HIPAA FOR BROKERS. revised 10/17

Size: px
Start display at page:

Download "HIPAA FOR BROKERS. revised 10/17"

Transcription

1 HIPAA FOR BROKERS revised 10/17

2 COURSE PURPOSE The purpose of this information is to help ensure that all Optima Health Brokers are prepared to protect the privacy and security of our members health information.

3 LEARNING OBJECTIVES After review of this information, you will be able to: Discuss the 3 different Acts that comprise the Administrative Simplification regulation; Demonstrate comprehensive understanding of privacy and security measures for our members, and: Understand how to prevent, identify and report violations or breaches.

4 HIPAA OVERVIEW The Privacy Rule governs who has access to protected health information (PHI). The Security Rule specifies a series of administrative, technical and physical security procedures to assure the confidentiality, integrity and availability of ephi. The American Recovery and Reinvestment Act (ARRA) goal is to establish secure electronic health records for all Americans by The Health Information Technology for Economic and Clinical Health Act (HITECH) ARRA/HITECH brings changes to the HIPAA regulations in 3 categories: Breach notification Business Associate responsibilities Penalties

5 HITECH and ARRA RULES HITECH is designed to encourage health care providers to adopt health information technology in a standardized manner and to protect private health information. ARRA is the direct result of modifications in the HIPAA Privacy, Security and Enforcement Rules and strengthens health information privacy and security protections. ARRA specifically addresses: Breaches Electronic Health Records(EHR) Personal Health Records (PHR)

6 THE PRIVACY RULE The Privacy Rule is designed to protect individuals health information (PHI) and allows individuals to: get a copy of their medical records ask for changes to their medical records find out and limit how their PHI may be used know who has received their PHI have communications sent to an alternate location or by an alternate means file complaints and participate in investigations

7 GUIDELINES FOR USING & DISCLOSING PHI You may disclose information, without a member s authorization, to the appropriate authorities: if required by law, court order, etc. to public health officials, FDA, etc. for abuse or domestic violence to help law enforcement officials to notify of suspicious death to provide information for workers compensation to assist government actions to help in disaster relief efforts to avert a serious threat to health or safety for health oversight activities

8 YOUR RESPONSIBILITIES You are required to: disclose PHI limit the information you share with a person to what he or she needs to know ( minimum necessary guidelines) use PHI according to HIPAA-approved guidelines for access, accounting, amendment, and restriction of PHI only access the PHI necessary to complete your job duties maintain confidentiality & security of member information at all times

9 ALTERNATE ADDRESS Members and Personal Representatives have the right to request alternate confidential means of receiving communications that includes PHI. These requirements are necessary for completion of this process: Request must be in writing Individual must indicate the alternate address or specifications for the alternative means of communication Form must be signed If the requestor is a Personal Representative, must provide legal proof of their authority to represent the Member

10 VERIFICATION FOR RELEASE OF PHI Prior to making any verbal disclosures of PHI, you must verify the requestor s identity by asking several identifying questions, i.e., address, birth date, member number, etc. You may discuss billing questions, benefit information, etc. without having an Authorization form signed. Protected health information may be given to custodial parents, adults acting in Loco Parentis, emancipated minors, Designated Representatives and Designated Agents as long as an authorization and/or legal documents are file. on

11 MENTAL HEALTH and SUBSTANCE ABUSE Federal law protects all information about a member with a current or past diagnosis of substance abuse and/or mental disorder. These laws override the HIPAA laws. Protected health information cannot be disclosed without a signed authorization. Limited mental health information can be discussed with a minor s custodial parent.

12 Federal and State Laws protect Minor s (under the age of 18) health care rights. Staff may discuss a minor s health information with custodial parents except for: Pregnancy and family planning Sexually transmitted diseases Substance abuse MINORS Mental health, if treatment consent given by minor only All discussions should be limited to the minimal amount of information necessary to resolve the question.

13 S In your daily job responsibilities, is used to communicate with staff, members, providers and vendors. REMEMBER: s with PHI embedded should only be shared with those who have a need to know this information in connection with their specific job function(s). s sent externally should be encrypted. systems cannot be used by to express discriminatory views, threaten or harass employees or to advertise information that brings personal or financial gain.

14 FAXES Avoid faxing confidential information. If you send a fax to an incorrect number, report the incident immediately. Verify fax numbers prior to transmission to ensure the fax will be going to the correct person. Use a Fax Cover Sheet to maintain confidentiality. The Fax Cover Sheet should contain a confidentiality notice requesting notification if the fax went to the wrong person.

15 PRIVACY/SECURITY BUSINESS ASSOCIATES (BAs) BAs perform services that involves the use or disclosure of member PHI. Should have a Business Associate Agreement (BAA) that requires specified written safeguards for PHI included in the contract. ARRA requires BAs to comply with all regulations. BAs have the same penalties for violations as every other Health Care Provider/Entity. BAAs must be included with every contract.

16 THE SECURITY RULE The Security Rule is designed to keep secure the transfer and storage of electronic health information (ephi) by enforcing: Administrative Procedures: These measures manage the selection, development, implementation and maintenance of security measures and include workforce security, security training, policies & procedures. Technical Safeguards: The technology that protects ephi and controls access and transmission security. Physical Safeguards: Physical measures to protect the electronic information systems and related buildings and equipment from natural and environmental hazards and unauthorized intrusion.

