In 2008, the Centers for Medicare & Medicaid Services (CMS) announced that it entered into a contract with a PricewaterhouseCoopers to audit covered entities and ensure compliance with the HIPAA security standards. According to CMS, the initial round of audits will be directed at the hundreds of companies about which it has received complaints.
Although CMS has the authority to enforce the HIPAA security standards, for the last several years it has been focused on outreach and education rather than enforcement. This year, that focus will change, and CMS will audit 10-20 hospitals over the next 9 months. CMS indicates that it will not publish the names of the entities it audits.
If you are a covered entity under HIPAA, and you have not conducted an internal review of your HIPAA security policy and enforcement, you should consider consulting experienced counsel to guide you through the process.