IHS HIPAA Privacy Checklist

(a) Subpart A -- General Provisions

    1.  [§ 164.106 Relationship to other
        parts](../HIPAA%20Privacy%20Rule.doc#_Hlk516542863)

-   Update SOR and/or policy

(b) Subpart E -- Privacy of Individually Identifiable Health Information

    1.  [§ 164.500](../HIPAA%20Privacy%20Rule.doc#_Hlk516542897)
        Applicability

-   Update SOR and/or policy

-   May require business associate contract

    1.  [§ 164.501
        Definitions](../HIPAA%20Privacy%20Rule.doc#_Hlk516543234)

-   Update SOR and/or policy

-   Refer to various IHS program offices for input

-   Legal review of some definitions for IHS

-   Some definitions need to be updated in current SOR and/or policy

    1.  [§ 164.502 Uses and disclosures of protected health information:
        general rules](../HIPAA%20Privacy%20Rule.doc#_Hlk516629277)

-   Update SOR and/or policy. Have work group consisting of appropriate
    staff develop the policy and procedure

    1.  [§ 164.504 Uses and disclosures: organizational
        requirements](../HIPAA%20Privacy%20Rule.doc#_Hlk516629339)

-   May require legal review from OGC to determine if this applies

-   Have workgroup consisting of appropriate staff to develop the policy
    and procedure to implement

    1.  [§ 164.506 Consent for uses or disclosures to carry out
        treatment, payment, or health care
        operations](../HIPAA%20Privacy%20Rule.doc#_Hlk516629525)

-   Refer to OGC for legal review

-   Refer to various IHS program offices for input

-   Have workgroup consisting of appropriate staff develop the written
    consent and the policy and procedure to implement

    1.  [§164.508 Uses and disclosures for which an authorization is
        required](../HIPAA%20Privacy%20Rule.doc#_Hlk516629583)

-   Have workgroup consisting of appropriate staff develop the written
    authorization and the policy and procedure to implement

-   Refer to various IHS program offices for input

-   Update SOR and/or policy

    1.  [§ 164.510 Uses and disclosures requiring an opportunity for the
        individual to agree or to
        object](../HIPAA%20Privacy%20Rule.doc#_Hlk516629643)

-   Have workgroup consisting of appropriate staff develop the policy
    and procedure to implement

    1.  [§ 164.512 Uses and disclosures for which consent, an
        authorization, or opportunity to agree or object is not
        required](../HIPAA%20Privacy%20Rule.doc#_Hlk516629684)

-   Refer to OGC for legal review

-   Refer to various IHS program offices for input

-   Have workgroup consisting of appropriate staff develop the policy
    and procedure to implement

-   Update SOR and/or policy

-   Privacy Act more stringent; legal review of "serious & imminent
    threat."

    1.  [§ 164.514 Other requirements relating to uses and disclosures
        of protected health
        information](../HIPAA%20Privacy%20Rule.doc#_Hlk516629782)

-   Have workgroup consisting of appropriate staff develop written
    policy and procedure to implement

-   Update SOR and/or policy

-   Develop notice of privacy practices

    1.  [§ 164.520 Notice of privacy practices for protected health
        information](../HIPAA%20Privacy%20Rule.doc#_Hlk516629850)

-   Update SOR and/or policy

    1.  [§ 164.522 Rights to request privacy protection for protected
        health information](../HIPAA%20Privacy%20Rule.doc#_Hlk516629935)

-   Refer to Research for further review and input: implementation

-   Have workgroup consisting of appropriate staff develop written
    policy and procedure to implement

    1.  [§ 164.524 Access of individuals to protected health
        information](../HIPAA%20Privacy%20Rule.doc#_Hlk517753112)

-   Update SOR and/or policy

-   Some parts of this section may not be applicable to IHS

-   Refer to various IHS program office for input

-   Have workgroup consisting of appropriate staff develop the policy
    and procedures to implement

    1.  [§ 164.526 Amendment of protected health
        information](../HIPAA%20Privacy%20Rule.doc#_Hlk516630053)

-   Have workgroup consisting of appropriate staff develop written
    policy and procedure

-   Update SOR and/or policy

    1.  [§ 164.528 Accounting of disclosures of protected health
        information](../HIPAA%20Privacy%20Rule.doc#_Hlk516630111)

-   Have workgroup consisted of appropriate staff develop policy and
    procedure to implement

-   Update SOR and/or policy

    1.  [§ 164.530 Administrative
        requirements](../HIPAA%20Privacy%20Rule.doc#_Hlk516630177)

-   At the HQ level, a PA Officer is a full-time position; Area-level,
    privacy act responsibilities are delegated in most cases to Medical
    Records positions; SU-level, PA responsibilities are covered by
    Medical Records Supv./HIMS staff.

-   Have workgroup consisted of appropriate staff develop policy and
    procedure to implement

-   Existing Area PA and contracted trainers (designed specific to IHS)
    can accomplish training

-   Some parts of this section may not be applicable to IHS

    1.  [§ 164.532 Transition
        provisions](../HIPAA%20Privacy%20Rule.doc#_Hlk516630231)

-   Have workgroup consisted of appropriate staff develop policy and
    procedure to implement

    1.  [§ 164.534 Compliance dates for initial implementation of the
        privacy standards](../HIPAA%20Privacy%20Rule.doc#_Hlk516630268)

-   Compliance info for implementing