HIPAA Privacy Breach Notification Regulations

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "HIPAA Privacy Breach Notification Regulations"

Transcription

1 Technical Bulletin Issue HIPAA Privacy Breach Notification Regulations On August 24, 2009 Health and Human Services (HHS) issued interim final regulations implementing the HIPAA Privacy Breach Notification requirements contained in the American Recovery and Reinvestment Act (ARRA). ARRA, which was enacted in February, added a new notification requirement when an individual s unsecured protected health information (PHI) is breached. Breach notifications will be required for any breach occurring after September 22, Regulations issued on April 27, 2009 provided guidance on when PHI is unsecured. These new regulations provide additional guidance in key areas including: What constitutes a breach To whom must the new breach notification be sent What information needs to be included in the notices When and how must notices be provided This Technical Bulletin addresses the guidance provided by HHS for privacy breach notification requirements for HIPAA covered entities and business associates. (The Federal Trade Commission (FTC) issued similar regulations for vendors of Personal Health Records (PHR) on August 25, 2009 which are not discussed in this Technical Bulletin.) What is a Breach ARRA defines a breach as the: unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of the protected health information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information. A breach requires notification when a covered entity or business associate experiences a breach of unsecured PHI. Encryption is not required under HIPAA. Encryption is an addressable implementation specification under HIPAA Security rules. However, information encrypted using HHS specified methods is secured. Notification is not required under HIPAA (but may be under a state law) if the PHI that was breached was secured. For more information on HHS s April 27 regulations defining unsecured PHI, please see our Technical Bulletin at: HHS provides additional guidance on what constitutes a breach which triggers the notification requirement: The information breached is PHI. The breach notification requirement does not apply to information that is not PHI such as de-identified information.

2 There has been an unauthorized acquisition, access, use or disclosure. Unauthorized means acquisition, access, use or disclosure that is not permitted under HIPAA privacy rules. If there is no HIPAA privacy violation, there is no breach. Regulators noted that uses or disclosures involving more than the minimum necessary amount may qualify as a breach. Compromises the security or privacy of the protected health information. HHS defines this as poses a significant risk of financial, reputational, or other harm to the individual. In order to determine if there is a significant risk, covered entities and business associates will need to perform a risk assessment. In conducting a risk assessment, HHS expects the covered entity or business associate to consider a number of factors such as the type and amount of PHI involved, who accessed the information, and the nature of the PHI. For example, if the PHI is disclosed in violation of the privacy rules, but the recipient is a HIPAA covered entity required to protect PHI, the incident may not be a breach. The number of individuals affected is not a factor in assessing the risk to determine if a breach has occurred. It will affect how notification is provided. Comment: One possible example of a privacy violation that may not be a breach based on the type of PHI involved is a list of employee s names & 3 rd quarter health care FSA balances (with no other information). Based on the limited information included it is unlikely that it could be used for a harm. A limited data set - which is PHI with 16 specific identifiers removed - is considered unsecured by HHS unless it is otherwise secured under HHS regulations. However, if both the individual s zip code and date of birth have been removed from the limited data set, HHS has stated that unauthorized access, use or disclosure would not compromise the security or privacy of the PHI. Therefore, it would not be a breach and no breach notification would be required. If either the date of birth or the zip code is included, a risk assessment must be performed to determine if a breach has occurred. ARRA includes three exceptions to the breach rule. These exceptions are situations where a HIPAA privacy violation has occurred, but the violation would not be considered a breach. Those exceptions along with HHS guidance are: 1. Unintentional acquisition, access or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate, if the acquisition, access, or use was made in good faith, within the course and scope of employment or other professional relationship, and does not result in further use or disclosure. HHS used an example where a billing employee opens an with PHI mistakenly sent by a nurse. The billing employee realizes he is not the intended recipient, notifies the nurse of the mistake and deletes the Inadvertent disclosure of PHI from a person who is authorized to access PHI at a facility to another similarly situated person authorized to access PHI at the same facility if the information is not further used or disclosed without authorization. Inadvertent disclosures of PHI from a person who is authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at the same covered entity or business associate are also exceptions. Regulators did not include a specific example for this exception. 3.The unauthorized person to whom PHI has been disclosed would not reasonably have been able to retain the information. HHS gave two examples. In the first example, a health plan Page 2 Issue