17 PROTECTING ephi Every organization has its own rules for internal and external storing and transferring of information, also known as EDI (electronic data interchange). You are required by law to: - use passwords - log off computer systems when you leave your desk - turn monitors so that they are not visible to others - dispose of disks and CDs properly (Contact your IT Dept for disposal assistance) - always save PHI to shared directory NO personal drives

18 WHAT IS A BREACH? A breach is defined as the acquisition, access, use or disclosure of unsecured PHI which is not permitted by the HIPAA Privacy Rules and which compromises the security or privacy of the PHI. Unsecured PHI is any member health information that is not secured through encryption or an approved destruction process that renders the PHI unusable, unreadable or indecipherable to unauthorized individuals. PHI can be in any form or medium including electronic, paper or oral.

19 HITECH BREACH CHANGES When a breach is identified, You are required to notify each individual whose unsecured PHI has been, or believed to have been accessed, acquired or disclosed. Business Associates must notify any company involved as well as the individual whose PHI was disclosed. The first day the breach is discovered, or there is reason to suspect that a breach has occurred, is counted as the first day. Required notifications must occur without unreasonable delay (no more than 60 calendar days after discovery).

20 REPORTING HIPAA VIOLATIONS OR BREACHES If a HIPAA violation, breach or possible breach occurs, complete the required information as soon as possible. Forward to a designated investigator for follow-up. Reports should be made without fear of intimidation, coercion, threats, retaliation, or discrimination. If you have questions about the Privacy Rule and how it affects your job, talk to your supervisor, or compliance personnel. OH employees have policies and procedures designated for reporting to the appropriate personnel. They may also use the Sentara Integrity Hotline ( ).

21 Thank you! Be HIPAA- smart

Federal Breach Notification Decision Tree and Tools

Federal Breach Notification Decision Tree and Tools Federal Breach Notification and Tools Disclaimer This document is copyright 2009 by the Long Term Care Consortium (LTCC). These materials may be reproduced and used only by long-term health care providers

More information

Putting It All Together:

Putting It All Together: Putting It All Together: The Interplay of Privacy & Security Regina Verde, MS, MBA, CHC Chief Corporate Compliance & Privacy Officer University of Virginia Health System 2017 ISPRO Conference October 24,

More information

HIPAA Security and Privacy Policies & Procedures

HIPAA Security and Privacy Policies & Procedures Component of HIPAA Security Policy and Procedures Templates (Updated for HITECH) Total Cost: $495 Our HIPAA Security policy and procedures template suite have 71 policies and will save you at least 400

More information

HIPAA Omnibus Notice of Privacy Practices

HIPAA Omnibus Notice of Privacy Practices HIPAA Omnibus Notice of Privacy Practices Revised 2013 Urological Associates of Bridgeport, PC 160 Hawley Lane, Suite 002, Trumbull, CT 06611 Tel: 203-375-3456 Fax: 203-375-4456 Effective as of April/14/2003

More information

HIPAA. Developed by The University of Texas at Dallas Callier Center for Communication Disorders

HIPAA. Developed by The University of Texas at Dallas Callier Center for Communication Disorders HIPAA Developed by The University of Texas at Dallas Callier Center for Communication Disorders Purpose of this training Everyone with access to Protected Health Information (PHI) must comply with HIPAA

More information

HIPAA For Assisted Living WALA iii

HIPAA For Assisted Living WALA iii Table of Contents The Wisconsin Assisted Living Association... ix Mission... ix Vision... ix Values... ix Acknowledgments... ix Who Should Use This Manual... x How to Use This Manual... x Updates and Forms...

More information

HIPAA Privacy & Security Training. Privacy and Security of Protected Health Information

HIPAA Privacy & Security Training. Privacy and Security of Protected Health Information HIPAA Privacy & Security Training Privacy and Security of Protected Health Information Course Competencies: This training module addresses the essential elements of maintaining the HIPAA Privacy and Security

More information

QUALITY HIPAA December 23, 2013

QUALITY HIPAA December 23, 2013 December 23, 2013 Page 1 of 5 Breach, HIPAA and Protected Health Information This week, we look at the rules governing HIPAA, the HITECH Act and HIPAA Omnibus Rule. Unsecured PHI means Protected Health

More information

RETINAL CONSULTANTS OF ARIZONA, LTD. HIPAA NOTICE OF PRIVACY PRACTICES. Our Responsibilities. Our Uses and Disclosures

RETINAL CONSULTANTS OF ARIZONA, LTD. HIPAA NOTICE OF PRIVACY PRACTICES. Our Responsibilities. Our Uses and Disclosures RETINAL CONSULTANTS OF ARIZONA, LTD. HIPAA NOTICE OF PRIVACY PRACTICES This notice describes how health information about you may be used and disclosed and how you can get access to this information. Please

More information

Steffanie Hall, RHIA HIM Director/Privacy Officer 1201 West 12 th Emporia, Kansas ext

Steffanie Hall, RHIA HIM Director/Privacy Officer 1201 West 12 th Emporia, Kansas ext JOINT NOTICE OF PRIVACY PRACTICES NEWMAN REGIONAL HEALTH, NEWMAN REGIONAL HEALTH MEDICAL PARTNERS, HOSPICE, NEWMAN PHYSICAL THERAPY, COMMUNITY WELLNESS AND MEMBERS OF THE NEWMAN REGIONAL HEALTH ORGANIZED

