Are auditors allowed to access medical records?

During a recent Falmouth class, someone raised a question about allowing auditors access to medical-related records when they are conducting single audits. The main concern was how allowing the auditor access to medical records would square with HIPAA Act privacy requirements.

 When testing grants or contracts for A-133 Major Program compliance in the Health and Social Services functions, a level of access is required.  In the course of testing, an auditor usually encounters information considered confidential under HIPAA. According to John Friel CPA and Falmouth consultant, who conducts single audits for tribal organizations, auditors are required to sign a HIPAA disclosure agreement when they are going to be reviewing health records. In addition, they are bound by the Code of Conduct of the American Institute of Certified Public Accountant to keep all records, particularly health records, locked in a secure place.  

So an auditor would have access to health records, but only to certify compliance to federal regulations.

Are Changes Ahead for the Single Audit Process?

State, local and tribal governments have long been subject to the Single Audit Act, which requires that entities expending more than $500,000 in federal funds in a year be subject to an annual audit to determine that the funds were spent properly. Now a recent report by the Government Accountability Office questions the effectiveness of those audits. 

In a report issued last month, the GAO noted that little spenders, those spending between $500,000 and $2 million, are getting a lot more attention from federal agencies than big spenders, those expending $50 million or more. The report points out that 2.6 percent of the audits conducted covered more than 85 percent of the federal money spent by non-profits and state, local and tribal governments. Conversely, more than 50 percent of the audits conducted covered just 2 percent of the federal award expenditures.    

The law, as it is currently written, imposes the same audit standards on a non profit spending $600,000 in federal funds as it does on a city that spends $23 million in federal funds. The GAO questions whether the process of implementing the Single Audit Act is placing an unfair burden on the smaller entities, while it doesn’t focus enough attention on the larger ones.

 "Without a mechanism in place to monitor on an ongoing basis how the single audit process is implemented government-wide, OMB and federal stakeholders are unable to measure the efficiency and effectiveness of this process, as well as its usefulness as an accountability tool over federal grant awards,” the report says. “The variations we found on how federal agencies we reviewed perform key functions of the single audit process demonstrate the need to assess whether federal agencies carry out their single audit responsibilities in an efficient and effective manner."

 This report could result in different audit standards for smaller entities. What the standards might be is unknown however auditors through their associations should be prepared to provide input into this process.

 Tribal governments that might benefit from relaxed federal standards would have the option as a government entity to adopt their own audit standards. The question is, would the cost associated with implementing these standards be an allowable indirect cost as the single audit fees now are. The GAO report did not discuss potential savings or if that was even a consideration, however it appears there would be a savings to those entities classified as small.