3 sends EOBs to the wrong person. The envelopes are returned by the post office unopened and marked undeliverable. In this case no breach occurred. If, however, any of the envelopes are not returned, this should be treated as a potential breach. In the second example, a nurse hands a patient someone else s discharge papers, but realizes her mistake and recovers the papers quickly. If the nurse can reasonably conclude that the patient could not have read the information, this would not be a breach. If unsecured PHI is accessed, used or disclosed in violation of the HIPAA privacy rules and the incident does not qualify for one of these three exceptions, the covered entity or business associate must conduct a risk assessment to determine if the unauthorized access, use or disclosure will compromise the privacy or security of the individual s PHI. The covered entity has the burden of proof in making this decision and is required to document its risk assessment and findings. Comment: One of the purposes of the risk assessment is to limit notifications to situations where there is a significant risk of harm. Too many notifications may confuse individuals. Too many notifications may also make it more difficult for individuals to determine when the situation poses a risk which creates the need for some action on their part. Unsecured Protected Health Information Unsecured protected health information is PHI that is not secured through the use of a technology or methodology specified by HHS. The April 27 regulations provide detailed information on the technologies and methodologies which HHS considers will render protected health information unusable, unreadable or indecipherable to unauthorized individuals. In general, only two methods are acceptable encryption using specific National Institute of Standards and Technology (NIST) standards or destruction. The August 24 guidance does not add any new methods or technologies for securing PHI. It does, however, make it clear that the term unsecured protected health information can include information in any form or medium including electronic, paper or oral form. In addition, the guidance states that where PHI is encrypted, the encryption or decryption key must be kept on a separate device from the data it encrypts or decrypts to avoid a breach. The preamble to the regulations also discusses two other methods for securing PHI which HHS considered and specifically rejected. The first is redaction of paper records which HHS does not view as a standardized methodology with proven capabilities to destroy or render the underlying information unreadable, unusable or indecipherable. Only the destruction of paper is deemed secure. The second is the use of access controls such as a firewall. While access controls are required under the HIPAA security rules and important security tools, they will not render the information unreadable, unusable or indecipherable. Comment: While redaction and access controls are not sufficient to secure PHI, they do reduce the potential for unauthorized access. The use of one of these methods may be an important consideration during the risk assessment when the covered entity or business associate must determine if an impermissible use or disclosure of PHI constitutes a breach. Comment: Office of Management and Budget (OMB) memorandum M provides information on how federal government agencies have been handling potential breach of personally identifiable information and the subsequent risk assessments. These are pertinent to the HIPPA determination process and the need for breach notifications. While the memo is pre-arra, it provides some very Page 3 Issue

4 useful information. For a copy of that memorandum: To Whom Must Breach Notification Be Sent In the event of a breach, the covered entity is required to send notices to affected individuals and Health and Human Services (HHS). In cases where the breach affects more than 500 individuals in a jurisdiction, notification must also be made to prominent media outlets. Individual Notifications Following the discovery of the breach of unsecured PHI, the covered entity must notify every individual whose unsecured PHI has been (or is reasonably believed by the covered entity to have been) accessed, acquired, used or disclosed as a result of the breach. Notification to Health and Human Services The covered entity is required to report all breaches to HHS. The method and timing of the report depends on the number of individuals affected by the breach. If fewer than 500 individuals are affected, the covered entity must keep a log and report the breach within 60 days after the end of the calendar year in which the breach occurred. For 2009, this will only include breaches occurring after September 22. If 500 or more individuals are affected by a breach, the covered entity is required to report the breach to HHS as soon as reasonably possible (see When and How Notices Must be Provided below). HHS will post the names of covered entities with a breach affecting 500 or more individuals on its web site. Notification to Prominent Media Outlets If the breach involves more than 500 individuals in a single State or jurisdiction, the covered entity is required to notify prominent media outlets where affected individuals likely reside. State is defined to include the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, and Guam. Jurisdiction is defined as a geographic area smaller than a State such as a county, city or town. If the breach involves more than 500 individuals who live in different jurisdictions, media notification is not required. For example, if a breach involves 200 individuals living in Maryland, 200 individuals living in Virginia and 200 individuals living in the District of Columbia, media notification is not required. Notification must be sent to a prominent media outlet. HHS states that what constitutes a prominent media outlet will differ depending on the State or jurisdiction involved. For a breach affecting more than 500 individuals in a particular State, a prominent media outlet may be a major, general interest newspaper with a daily circulation throughout the State. A newspaper serving only one town and distributed on a monthly basis, or a daily newspaper of specialized interest (such as sport, politics) would not be viewed as a prominent media outlet. If the individuals affected by the breach reside in a more limited area such as a city, then a major, general-interest newspaper with daily circulation throughout that city may be a prominent media outlet. A prominent media outlet may also be a major television station where the individuals reside in a city. For larger geographical areas, the media outlet must serve the larger Page 4 Issue

