OIG Work Plan targets security, integrity of EHRs, medical devices

The Office of the Inspector General’s (OIG) Work Plan for fiscal 2014 places added attention on the security and integrity of health IT, both for EHRs and networked medical devices within hospitals.

The 101-page plan includes two new areas that pertain to health IT. Under the plan, OIG will determine whether hospitals’ security controls over networked medical devices—such as dialysis machines, radiology systems and medication dispensing systems—adequately protect electronically protected health information (PHI) and ensure patient safety.

Also, OIG will examine the security of EHR technology under Meaningful Use. The office will perform audits of various covered entities receiving EHR incentive payments, as well as business associates like EHR cloud service providers, to determine whether they sufficiently protect PHI.

“Business associates that transmit, process and store EHRs for Medicare/Medicaid providers are playing a larger role in the protection of electronic health information. Therefore, audits of cloud service providers and other downstream service providers are necessary to assure compliance with regulatory requirements and contractual agreements,” according to the Work Plan.

The OIG will continue with other health-IT related focus areas, including documentation vulnerabilities in evaluation and management coding within EHRs, the security of portable devices containing PHI and the Department of Health & Human Services Office for Civil Rights oversight of HIPAA's privacy and breach notification rules.