CMS's 2009 security assessment process.

摘要

In 2008 the Centers for Medicare and Medicaid Services (CMS) conducted 10 HIPAA security assessments in covered entities (CEs) nationwide. CMS's stated purpose was not to identify flaws but to gain a true understanding of industry compliance with the HIPAA security rule.CMS contracted PriceWaterhouseCoopers to carry out and complete all assessments, which were selected on a complaint-driven basis. In other words, the sites were chosen from a pool of CEs that already had complaints filed against them.