5 area. In cases involving more than one jurisdiction, the covered entity may need to notify more than one media outlet. What Information Needs to Be Included in the Notices The notice must be written in plain language and contain five specific items: 1. A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; 2. A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); 3. Any steps individuals should take to protect themselves from potential harm resulting from the breach; 4. A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and 5. Contact procedures for individuals to ask questions or learn additional information, which must include a toll-free number, an address, web site, or postal address. The notice should include a description of the type of information involved, but should not include any sensitive information. The covered entity may also wish to include additional information such as a suggestion that the individual contact his or her credit card company or how to contact credit reporting bureaus, if appropriate. Instructions for what information to send to HHS will be posted on the HHS website. While not specified, the required information will probably be the same or similar to the information required in the individual notices. Notification to the media outlet must include the same content as required for the individual notices. The format is not specified, but it may take the form of a press release. When and How Notices Must be Provided HHS guidance describes what will be considered timely notice and what methods must be used to provide the required notices. The rules cover notices to individuals, HHS and if required, to major media outlets. The time frame for sending notices is the same for all notices except the notice to HHS for breaches affecting fewer than 500 individuals. When Must Notices Be Provided The covered entity is permitted to take a reasonable amount of time to investigate the circumstances to conduct a risk assessment to determine that a breach has occurred and to collect the information which must be included in the notices. Individual notices must be provided without unreasonable delay and in no case later than 60 calendar days after the date the breach is discovered by the covered entity. Page 5 Issue

6 Covered entities may provide the required information to individuals with information in multiple mailings, as information becomes available, as long as the notices with all of the required content are sent within the 60-day time period. HHS makes it clear that this 60 day time frame is the outer limit for providing notification. If the covered entity has determined that a breach occurs and has the information needed for the notice within 10 days, sending the notice on the 60 th day would be an unreasonable delay. The clock for sending the notices starts when the covered entity discovers the breach. Breaches are treated as discovered on the first day that the breach is known, or by exercising reasonable diligence would have been known, to the covered entity. A breach is considered known when any person in the covered entity s workforce (other than the person committing the breach) knows of the breach. Workforce is defined to include more than just employees. For example, it includes volunteers and trainees who are under the control of the covered entity. The guidance makes it clear that the 60 day time frame begins when the incident is discovered, not when the covered entity has investigated the event and determined that it constitutes a breach. Covered entities should establish procedures to report incidents and to ensure that workforce members are adequately trained and aware of the importance of timely reporting of privacy and security incidents (as well of the potential consequences for failure to report incidents). Comment: Covered entities may want to conduct at least some basic training of their workforce since the discovery of a security incident by any member of the covered entity s workforce will start the 60 day clock. Basic training could include information such as what types of security incidents must be reported, how, when and to whom. A delay is permitted where a law enforcement official determines that the notice would impede a criminal investigation or cause damage to national security. The covered entity may temporarily delay a notification (including any web site posting) based on an oral request for the time period requested by law enforcement up to 30 days. The covered entity must document the request including the requested delay period and the identity of the law enforcement official. If the law enforcement request is written, the covered entity may delay notification based on the time frame in the written request. If a business associate of the covered entity is an agent of the covered entity (determined in accordance with the federal common law of agency), the covered entity will be treated as knowing about the breach when the business associate first knows about the breach. If a business associate is not an agent of the covered entity, the business associate must notify the covered entity without unreasonable delay and in all cases within 60 calendar days. (See Notification by a Business Associate below.) For breaches involving fewer than 500 individuals, information must be reported to HHS within 60 days after the end of the calendar year. Methods for Providing Notification Individual notices must be sent via first class mail to the individual s last known address. Written notice may be provided in the form of electronic mail, provided the individual agrees to receive electronic notice (and has not withdrawn agreement). If the individual is a minor or lacks legal capacity due to a physical or mental condition, the notice may be sent to the parent or other person who is the personal representative of the individual. If the individual is deceased, notice must be sent to the last known address of the next of kin (or a personal representative who has the authority to act on behalf of the decedent or the decedent s estate if the covered entity has contact information for that person rather than next of kin.) Page 6 Issue