More information

HIPAA-HITECH: Privacy & Security Updates for 2015

HIPAA-HITECH: Privacy & Security Updates for 2015 South Atlantic Regional Annual Conference Orlando, FL February 6, 2015 1 HIPAA-HITECH: Privacy & Security Updates for 2015 Darrell W. Contreras, Esq., LHRM Gregory V. Kerr, CHPC, CHC Agenda 2 OCR On-Site

More information

Security and Privacy Breach Notification

Security and Privacy Breach Notification Security and Privacy Breach Notification Version Approval Date Owner 1.1 May 17, 2017 Privacy Officer 1. Purpose To ensure that the HealthShare Exchange of Southeastern Pennsylvania, Inc. (HSX) maintains

More information

The HIPAA Omnibus Rule

The HIPAA Omnibus Rule The HIPAA Omnibus Rule What You Should Know and Do as Enforcement Begins Rebecca Fayed, Associate General Counsel and Privacy Officer Eric Banks, Information Security Officer 3 Biographies Rebecca C. Fayed

More information

HIPAA How to Comply with Limited Time & Resources. Jonathan Pantenburg, MHA, Senior Consultant August 17, 2017

HIPAA How to Comply with Limited Time & Resources. Jonathan Pantenburg, MHA, Senior Consultant August 17, 2017 HIPAA How to Comply with Limited Time & Resources Jonathan Pantenburg, MHA, Senior Consultant JPantenburg@Stroudwater.com August 17, 2017 Stroudwater Associates is a leading national healthcare consulting

More information

For any questions regarding this notice call: Meredith Damboise, Privacy Officer , ext. 17

For any questions regarding this notice call: Meredith Damboise, Privacy Officer , ext. 17 This notice describes how information about you may be used and disclosed and how you can get access to this information. Please review it carefully. For any questions regarding this notice call: Meredith

More information

University of Wisconsin-Madison Policy and Procedure

University of Wisconsin-Madison Policy and Procedure Page 1 of 10 I. Policy The Health Information Technology for Economic and Clinical Health Act regulations ( HITECH ) amended the Health Information Portability and Accountability Act ( HIPAA ) to establish

More information

Update on HIPAA Administration and Enforcement. Marissa Gordon-Nguyen, JD, MPH October 7, 2016

Update on HIPAA Administration and Enforcement. Marissa Gordon-Nguyen, JD, MPH October 7, 2016 Update on HIPAA Administration and Enforcement Marissa Gordon-Nguyen, JD, MPH October 7, 2016 Updates Policy Development Breaches Enforcement Audit 2 POLICY DEVELOPMENT RECENTLY PUBLISHED: RIGHT OF ACCESS,

More information

Security Rule for IT Staffs. J. T. Ash University of Hawaii System HIPAA Compliance Officer

Security Rule for IT Staffs. J. T. Ash University of Hawaii System HIPAA Compliance Officer Security Rule for IT Staffs J. T. Ash University of Hawaii System HIPAA Compliance Officer jtash@hawaii.edu hipaa@hawaii.edu Disclaimer HIPAA is a TEAM SPORT and everyone has a role in protecting protected

More information

Policy and Procedure: SDM Guidance for HIPAA Business Associates

Policy and Procedure: SDM Guidance for HIPAA Business Associates Policy and Procedure: SDM Guidance for HIPAA Business (Adapted from UPMC s Guidance for Business at http://www.upmc.com/aboutupmc/supplychainmanagement/documents/guidanceforbusinessassociates.pdf) Effective:

More information

How to Respond to a HIPAA Breach. Tuesday, Oct. 25, 2016

How to Respond to a HIPAA Breach. Tuesday, Oct. 25, 2016 How to Respond to a HIPAA Breach Tuesday, Oct. 25, 2016 This Webinar is Brought to You By. About HealthInsight and Mountain-Pacific Quality Health HealthInsight and Mountain-Pacific Quality Health are

More information

HIPAA Privacy and Security Training Program

HIPAA Privacy and Security Training Program Note The following HIPAA training is intended for Vendors, Business Associates, Students, Pre Approved Shadowers, and Visitors. The following training module does not provide credit for annual training

More information

Lesson Three: False Claims Act and Health Insurance Portability and Accountability Act (HIPAA)

Lesson Three: False Claims Act and Health Insurance Portability and Accountability Act (HIPAA) Lesson Three: False Claims Act and Health Insurance Portability and Accountability Act (HIPAA) Introduction: Welcome to Honesty and Confidentiality Lesson Three: The False Claims Act is an important part

More information

Your Information. Your Rights. Our Responsibilities.

Your Information. Your Rights. Our Responsibilities. Notice of Privacy Practices Your Information. Your Rights. Our Responsibilities. This notice describes how medical information about you may be used and disclosed and how you can get access to this information.

