Jason Romer

Physician practices are used to undergoing audits. They undergo meaningful use audits and payer claims review audits, and may even face tax and RAC audits. But one type of audit that is not often discussed but is absolutely critical for practices to undergo is an information technology (IT) audit.

In short, an IT audit is a comprehensive review and examination of IT in use within a practice. It has many purposes that are critical to the short- and long-term financial, legal, and operational success of a practice.

Here are 10 things you should know about IT audits and why your practice should consider scheduling one today.

1. IT audits detect security and compliance gaps. 

The primary reason practices should undergo an IT audit is to mitigate risk. An IT audit will identify gaps in security that may allow a data breach of unsecured protected health information, which is a HIPAA violation. The audit will provide a practice with an understanding of areas of security and compliance that require remediation.

 Some IT auditors will provide an analysis of a practice's workflow to determine whether there are opportunities for changes that will bring about improvement in productivity. These changes might be as simple as moving a scanner to a location that is more easily accessible to staff members to leveraging new types of technology that can improve employee productivity, such as providing employees with dual monitors.

Practices should always know exactly what technology is used in their facility. An IT audit will provide a practice with such a comprehensive list. Using this inventory assessment, a practice will know, for example, whether it needs to purchase new technology when new employees join or when technology needs to be upgraded or replaced, such as systems using Windows XP as an operating system (now that 

4. IT audits should be conducted by a qualified third party. 

This is true regardless of whether or not a practice has a current IT provider in place. By bringing in a third party, you're more likely to receive a truly objective report. In addition, if you work with an IT provider that lacks extensive healthcare experience, the provider may not be aware of the nuances of HIPAA laws, for example. An outside company with healthcare experience can help identify areas in need of improvement specific to healthcare IT.

5. IT audits should be conducted on a regular basis. 

For smaller practices, it is best to undergo an IT audit every year; larger entities should consider undergoing one every six months because of the increased likelihood of compliance issues developing as a result of their more complex operations. By conducting regular IT audits, you will reduce the likelihood of gaps developing while helping ensure you have the most efficient workflow possible.

6. IT audits are usually conducted one of two ways. 

 If you do not want anything installed on your computers, an IT auditor can run a network and hardware analysis using a bevy of different auditing and assessment software tools. These tools do not actually sit on the systems. Rather, they run from an engineer's laptop that is connected to the local network being assessed. The programs will scan everything on your entire network and then generate the report, which should include analysis of everything noted earlier: gaps, work flow, inventory assets, etc.

Another way to undergo an IT audit is to allow for what are called "assessment agents" to be installed on your computers. The assessment agents will run for about a few days and will collect multitudes of detailed information on the hardware, software, patches and much more. This not only provides a 50,000-foot overview, but allows an IT auditor to drill down and learn about every single facet of your entire network. The auditor can look at everything from software licensing issues all the way down to whether the manner in which a printer is setup is slowing down your network. Using assessment agents will yield a much richer report with much more accurate and detailed data than using the webpage-based software.

7. IT auditors should sign a business associate agreement. 

Before you begin the audit process, it is required that you have the IT firm sign a 

. It's important to note that the IT company performing the audit must follow HIPAA security and compliance policies and procedures required by a business associate. Once on your network, the IT firm has essentially full carte blanche access to your information. 

Without usernames and passwords to access your EHR, an IT auditor cannot view patient data or access a secured database unless you have patient medical records stored unsecured.

The audit is critical for company valuation and for the controlling party to learn what technology they're acquiring. Without an audit, it will be significantly more difficult to merge the IT of the organizations and develop an effective workflow between them.

9. IT auditors should provide you with the report. 

A trustworthy IT auditor will provide you with all of the information gathered during the audit and not hold the information hostage until you sign a contract to have the issues identified during the audit addressed. Make sure this clause is included in the contract you sign with an IT auditor.

10. IT auditors should review and test backup and disaster recovery.

 A critical IT function of any physician practice is its 

. It's imperative that any IT audit include a detailed review of the backup policies and procedures. The principal areas that require review are as follows:

• Backup logs
• Retention policies
• Data restores
• Mock disaster testing
• Disaster recovery plan
• Documentation

Articles

Medical practices are no strangers to audits. But health IT audits are critical to the financial, legal, and operational success of your office.

Medical Practice Health IT Audits: 10 Reasons to Review Your Tech

On Apr. 8, 2014, support and updates for Windows XP will no longer be available from or provided by Microsoft. While your practice will still be 

 to use computers with Windows XP as their operating system, doing such would be a mistake. Without Microsoft's support, these workstations are more vulnerable to security risks and, if they are used for anything involving protected health information, effectively become non-compliant with HIPAA and the HITECH Act.

With April 8 right around the corner, here are the steps your practice should take to address this serious security concern.

The first step to take is to determine whether this is an issue that even applies to your practice. Task your designated IT person with running a report to identify which workstations in use in your practice are on the Windows XP operating system. If even just one machine uses XP, you will need to upgrade its operating system.

Before you can upgrade the operating system, you will need to determine whether the computer is capable of running a new operating system, such as Windows 7 or 8. Ask your designated IT person to assess the workstation's hardware resources, noting any technology in the machine that may present an obstacle to running a new system.

3. Determine whether to upgrade or replace the computer. 

If the workstation is capable of handling a newer operating system effectively, you can pay for the system license upgrade plus the fee to configure the computer for its use and continue to use the machine.

But if the workstation does not meet the new operating system's hardware requirements, you have a decision to make: invest in new hardware to bring the computer up to the new operating systems specifications or purchase a new machine. In many cases, the cost of upgrading an older machine's hardware and purchasing the new license will exceed the cost - and practicality - of purchasing a new workstation with a new operating system installed.

Switching computers over from XP to a new operating system is no easy process. It takes time to upgrade existing systems and purchase new workstations, and time to configure the systems to work properly in your practice. Your staff may also require training on how to properly and effectively use the new operating system. Take all of these factors into consideration as you lay out your practice's plan and strategy to upgrade without causing a significant interruption in your operations.

 A component of this plan should include identification of which operating system you will upgrade to: either Windows 7 or Windows 8. While it may seem logical to upgrade to the newest operating system, that isn't necessarily the case. There is a steep learning curve with Windows 8 as the operating system is a complete revamp of Windows (e.g., there is no start button, there are apps instead of desktop applications and countless other little changes) that may confuse users, especially those who are not technically savvy. In addition, while Windows 8 touts its compatibility with Windows 7 applications, most IT vendors have already seen their fair share of issues arising from the way the new operating system handles applications. Work with your designated IT representative to identify the best operating system for your needs.

With a plan in place, make the switch to the new operating system. Your workstation's operating system will now be in compliance with HIPAA and HITECH come April 8, and you have made your practice a more secure environment as well - a benefit to you and your patients.

 Many practices run legacy applications that need to be checked for compliancy with Windows 7. Windows 7 runs on a different core technology than Windows XP, and therefore there are incompatibilities that must be fleshed out before these applications can be properly installed on Windows 7. Oftentimes the developer of the non-compliant software can be contacted for an upgrade (usually at an additional cost) that will allow the software to run properly on Windows 7.

PriorityOne Group, a New Jersey-based healthcare IT consulting firm. 

With the deadline for the end of support and updates for Windows XP, here are five important steps for your practice to avoid HIPAA and HITECH Act violations.