7 In some cases the covered entity may not have sufficient contact information for some or all of the affected individuals. In other cases notices may be returned as undeliverable. In these cases the covered entity is permitted to use a substitute form for the notice. Substitute notice must have the same contents and should be provided as soon as reasonably possible after the covered entity realizes that it has incomplete or out of date information. Substitute notice is not required for next of kin of a deceased individual if the covered entity has out of date or no contact information. If there are fewer than 10 individuals for whom the covered entity has incomplete or out of date address information, the covered entity may use an alternative form to provide notification such as telephone or depending on the information available to the covered entity. If the covered entity has incomplete or out of date contact information for 10 or more individuals, then substitute notice must be provided through a conspicuous posting on the covered entity s web site. The posting must be on the home page or provide a prominent hyperlink to the notice on its home page and must include a toll free number for individuals to call with questions or to get more information. The hyperlink should be noticeable and worded to convey the nature and importance of the information. The notice may be located in the login page for existing account holders. The link must be on the web site for at least 90 days. If the covered entity does not have (or prefers not to use) a website, it may post the notice in major print or broadcast media where affected individuals are likely to reside. The notice must be continued for at least 90 days and include the toll free number. In urgent situations (not defined) where there is a possible imminent misuse of the unsecured protected health information, the covered entity may also provide notice by other means such as telephone. However, this notice must be in addition to the written notice sent via first class mail. Notification by a Business Associate Business associates are required to notify a covered entity in the event of a breach of unsecured protected health information. The regulations do not specify to whom or how the business associate will notify the covered entity. In the preamble, HHS states that covered entities and business associates should determine when and how the required reporting will be accomplished. Procedures and time frames agreed upon will need to be incorporated into business associate agreements. If the business associate is an agent of the covered entity (determined based on the federal common law of agency), the covered entity will be treated as having discovered the breach when the business associate discovers the breach. The rules for determining when a breach is discovered by as business associate are the same as those used by a covered entity. If the business associate in not an agent of the covered entity (i.e. the business associate is an independent contractor), the business associate should notify the covered entity as soon as possible of the breach, but in no event more than within 60 calendar days after discovery. In all cases, the business associate must provide the covered entity with the names of affected individuals to the extent the business associate has that information. In some circumstances, the business associate may have no or incomplete information about the identity of individuals whose unsecured PHI has been breached. The example included by HHS is a records storage company that stores several hundred boxes of the covered entity s paper medical records. If several boxes are missing, the record storage company may not know the individuals whose records were contained in the missing boxes. Page 7 Issue