More information

Breach Notification Remember State Law

Breach Notification Remember State Law Breach Notification HITECH: First federal law mandating breach notification for health care industry Applies to covered entities, business associates, PHR vendors, and PHR service providers FTC regulates

More information

HIPAA & Privacy Compliance Update

HIPAA & Privacy Compliance Update HIPAA & Privacy Compliance Update Vermont Medical Society FREE Wednesday Webinar Series March 15, 2017 Anne Cramer and Shireen Hart Primmer Piper Eggleston & Cramer PC acramer@primmer.com shart@primmer.com

More information

Revised January

Revised January Revised January 2017 1 Copyright and Trade Secret Warning All Rights Reserved. This training presentation contains confidential and proprietary trade secrets of and copyrights belonging to RadNet Management,

More information

Into the Breach: Breach Notification Requirements in the Wake of the HIPAA Omnibus Rule

Into the Breach: Breach Notification Requirements in the Wake of the HIPAA Omnibus Rule Into the Breach: Breach Notification Requirements in the Wake of the HIPAA Omnibus Rule The Twenty-Second National HIPAA Summit Healthcare Privacy and Security After HITECH and Health Reform Rebecca Williams,

More information

ORA HIPAA Security. All Affiliate Research Policy Subject: HIPAA Security File Under: For Researchers

ORA HIPAA Security. All Affiliate Research Policy Subject: HIPAA Security File Under: For Researchers All Affiliate Research Policy Subject: HIPAA File Under: For Researchers ORA HIPAA Issuing Department: Office of Research Administration Original Policy Date Page 1 of 5 Approved by: May 9,2005 Revision

More information

HIPAA Federal Security Rule H I P A A

HIPAA Federal Security Rule H I P A A H I P A A HIPAA Federal Security Rule nsurance ortability ccountability ct of 1996 HIPAA Introduction - What is HIPAA? HIPAA = The Health Insurance Portability and Accountability Act A Federal Law Created

More information

Sample BYOD Policy. Copyright 2015, PWW Media, Inc. All Rights Reserved. Duplication, Reproduction or Distribution by Any Means Prohibited.

Sample BYOD Policy. Copyright 2015, PWW Media, Inc. All Rights Reserved. Duplication, Reproduction or Distribution by Any Means Prohibited. Sample BYOD Policy Copyright 2015, PWW Media, Inc. All Rights Reserved. Duplication, Reproduction or Distribution by Any Means Prohibited. SAMPLE BRING YOUR OWN DEVICE POLICY TERMS OF USE This Sample Bring

More information

HIPAA Security Manual

HIPAA Security Manual 2010 HIPAA Security Manual Revised with HITECH ACT Amendments Authored by J. Kevin West, Esq. 2010 HALL, FARLEY, OBERRECHT & BLANTON, P.A. DISCLAIMER This Manual is designed to set forth general policies

More information

BCN Telecom, Inc. Customer Proprietary Network Information Certification Accompanying Statement

BCN Telecom, Inc. Customer Proprietary Network Information Certification Accompanying Statement BCN Telecom, Inc. Customer Proprietary Network Information Certification Accompanying Statement BCN TELECOM, INC. ( BCN" or "Company") has established practices and procedures adequate to ensure compliance

More information

HIPAA in 2017: Hot Topics You Can t Ignore. Danika Brinda, PhD, RHIA, CHPS, HCISPP March 16, 2017

HIPAA in 2017: Hot Topics You Can t Ignore. Danika Brinda, PhD, RHIA, CHPS, HCISPP March 16, 2017 HIPAA in 2017: Hot Topics You Can t Ignore Danika Brinda, PhD, RHIA, CHPS, HCISPP March 16, 2017 Breach Notification State Law Privacy Rule Authorizations Polices and Procedures The Truth Is Have created

More information

University Policies and Procedures ELECTRONIC MAIL POLICY

University Policies and Procedures ELECTRONIC MAIL POLICY University Policies and Procedures 10-03.00 ELECTRONIC MAIL POLICY I. Policy Statement: All students, faculty and staff members are issued a Towson University (the University ) e-mail address and must

More information

Notice of Privacy Practices Page 1

Notice of Privacy Practices Page 1 Notice of Privacy Practices Page 1 Your Rights When it comes to your health information, you have certain rights. This section explains your rights and some of our responsibilities to help you. Get an

More information

by Robert Hudock and Patricia Wagner April 2009 Introduction

by Robert Hudock and Patricia Wagner April 2009 Introduction HITECH Updates: Proposed Health Breach Notification Rule Promulgated by the FTC; HHS Releases Guidance on How to Render PHI Unusable, Unreadable, or Indecipherable by Robert Hudock and Patricia Wagner

More information

Secure Messaging Mobile App Privacy Policy. Privacy Policy Highlights

Secure Messaging Mobile App Privacy Policy. Privacy Policy Highlights Secure Messaging Mobile App Privacy Policy Privacy Policy Highlights For ease of review, Everbridge provides these Privacy Policy highlights, which cover certain aspects of our Privacy Policy. Please review

More information

HIPAA and HIPAA Compliance with PHI/PII in Research

HIPAA and HIPAA Compliance with PHI/PII in Research HIPAA and HIPAA Compliance with PHI/PII in Research HIPAA Compliance Federal Regulations-Enforced by Office of Civil Rights State Regulations-Texas Administrative Codes Institutional Policies-UTHSA HOPs/IRB

More information

HIPAA Privacy and Security. Rochelle Steimel, HIPAA Privacy Official Judy Smith, Staff Development January 2012

HIPAA Privacy and Security. Rochelle Steimel, HIPAA Privacy Official Judy Smith, Staff Development January 2012 HIPAA Privacy and Security Rochelle Steimel, HIPAA Privacy Official Judy Smith, Staff Development January 2012 Goals and Objectives Course Goal: Can serve as annual HIPAA training for physician practice

More information

Elements of a Swift (and Effective) Response to a HIPAA Security Breach

Elements of a Swift (and Effective) Response to a HIPAA Security Breach Elements of a Swift (and Effective) Response to a HIPAA Security Breach Susan E. Ziel, RN BSN MPH JD Krieg DeVault LLP Past President, The American Association of Nurse Attorneys Disclaimer The information

More information

Boerner Consulting, LLC Reinhart Boerner Van Deuren s.c.

