliance and is intended to help our clients understand that there is a need to do more than employee training in order to avoid enforcement action from regulatory agencies.

Compliance Training is not the End All

Many practices view compliance training as the primary element for meeting regulatory requirements. Although training is a key component, the reality is that compliance requires more than training. Here are the basic major elements for ensuring compliance with any set of regulations:

Written Policies – Regulations, such as HIPAA and OSHA, require that you have written policies explaining your intent and process for meeting requirements. Policies are often requested by regulatory agencies as part of an audit process as a first step in evaluating an entity’s compliance.

Updates – Regulatory agencies require that policies and overall compliance programs be monitored to ensure their continued effectiveness. Changes in your organization, as well as changes in the regulations and their enforcement, may present new risks that must be managed with new or revised policies, compliance assessments, reporting, updated training information, etc.

Documentation – Records of compliance must be maintained (this can range from 3 to 10 years, depending on the specific regulatory agency enforcing compliance). Documentation is the only acceptable means of proving compliance. For example, HIPAA’s Security Rule specifically requires completion of a periodic risk analysis to ensure the confidentiality, availability and integrity of electronic protected health information (EPHI). Without documentation of this assessment and completion of identified corrective actions, practices are at greater risk of civil monetary penalties and other enforcement action should the Office for Civil Rights request it. In the event of a cyberattack or other security event that results in a large privacy breach, it will be even more important to have this documentation available.

Training – All regulations include various requirements ranging from initial or new hire training to annual training on certain key elements. Training documentation should include a summary, who participated, and the date.

Active Program – Regulatory agencies’ penalties for “willful” violations, in which employers disregard regulations, are far more severe than even for “serious” violations where an employer can demonstrate good faith. Documentation of your practice’s compliance efforts is central to proving your good faith efforts and that you have done more than just assemble a book of policies and place them on a shelf, never to be referred to again.

The best method for ensuring you have all the key elements and an active program is to conduct an annual review using a checklist or audit tool. An annual review of policies ensures that your compliance program is complete, and that policies are followed and updated when necessary.

Eagle Associates Compliance Subscribers have access to annual auditing checklists and other resources to ensure compliance.