8 Since under some circumstances the business associate may be in the best position to gather the information required for the breach notification, business associates are required to provide the covered entity with other information which the covered entity will need for the required notices. Covered entities and business associates are expected to continue to specify in their agreements obligations such as when, how and to whom a breach will be reported and who will send the individual notifications. In some cases, the business associate may be in a better position to provide those notices. The covered entity and business associate should coordinate their efforts to avoid providing duplicates notices. Comment: While the covered entity and business associate may agree to have the business associate send the individual notices, it appears that the covered entity is required to provide required notification to HHS (and, if needed, the media). State Laws In general, HIPAA provides that State laws which conflict will be preempted. State laws which are similar including those with more stringent requirements that do not conflict with HIPAA requirements are not preempted. Currently a number of states have some form (e.g., personal information rather than health information) of breach notification laws. It is HHS belief that generally covered entities will be able to comply with both State laws and HIPAA. However, covered entities will need to review their own State laws to make this determination. Effective Date These rules are effective for breaches of unsecured protected health information occurring after September 22, However, HHS has said they will use their regulatory discretion not to impose sanctions for failure to provide the required notices for breaches that are discovered before February 22, During this time period they expect covered entities to comply with the rules and will work with covered entities providing technical assistance and voluntary corrective action to achieve compliance. Action Steps Even with HHS use of enforcement discretion not to impose sanctions for breaches that are discovered before February 22, covered entities (and business associates) have only a short time to become familiar with the new rules and take needed action. Some key action steps are: 1. Review current PHI. Perform an assessment of PHI that the covered entity currently receives, uses, stores or transmits. Determine how much and what type of PHI is involved, who has access, how PHI is received and sent, and how the information is currently protected. Reviewing storage of PHI on portable devices such as laptops, hard drives, CD-ROMs and flash drives will be particularly important since those devices may constitute the greatest risk. 2. Reduce PHI. To the extent feasible, the covered entity may choose to reduce the amount of PHI it uses, stores, receives or shares. The smaller the amount of PHI, the lower the potential for a breach. Page 8 Issue

9 3. Inventory PHI. Take inventory of all of the covered entity s PHI for future reference. The covered entity may also want to reorganize how it handles PHI and/or improve recordkeeping of its paper PHI. 4. Determine if any PHI should be encrypted. Depending on the amount of PHI, type involved and the amount of storage and transmission, a covered entity may decide to encrypt some, or all, of its PHI. The covered entity should work with its IT staff to determine if encryption is appropriate. 5. Update Policies & Procedures. Review current policies and procedures, add appropriate provisions and processes to cover the new breach notification rules. This may also be a good time to make any other needed updates (e.g., if there has been a change in how the covered entity uses PHI, this would be an excellent opportunity to update the documentation). 6. Training. The new breach notification rules will have a significant impact on who is trained and how covered entities provide HIPAA training. In the past, the covered entity could limit training to individuals who would have access to PHI such as HR staff. Under the new rules, a breach will be treated as discovered when any member of the covered entity s workforce becomes aware of the incident. Covered entities may want to provide some training on recognizing and reporting security incidents to all members of its workforce. This may also be an excellent opportunity to update HIPAA training in general and conduct refresher training where needed. 7. Develop Breach Procedures. Create policies and procedures for identifying and responding to security incidents that may constitute breaches. For example, determine what types of incidents workforce members will be required to report, how to report incidents and who must be notified. The covered entity will also need to develop processes for collecting information and sending notices in the event of a breach. 8. Update Documentation. Modify current policy and procedure documents, any training materials such as manuals, the HIPAA privacy policy and notice; and amend the formal Plan document. 9. Amend Business Associate Agreements. Update business associate agreements to include the new breach notification rules. As part of the process determine the roles of the covered entity and business associate in the event that the business associate experiences a breach. As part of this process, it would be prudent for the covered entity to ensure that it has updated information. 10. Monitor Developments. Covered entities may want to check the HHS web site to keep current on developments. The url for the main HIPAA privacy website is: The intent of this Technical Bulletin is to provide general information on employee benefit issues. It should be not construed as legal advice and, as with any interpretation of law; plan sponsors should seek proper legal advice for application of these rules to their plans Gallagher Benefit Services. Page 9 Issue

Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455. Notification of Security Breach Policy

Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455. Notification of Security Breach Policy Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455 Notification of Security Breach Policy Purpose: This policy has been adopted for the purpose of complying with the Health

More information

What You Need to Know About the New HIPAA Breach Notification Rule 1

What You Need to Know About the New HIPAA Breach Notification Rule 1 What You Need to Know About the New HIPAA Breach Notification Rule 1 New regulations effective September 23, 2009 require all physicians who are covered by HIPAA to notify patients if there are breaches

More information

Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule

Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule HEALTHCARE October 2009 Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule This HIPAA Update provides a detailed description of the new breach notification requirements for HIPAA