Boerner Consulting, LLC Reinhart Boerner Van Deuren s.c. Catherine M. Boerner, Boerner Consulting LLC Heather Fields, 1 Discuss any aggregate results of the desk audits Explore the Sample(s) Requested and Inquire of Management requests for the full on-site audits

More information

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Privacy Rule.

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Privacy Rule. Medical Privacy Version 2018.03.26 Business Associate Agreement This Business Associate Agreement (the Agreement ) shall apply to the extent that the Lux Scientiae HIPAA Customer signee is a Covered Entity

More information

WHITE PAPER. HIPAA Breaches Continue to Rise: Avoid Becoming a Casualty

WHITE PAPER. HIPAA Breaches Continue to Rise: Avoid Becoming a Casualty WHITE PAPER HIPAA Breaches Continue to Rise: Avoid Becoming a Casualty WHITE PAPER HIPAA Breaches Continue to Rise: Avoid Becoming a Casualty By Jill Brooks, MD, CHCO and Katelyn Byrne, BSN, RN Data Breaches

More information

01.0 Policy Responsibilities and Oversight

01.0 Policy Responsibilities and Oversight Number 1.0 Policy Owner Information Security and Technology Policy Policy Responsibility & Oversight Effective 01/01/2014 Last Revision 12/30/2013 Department of Innovation and Technology 1. Policy Responsibilities

More information

HIPAA and Research Contracts JILL RAINES, ASSISTANT GENERAL COUNSEL AND UNIVERSITY PRIVACY OFFICIAL

HIPAA and Research Contracts JILL RAINES, ASSISTANT GENERAL COUNSEL AND UNIVERSITY PRIVACY OFFICIAL HIPAA and Research Contracts JILL RAINES, ASSISTANT GENERAL COUNSEL AND UNIVERSITY PRIVACY OFFICIAL Just a Few Reminders HIPAA applies to Covered Entities HIPAA is a federal law that governs the privacy

More information

2016 SC REGIONAL HOUSING AUTHORITY NO. 3 S EIV SECURITY POLICY

2016 SC REGIONAL HOUSING AUTHORITY NO. 3 S EIV SECURITY POLICY 2016 SC REGIONAL HOUSING AUTHORITY NO. 3 S EIV SECURITY POLICY Purpose: The purpose of this policy is to provide instruction and information to staff, auditors, consultants, contractors and tenants on

More information

NOTICE OF PRIVACY PRACTICES

NOTICE OF PRIVACY PRACTICES NOTICE OF PRIVACY PRACTICES Chmura Orthodontics ( Practice ) understands the important of keeping your personal information private. Personal information includes: your name, postal address, e-mail address,

More information

ACCEPTABLE USE OF HCHD INTERNET AND SYSTEM

ACCEPTABLE USE OF HCHD INTERNET AND  SYSTEM Page Number: 1 of 6 TITLE: PURPOSE: ACCEPTABLE USE OF HCHD INTERNET AND EMAIL SYSTEM To establish the guidelines for the use of the Harris County Hospital District s Internet and email system. POLICY STATEMENT:

More information

Compliance & HIPAA Annual Education

Compliance & HIPAA Annual Education Compliance & HIPAA Annual Education 1 The purpose of this education is to UPDATE The purpose and of this education REFRESH is to UPDATE your and REFRESH understanding understanding of: of: Aultman s Compliance

More information

Campus Health Your Information Your Rights Our Responsibilities

Campus Health Your Information Your Rights Our Responsibilities Notice of Privacy Practices Indiana University-Purdue University at Indianapolis Campus Health Your Information Your Rights Our Responsibilities This booklet describes how medical information about you

More information

Preventing Breaches When Using , Telephone and Fax Machines

Preventing Breaches When Using  , Telephone and Fax Machines Preventing Breaches When Using E-mail, Telephone and Fax Machines Harley HIPAA Presented by the UAMS HIPAA Office, July 26, 2011 Breach Reporting When a use or disclosure occurs that is not allowed by

More information

Employee Security Awareness Training Program

Employee Security Awareness Training Program Employee Security Awareness Training Program Date: September 15, 2015 Version: 2015 1. Scope This Employee Security Awareness Training Program is designed to educate any InComm employee, independent contractor,

More information

IT SECURITY RISK ANALYSIS FOR MEANINGFUL USE STAGE I

IT SECURITY RISK ANALYSIS FOR MEANINGFUL USE STAGE I Standards Sections Checklist Section Security Management Process 164.308(a)(1) Information Security Program Risk Analysis (R) Assigned Security Responsibility 164.308(a)(2) Information Security Program

More information

SECURITY & PRIVACY DOCUMENTATION

SECURITY & PRIVACY DOCUMENTATION Okta s Commitment to Security & Privacy SECURITY & PRIVACY DOCUMENTATION (last updated September 15, 2017) Okta is committed to achieving and preserving the trust of our customers, by providing a comprehensive

More information

NMHC HIPAA Security Training Version

NMHC HIPAA Security Training Version NMHC HIPAA Security Training 2017 Version HIPAA Data Security HIPAA Data Security is intended to provide the technical controls to ensure electronic Protected Health Information (PHI) is kept secure and

More information

Acknowledgement of Receipt of Notice of Privacy Practices

Acknowledgement of Receipt of Notice of Privacy Practices Acknowledgement of Receipt of Notice of Privacy Practices I acknowledge that I have reviewed and understand Rainbow Pediatrics' Notice of Privacy Practices containing a description of the uses and disclosures

More information

Inside the OCR Investigation/Audit Process 2018 PBI HEALTH LAW INSTITUTE TUESDAY, MARCH 13, 2017 GREGORY M. FLISZAR, J.D., PH.D.

