The Department of Health and Human Services’ Office for Civil Rights is asking the 115 HIPAA-covered entities that were audited in 2012 to complete a survey about the experience.

In late March, OCR issued an information collection request in the Federal Register, as part of a review it’s conducting of the HIPAA audit program, which was required under the HITECH Act.

As it prepares to do similar audits of business associates under the final HIPAA privacy and security rule, OCR said the survey is intended to help federal health officials gauge the benefit and outcomes of the audit program by measuring the effect on covered entities.

[See also: Data breaches continue to climb.]

The survey will query providers, health plans and clearinghouses on their attitudes of the audit process and outcomes, such as document requests, site visits, findings and recommendations. OCR is also hoping to get a sense of the costs incurred by covered entities responding to audits, “in time and money,” and to assess whether the audits led to improved HIPAA compliance.

The 115 audits conducted last year were part of a pilot program that aimed to identify best practices, find security risks that may go undiscovered after breach complaints and to foster a culture of vigilance for managing personal health information — especially amid the transition from paper to digital records and as digital health data grows in quantity.

In addition to privacy and security audits, the HITECH Act also established breach notification requirements and new penalty levels. The HIPAA omnibus rule released in January also extends compliance coverage to business associates and continues OCR’s authority to audit and fine entities for breaches.

Bob Belfort, a partner in the healthcare practice at Manatt, Phelps & Phillips, said earlier this year that audits and fines are likely to continue as providers build their privacy and security systems.

[See also: Healthcare lawyer probes HIPAA rule.]

“We’re already seeing the beginning of more aggressive enforcement and stiffer penalties, more frequent penalties,” Belfort said. “And I think that trend will definitely accelerate.”