More information

POLICY AND PROCEDURE MANUAL

POLICY AND PROCEDURE MANUAL Pennington Biomedical POLICY NO. 412.22 POLICY AND PROCEDURE MANUAL Origin Date: 02/04/2013 Impacts: ALL PERSONNEL Effective Date: 03/17/2014 Subject: HIPAA BREACH NOTIFICATION Last Revised: Source: LEGAL

More information

BREACH NOTIFICATION POLICY

BREACH NOTIFICATION POLICY PRIVACY 2.0 BREACH NOTIFICATION POLICY Scope: All subsidiaries of Universal Health Services, Inc., including facilities and UHS of Delaware Inc. (collectively, UHS ), including UHS covered entities ( Facilities

More information

Definitions: 45 CFR As used in this subpart, the following terms have the following meanings:

Definitions: 45 CFR As used in this subpart, the following terms have the following meanings: HITECH/HIPAA Breach Notification Regulations This summary was prepared by the New Jersey Department of Human Services Privacy Officer on February 24, 2010 for distribution at the Division of Addiction

More information

CHART YOUR HIPAA COURSE...

CHART YOUR HIPAA COURSE... CHART YOUR HIPAA COURSE... HHS ISSUES SECURITY BREACH NOTIFICATION RULES PUBLISHED IN FEDERAL REGISTER 8/24/09 EFFECTIVE 9/23/09 The Department of Health and Human Services ( HHS ) has issued interim final

More information

Everett School Employee Benefit Trust. Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law

Everett School Employee Benefit Trust. Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law Everett School Employee Benefit Trust Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law Introduction The Everett School Employee Benefit Trust ( Trust ) adopts this policy

More information

UNIVERSITY OF WYOMING HIPAA POLICY 3.6 BREACH

UNIVERSITY OF WYOMING HIPAA POLICY 3.6 BREACH UNIVERSITY OF WYOMING HIPAA POLICY 3.6 BREACH I. PURPOSE: The purpose of this policy is to outline the processes and procedures for determining whether the security or privacy of PHI has been compromised

More information

HIPAA Breach Notification Interim Final Rule

HIPAA Breach Notification Interim Final Rule HIPAA Breach Notification Interim Final Rule The American Recovery and Reinvestment Act of 2009 ( the Act ) made several changes to the HIPAA privacy rules including adding a requirement for notice to

More information

COMPLIANCE ALERT 10-12

COMPLIANCE ALERT 10-12 HAWAII HEALTH SYSTEMS C O R P O R A T I O N "Touching Lives Every Day COMPLIANCE ALERT 10-12 HIPAA Expansion under the American Recovery and Reinvestment Act of 2009 The American Recovery and Reinvestment

More information

HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES

HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES SALISH BHO HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES Policy Name: HIPAA BREACH NOTIFICATION REQUIREMENTS Policy Number: 5.16 Reference: 45 CFR Parts 164 Effective Date: 03/2016 Revision Date(s):

More information

Breach Notification Policy

Breach Notification Policy 1. Breach Notification Team. Breach Notification Policy Ferris State University ( Ferris State ), a hybrid entity with health care components, has established a Breach Notification Team, which consists

More information

Information Privacy and Security Program. Title: EC.PS.01.02

Information Privacy and Security Program. Title: EC.PS.01.02 Page: 1 of 9 I. PURPOSE: The purpose of this standard is to ensure that affected individuals, the media, and the Secretary of Health and Human Services (HHS) are appropriately notified of any Breach of

More information

BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION

BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION Summary November 2009 On August 24, 2009, the Department of Health and Human Services (HHS) published an interim final rule (the Rule ) that

More information

Community First Health Plans Breach Notification for Unsecured PHI

Community First Health Plans Breach Notification for Unsecured PHI Community First Health Plans Breach Notification for Unsecured PHI The presentation is for informational purposes only. It is the responsibility of the Business Associate to ensure awareness and compliance