Inside the OCR Investigation/Audit Process 2018 PBI HEALTH LAW INSTITUTE TUESDAY, MARCH 13, 2017 GREGORY M. FLISZAR, J.D., PH.D. Inside the OCR Investigation/Audit Process 2018 PBI HEALTH LAW INSTITUTE TUESDAY, MARCH 13, 2017 GREGORY M. FLISZAR, J.D., PH.D. HIPAA GENERAL RULE PHI may not be disclosed without patient authorization

More information

A Panel Discussion. Nancy Davis

A Panel Discussion. Nancy Davis A Panel Discussion 1 Nancy Davis Director of Compliance & Safety, Door County Medical Center Cathy Hansen Director, Health Information Services & Privacy Officer, St. Croix Regional Medical Center Rhonda

More information

CERT Symposium: Cyber Security Incident Management for Health Information Exchanges

CERT Symposium: Cyber Security Incident Management for Health Information Exchanges Pennsylvania ehealth Partnership Authority Pennsylvania s Journey for Health Information Exchange CERT Symposium: Cyber Security Incident Management for Health Information Exchanges June 26, 2013 Pittsburgh,

More information

Data Compromise Notice Procedure Summary and Guide

Data Compromise Notice Procedure Summary and Guide Data Compromise Notice Procedure Summary and Guide Various federal and state laws require notification of the breach of security or compromise of personally identifiable data. No single federal law or

More information

Healthcare Privacy and Security:

Healthcare Privacy and Security: Healthcare Privacy and Security: Breach prevention and mitigation/ Insuring for breach Colin J. Zick Foley Hoag LLP (617) 832-1000 www.foleyhoag.com www.securityprivacyandthelaw.com Boston Bar Association

More information

TERMS OF USE Terms You Your CMT Underlying Agreement CMT Network Subscribers Services Workforce User Authorization to Access and Use Services.

TERMS OF USE Terms You Your CMT Underlying Agreement CMT Network Subscribers Services Workforce User Authorization to Access and Use Services. TERMS OF USE A. PLEASE READ THESE TERMS CAREFULLY. YOUR ACCESS TO AND USE OF THE SERVICES ARE SUBJECT TO THESE TERMS. IF YOU DISAGREE OR CANNOT FULLY COMPLY WITH THESE TERMS, DO NOT ATTEMPT TO ACCESS AND/OR

More information

Red Flags/Identity Theft Prevention Policy: Purpose

Red Flags/Identity Theft Prevention Policy: Purpose Red Flags/Identity Theft Prevention Policy: 200.3 Purpose Employees and students depend on Morehouse College ( Morehouse ) to properly protect their personal non-public information, which is gathered and

More information

Computer Security Incident Response Plan. Date of Approval: 23-FEB-2014

Computer Security Incident Response Plan. Date of Approval: 23-FEB-2014 Computer Security Incident Response Plan Name of Approver: Mary Ann Blair Date of Approval: 23-FEB-2014 Date of Review: 31-MAY-2016 Effective Date: 23-FEB-2014 Name of Reviewer: John Lerchey Table of Contents

More information

WASHINGTON UNIVERSITY HIPAA Privacy Policy # 7. Appropriate Methods of Communicating Protected Health Information

WASHINGTON UNIVERSITY HIPAA Privacy Policy # 7. Appropriate Methods of Communicating Protected Health Information WASHINGTON UNIVERSITY HIPAA Privacy Policy # 7 Appropriate Methods of Communicating Protected Health Information Statement of Policy Washington University and its member organizations (collectively, Washington

More information

USER CORPORATE RULES. These User Corporate Rules are available to Users at any time via a link accessible in the applicable Service Privacy Policy.

USER CORPORATE RULES. These User Corporate Rules are available to Users at any time via a link accessible in the applicable Service Privacy Policy. These User Corporate Rules are available to Users at any time via a link accessible in the applicable Service Privacy Policy. I. OBJECTIVE ebay s goal is to apply uniform, adequate and global data protection

More information

HIPAA Privacy, Security and Breach Notification

HIPAA Privacy, Security and Breach Notification HIPAA Privacy, Security and Breach Notification HCCA East Central Regional Annual Conference October 2013 Disclaimer The information contained in this document is provided by KPMG LLP for general guidance

More information

HIPAA Compliance: What it is, what it means, and what to do about it. Adam Carlson, Security Solutions Consultant Intapp

HIPAA Compliance: What it is, what it means, and what to do about it. Adam Carlson, Security Solutions Consultant Intapp HIPAA Compliance: What it is, what it means, and what to do about it. Adam Carlson, Security Solutions Consultant Intapp Agenda Introductions HIPAA Background and History Overview of HIPAA Requirements

More information

Privacy Policy. I. How your information is used. Registration and account information. March 3,

Privacy Policy. I. How your information is used. Registration and account information. March 3, Privacy Policy This Privacy Policy describes how and when we collect, use and share your information across our App. When using our App you consent to the collection, transfer, storage, disclosure, and

