Hawaii Administrative Rules › Title 14 - DEPARTMENT OF HUMAN RESOURCES DEVELOPMENT › Subtitle 5 - STATE OF HAWAII CAFETERIA PLAN › Chapter 52 - FLEXIBLE SPENDING ACCOUNTS PLAN › Subchapter 9 - GENERAL PROVISIONS › Section 14-52-88.2 - Compliance with HIPAA Privacy Standards

Current through June, 2024
(a) Application. If
				  the medical expense reimbursement spending account under the plan is subject to
				  the Standards for Privacy of Individually Identifiable Health Information (45
				  Code of Federal Regulations Part 164, the "Privacy Standards"), then this
				  section shall apply,
(b) Disclosure
				  of Protected Health Information. The plan shall not disclose Protected Health
				  Information to any member of the employer's workforce unless each of the
				  conditions set out in this section are met. "Protected Health Information DEC
				  02 2021' shall have the same definition as set forth in the Privacy Standards
				  but generally shall mean individually identifiable information about the past,
				  present, or future physical or mental health or condition of an individual,
				  including information about treatment or payment for treatment,
(c) Protected Health Information disclosed
				  for administrative purposes. Protected Health Information disclosed to members
				  of the employer's workforce shall be used or disclosed by them only for
				  purposes of plan administrative functions. The plan's administrative functions
				  shall include all plan payment functions and health care operations, The terms
				  "payment" and "health care operations" shall have the same definitions as set
				  out in the Privacy Standards, but the term "payment" generally shall mean
				  activities taken to determine or fulfill plan responsibilities with respect to
				  eligibility, coverage, provision of benefits, or reimbursement for health care.
(d) Protected Health Information
				  disclosed to certain workforce members. The plan shall disclose Protected
				  Health Information only to members of the employer's workforce who are
				  authorized to receive the Protected Health Information, and only to the extent
				  and in the minimum amount necessary for that person to perform his or her
				  duties with respect to the plan. "Members of the employer's workforce DEC 02
				  2021' shall refer to all employees and other persons under the control of the
				  employer. The employer shall keep an updated list of those authorized to
				  receive Protected Health Information.
(1) An
				  authorized member of the employer's workforce who receives Protected Health
				  Information shall use or disclose the Protected Health Information only to the
				  extent necessary to perform his or her duties with respect to the
				  plan.
(2) In the event that any
				  member of the employer's workforce uses or discloses Protected Health
				  Information other than as permitted by this section and the Privacy Standards,
				  the incident shall be reported to the plan's privacy officer. The privacy
				  officer shall take appropriate action, including;
(A) Investigation of the incident to
				  determine whether the breach occurred inadvertently, through negligence or
				  deliberately,- whether there is a pattern of breaches; and the degree of harm
				  caused by the breach;
(B)
				  Appropriate sanctions against the persons causing the breach which, depending
				  upon the nature of the breach/ may include oral or written reprimand,
				  additional training, or termination of employment;
(C) Mitigation of any harm caused by the
				  breach, to the extent practicable; and
(D) Documentation of the incident and all
				  actions taken to resolve the issue and mitigate any damages-