These policies and procedures should detail who will be entitled to access certain information, both within and outside the organization, and the purposes for which such information can be used. The policies and procedures should incorporate administrative, technical, and physical methods of safeguarding this information. In addition, covered entities should establish a policy implementing appropriate sanctions for violations of its privacy policies and procedures. Business associates also should develop policies and procedures in order to be able to make appropriate certifications to covered entities that present to such business associates a written confidentiality agreement for execution. D. Covered entities each should develop an amendment process through which individuals may request amendments to PHI maintained by the covered entity.
Covered entities can choose to accept or deny such requests based upon certain circumstances.
The final rule specifies the process through which covered entities should proceed in accepting or denying such requests. E. Every covered entity should designate a contact person or office to receive complaints by individuals about the entity s compliance with the final rule s privacy requirements. This individual may double as the privacy officer but need not be an employee of the covered entity. What to Do Before the Effective Date G. Much closer, but still prior, to the compliance deadline for the final rule, each covered entity must provide effective training for all employees on the organization s privacy policies and procedures. Following the effective date, newly-hired employees must be trained as soon as reasonably possible.