HIPAA 2 15 A – HIPAA A-1 A-137 B – B-1 B-5 C – C-1 C-5 D – PHI D-1 D-2 HIPAA A. Introduction This Privacy Policy of (replace this with your company name) (the “Lab”) is implemented by the Lab for the purpose of complying with the Standards for the Privacy of Individually Identifiable Health Information at 45 CFR Parts 160 and 164, Subparts A and E ("Privacy Rule"). In particular, this policy documents how the Lab will treat Protected Health Information (as defined below) in compliance with HIPAA Privacy Rule, and will otherwise NOTICE OF PRIVACY PRACTICES PRIVACY ACCESS TO EXHIBIT OF PRIVACY TO OF PRIVACY FOR EXHIBIT BUSINESS ASSOCIATE AGREEMENT OF EXHIBIT
b. First Offense, Willful – Attend refresher training course within two months. Additional sanctions ranging from letter of reprimand in personnel file to termination, based upon severity of offense. c. Subsequent Violations – Combination of required attendance at refresher training course and possible employee discipline ranging from letter of reprimand in file to termination of employment, based upon the number of previous violations, presence or lack of willfulness and other mitigating or aggravating circumstances. d. Each instance of workforce disciplinary action regarding the privacy of PHI is to be documented in a written or electronic record by the Privacy Official. The Sanctions log will contain the following information: i. Name of employee ii. Description of the violation iii. Level of breach or violation iv. Location of breach of violation v. Date and time of breach or violation vi. Disciplinary action taken This documentation must be retained for six years from the date of its creation or the date when it was last in effect, whichever is later. L. TERMINATION When an employee (or other member of the workforce) of the Lab leaves or is terminated, both physical and electronic access to PHI will be denied. The Lab will use appropriate safeguards to protect the privacy of PHI when an employee (or other member of the workforce) of the Lab leaves or is terminated. M. Mitigation
(ii) Safeguard requirements. An affiliated covered entity must ensure that it complies with the applicable requirements of this part, including, if the affiliated covered entity combines the functions of a health plan, health care provider, or health care clearinghouse, § 164.308(a)(4)(ii)(A) and § 164.504(g), as applicable. (c)(1) Standard: Documentation. A covered entity must maintain a written or electronic record of a designation as required by paragraphs (a) or (b) of this section. (2) Implementation specification: Retention period. A covered entity must retain the documentation as required by paragraph (c)(1) of this section for 6 years from the date of its creation or the date when it last was in effect, whichever is later. § 164.106 Relationship to other parts. Go to Central ToC. In complying with the requirements of this part, covered entities and, provided, business associates, are required to comply with the applicable provisions of parts 160 and 162 of this subchapter. The authority citation for subpart C of part 164 is revised to read as follows: Authority: 42 U.S.C. 1320d-2 and 1320d-4; sec. 13401, Pub. L. 111-5, 123 Stat. 260. § 164.400 Applicability. Go to Central ToC. The requirements of this subpart shall apply with respect to breaches of protected health information occurring on or after September 23, 2009. § 164.402 Definitions. Go to Central ToC. As used in this subpart, the following terms have the following meanings:
(i) Determinations of eligibility or coverage (including coordination of benefits or the determination of cost sharing amounts), and adjudication or subrogation of health benefit claims; (ii) Risk adjusting amounts due based on enrollee health status and demographic characteristics; (iii) Billing, claims management, collection activities, obtaining payment under a contract for reinsurance (including stop-loss insurance and excess of loss insurance), and related health care data processing; (iv) Review of health care services with respect to medical necessity, coverage under a health plan, appropriateness of care, or justification of charges; (v) Utilization review activities, including precertification and preauthorization of services, concurrent and retrospective review of services; and (vi) Disclosure to consumer reporting agencies of any of the following protected health in-formation relating to collection of premiums or reimbursement: (A) Name and address; (B) Date of birth; (C) Social security number; (D) Payment history; (E) Account number; and (F) Name and address of the health care provider and/or health plan.
(ii) A covered entity must document that the training as described in paragraph (b)(2)(i) of this section has been provided, as required by paragraph (j) of this section. (c) ......... (1) Standard: Safeguards. A covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information. (2) ......... (i) Implementation specification: Safeguards. A covered entity must reasonably safeguard protected health information from any intentional or unintentional use or disclosure that is in violation of the standards, implementation specifications or requirements of this subpart. (ii) A covered entity must reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure. (d) ......... (1) Standard: Complaints to the covered entity. A covered entity must provide a process for individuals to make complaints concerning the covered entity's policies and procedures required by this subpart or its compliance with such policies and procedures or the requirements of this subpart. (2) Implementation specification: Documentation of complaints. As required by paragraph (j) of this section, a covered entity must document all complaints received, and disposition, if any. (e) ......... (1) Standard: Sanctions. A covered entity must have and apply appropriate sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity or the requirements of this subpart. This standard does not apply to a member of the covered entity's workforce with respect to actions that are covered by and that meet the conditions of § 164.502(j) or paragraph (g)(2) of this section. (2) Implementation specification: Documentation. As required by paragraph (j) of this section, a covered entity must document the sanctions that are applied, if any.