More information

HIPAA/HITECH Privacy & Security Checklist Assessment HIPAA PRIVACY RULE

HIPAA/HITECH Privacy & Security Checklist Assessment HIPAA PRIVACY RULE 164.502 Develop "minimum necessary" policies for: HIPAA PRIVACY RULE 164.514 - Uses 15 Exempts disclosure for the purpose of treatment from the minimum necessary standard. Page references for - Routine

More information

UT HEALTH SAN ANTONIO HANDBOOK OF OPERATING PROCEDURES

UT HEALTH SAN ANTONIO HANDBOOK OF OPERATING PROCEDURES ACCESS MANAGEMENT Policy UT Health San Antonio shall adopt access management processes to ensure that access to Information Resources is restricted to authorized users with minimal access rights necessary

More information

HIPAA / HITECH Overview of Capabilities and Protected Health Information

HIPAA / HITECH Overview of Capabilities and Protected Health Information HIPAA / HITECH Overview of Capabilities and Protected Health Information August 2017 Rev 1.8.9 2017 DragonFly Athletics, LLC 2017, DragonFly Athletics, LLC. or its affiliates. All rights reserved. Notices

More information

Beam Technologies Inc. Privacy Policy

Beam Technologies Inc. Privacy Policy Beam Technologies Inc. Privacy Policy Introduction Beam Technologies Inc., Beam Dental Insurance Services LLC, Beam Insurance Administrators LLC, Beam Perks LLC, and Beam Insurance Services LLC, (collectively,

More information

Virginia Commonwealth University School of Medicine Information Security Standard

Virginia Commonwealth University School of Medicine Information Security Standard Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Personnel Security Standard This standard is applicable to all VCU School of Medicine personnel. Approval

More information

HIPAA Security Awareness Training

HIPAA Security Awareness Training HIPAA Security Awareness Training Spring 2015 DBHDS Vision: A life of possibilities for all Virginians What is HIPAA? HIPAA means: Health Insurance Portability and Accountability Act It is a set of regulations

More information

EXHIBIT A. - HIPAA Security Assessment Template -

EXHIBIT A. - HIPAA Security Assessment Template - Department/Unit: Date: Person(s) Conducting Assessment: Title: 1. Administrative Safeguards: The HIPAA Security Rule defines administrative safeguards as, administrative actions, and policies and procedures,

More information

Auditing and Monitoring for HIPAA Compliance. HCCA COMPLIANCE INSTITUTE 2003 April, Presented by: Suzie Draper Sheryl Vacca, CHC

Auditing and Monitoring for HIPAA Compliance. HCCA COMPLIANCE INSTITUTE 2003 April, Presented by: Suzie Draper Sheryl Vacca, CHC Auditing and Monitoring for HIPAA Compliance HCCA COMPLIANCE INSTITUTE 2003 April, 2003 Presented by: Suzie Draper Sheryl Vacca, CHC 1 The Elements of Corporate Compliance Program There are seven key elements

More information

Agenda. Hungry, Hungry HIPAA: Security, Enforcement, Audits, & More. Health Law Institute

Agenda. Hungry, Hungry HIPAA: Security, Enforcement, Audits, & More. Health Law Institute Health Law Institute Hungry, Hungry HIPAA: Security, Enforcement, Audits, & More Brooke Bennett Aziere October 18, 2017 Agenda Enforcement Trends Phase 2 HIPAA Audits Upcoming Initiatives 1 Enforcement

More information

Integrating HIPAA into Your Managed Care Compliance Program

Integrating HIPAA into Your Managed Care Compliance Program Integrating HIPAA into Your Managed Care Compliance Program The First National HIPAA Summit October 16, 2000 Mark E. Lutes, Esq. Epstein Becker & Green, P.C. 1227 25th Street, N.W., Suite 700 Washington,

More information

MANUAL OF UNIVERSITY POLICIES PROCEDURES AND GUIDELINES. Applies to: faculty staff students student employees visitors contractors

MANUAL OF UNIVERSITY POLICIES PROCEDURES AND GUIDELINES. Applies to: faculty staff students student employees visitors contractors Page 1 of 6 Applies to: faculty staff students student employees visitors contractors Effective Date of This Revision: June 1, 2018 Contact for More Information: HIPAA Privacy Officer Board Policy Administrative

More information

David C. Marshall, Esq. PACAH 2017 Spring Conference April 27, 2017

David C. Marshall, Esq. PACAH 2017 Spring Conference April 27, 2017 David C. Marshall, Esq. PACAH 2017 Spring Conference April 27, 2017 Privacy and security of patient information held by health care providers remains a concern of the federal government. More resources

More information

ecare Vault, Inc. Privacy Policy

ecare Vault, Inc. Privacy Policy ecare Vault, Inc. Privacy Policy This document was last updated on May 18, 2017. ecare Vault, Inc. owns and operates the website www.ecarevault.com ( the Site ). ecare Vault also develops, operates and

More information

Self-Directed Learning: UPMC Privacy and Information Security Policies

Self-Directed Learning: UPMC Privacy and Information Security Policies Self-Directed Learning: UPMC Privacy and Information Security Policies 2017 1 Purpose This self-directed learning course was developed to promote awareness of key concepts from UPMC policies on Privacy

More information

Data Backup and Contingency Planning Procedure

Data Backup and Contingency Planning Procedure HIPAA Security Procedure HIPAA made Easy Data Backup and Contingency Planning Procedure Please fill in date implemented and updates for your facility: Goal: This document will serve as our back-up storage

More information

Privacy & Information Security Protocol: Breach Notification & Mitigation

Privacy & Information Security Protocol: Breach Notification & Mitigation The VUMC Privacy Office coordinates compliance with the required notification steps and prepares the necessary notification and reporting documents. The business unit from which the breach occurred covers

More information

Privacy Statement. Your privacy and trust are important to us and this Privacy Statement ( Statement ) provides important information

Privacy Statement. Your privacy and trust are important to us and this Privacy Statement ( Statement ) provides important information Privacy Statement Introduction Your privacy and trust are important to us and this Privacy Statement ( Statement ) provides important information about how IT Support (UK) Ltd handle personal information.

More information

Mobile Device Policy. Augusta University Medical Center Policy Library. Policy Owner: Information Technology Support and Services

Mobile Device Policy. Augusta University Medical Center Policy Library. Policy Owner: Information Technology Support and Services Augusta University Medical Center Policy Library Mobile Device Policy Policy Owner: Information Technology Support and Services POLICY STATEMENT Augusta University Medical Center (AUMC) discourages the

More information

UTAH VALLEY UNIVERSITY Policies and Procedures

UTAH VALLEY UNIVERSITY Policies and Procedures Page 1 of 5 POLICY TITLE Section Subsection Responsible Office Private Sensitive Information Facilities, Operations, and Information Technology Information Technology Office of the Vice President of Information

More information

Privacy Policy on the Responsibilities of Third Party Service Providers

Privacy Policy on the Responsibilities of Third Party Service Providers Privacy Policy on the Responsibilities of Third Party Service Providers Privacy Office Document ID: 2489 Version: 3.2 Owner: Chief Privacy Officer Sensitivity Level: Low Copyright Notice Copyright 2016,

More information

The simplified guide to. HIPAA compliance

The simplified guide to. HIPAA compliance The simplified guide to HIPAA compliance Introduction HIPAA, the Health Insurance Portability and Accountability Act, sets the legal requirements for protecting sensitive patient data. It s also an act

More information

Website Privacy Policy

Website Privacy Policy Website Privacy Policy Village Emergency Center Privacy Policy Updated: 1/22/18. PLEASE READ THIS PRIVACY POLICY (Privacy Policy) CAREFULLY. By accessing and using this website, you agree to be bound by

More information

Data Use and Reciprocal Support Agreement (DURSA) Overview

Data Use and Reciprocal Support Agreement (DURSA) Overview Data Use and Reciprocal Support Agreement (DURSA) Overview 1 Steve Gravely, Troutman Sanders LLP Jennifer Rosas, ehealth Exchange Director January 12, 2017 Introduction Steve Gravely Partner and Healthcare

More information

Therapy Provider Portal. User Guide

Therapy Provider Portal. User Guide Therapy Provider Portal User Guide Page 2 of 16 UCare User Guide V1.7 Table of Contents I. Introduction...3 About HSM Therapy Management... 4 Terms of Use... 4 Contact Information... 6 II. Using the Therapy

More information

HIPAA Compliance Checklist

HIPAA Compliance Checklist HIPAA Compliance Checklist Hospitals, clinics, and any other health care providers that manage private health information today must adhere to strict policies for ensuring that data is secure at all times.

More information

Enterprise Income Verification (EIV) System User Access Authorization Form

Enterprise Income Verification (EIV) System User Access Authorization Form Enterprise Income Verification (EIV) System User Access Authorization Form Date of Request: (Please Print or Type) PART I. ACCESS AUTHORIZATION * All required information must be provided in order to be

More information

Virtua Health, Inc. is a 501 (c) (3) non-profit corporation located in Marlton, New Jersey ( Virtua ).

Virtua Health, Inc. is a 501 (c) (3) non-profit corporation located in Marlton, New Jersey ( Virtua ). myvirtua.org Terms of Use PLEASE READ THESE TERMS OF USE CAREFULLY Virtua Health, Inc. is a 501 (c) (3) non-profit corporation located in Marlton, New Jersey ( Virtua ). Virtua has partnered with a company

More information

Checklist: Credit Union Information Security and Privacy Policies

Checklist: Credit Union Information Security and Privacy Policies Checklist: Credit Union Information Security and Privacy Policies Acceptable Use Access Control and Password Management Background Check Backup and Recovery Bank Secrecy Act/Anti-Money Laundering/OFAC

More information

Shaw Privacy Policy. 1- Our commitment to you

Shaw Privacy Policy. 1- Our commitment to you Privacy Policy last revised on: Sept 16, 2016 Shaw Privacy Policy If you have any questions regarding Shaw s Privacy Policy please contact: privacy@shaw.ca or use the contact information shown on any of

More information

Olympia Family Medicine 5949 Harbour Park Drive Midlothian, VA 23112

Olympia Family Medicine 5949 Harbour Park Drive Midlothian, VA 23112 Olympia Family Medicine 5949 Harbour Park Drive Midlothian, VA 23112 Patient Registration Date Name DOB Age SSN Sex: M F Address City State Zip Code Home Phone # Cell Phone # Work Phone Occupation Employer

More information

Acceptable Use Policy

Acceptable Use Policy Acceptable Use Policy POLICY 07.01.01 Effective Date: 01/01/2015 The following are responsible for the accuracy of the information contained in this document Responsible Policy Administrator Information

More information