More information

The ReHabilitation Center. 1439 Buffalo Street. Olean. NY. 14760

The ReHabilitation Center. 1439 Buffalo Street. Olean. NY. 14760 Procedure Name: HITECH Breach Notification The ReHabilitation Center 1439 Buffalo Street. Olean. NY. 14760 Purpose To amend The ReHabilitation Center s HIPAA Policy and Procedure to include mandatory breach

More information

LIVINGSTON COUNTY ADMINISTRATIVE PROCEDURE HIPAA-4. Breach Notification for Unsecured Protected Health Information

LIVINGSTON COUNTY ADMINISTRATIVE PROCEDURE HIPAA-4. Breach Notification for Unsecured Protected Health Information LIVINGSTON COUNTY ADMINISTRATIVE PROCEDURE HIPAA-4 SUBJECT: ORGANIZATION RESPONSIBLE: Breach Notification for Unsecured Protected Health Information Information Technology Security Manager Office of Information

More information

ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016

ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016 Page 1 of 9 CITY OF CHESAPEAKE, VIRGINIA NUMBER: 2.62 ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016 SUPERCEDES: N/A SUBJECT: HUMAN RESOURCES DEPARTMENT CITY OF CHESAPEAKE EMPLOYEE/RETIREE GROUP HEALTH

More information

This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in

This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in the HIPAA Omnibus Rule of 2013. As part of the American

More information

HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013

HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013 HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013 Orchard Creek Health Care is required by law to maintain the privacy of protected health information (PHI) of our residents. If you feel

More information

Data Breach, Electronic Health Records and Healthcare Reform

Data Breach, Electronic Health Records and Healthcare Reform Data Breach, Electronic Health Records and Healthcare Reform (This presentation is for informational purposes only and it is not intended, and should not be relied upon, as legal advice.) Overview of HIPAA

More information

STANDARD ADMINISTRATIVE PROCEDURE

STANDARD ADMINISTRATIVE PROCEDURE STANDARD ADMINISTRATIVE PROCEDURE 16.99.99.M0.26 Investigation and Response to Breach of Unsecured Protected Health Information (HITECH) Approved October 27, 2014 Next scheduled review: October 27, 2019

More information

Checklist for HITECH Breach Readiness

Checklist for HITECH Breach Readiness Checklist for HITECH Breach Readiness Checklist for HITECH Breach Readiness Figure 1 describes a checklist that may be used to assess for breach preparedness for the organization. It is based on published

More information

SALT LAKE COUNTY COUNTYWIDE POLICY ON HIPAA BREACH NOTIFICATION REQUIREMENTS

SALT LAKE COUNTY COUNTYWIDE POLICY ON HIPAA BREACH NOTIFICATION REQUIREMENTS SALT LAKE COUNTY COUNTYWIDE POLICY ON HIPAA BREACH NOTIFICATION REQUIREMENTS Reference Purpose Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 United States Code 1320d et seq.;

More information

Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule

Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule Patricia D. King, Esq. Associate General Counsel Swedish Covenant Hospital Chicago, IL I. Business Associates under

More information

UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14

UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14 UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14 RULES Issued August 19, 2009 Requires Covered Entities to notify individuals of a breach as well as HHS without reasonable delay or within

More information

New HIPAA Breach Notification Rule: Know Your Responsibilities. Loudoun Medical Group Spring 2010

New HIPAA Breach Notification Rule: Know Your Responsibilities. Loudoun Medical Group Spring 2010 New HIPAA Breach Notification Rule: Know Your Responsibilities Loudoun Medical Group Spring 2010 Health Information Technology for Economic and Clinical Health Act (HITECH) As part of the Recovery Act,

More information

organization's patient protected health information (PHI) occurs. as any other federal or state notification law.

organization's patient protected health information (PHI) occurs. as any other federal or state notification law. I. APPLICABILITY Entire organization and its business associate (BAs) and the BA's Subcontractors. II. PURPOSE To provide guidance for breach notification by covered entities and breaches by their business

More information

HIPAA BREACH RESPONSE POLICY

HIPAA BREACH RESPONSE POLICY http://dhmh.maryland.gov/sitepages/op02.aspx (OIG) DHMH POLICY 01.03.07 Effective Date: July 22, 2014 I. EXECUTIVE SUMMARY The Department of Health and Mental Hygiene (DHMH) is committed to protecting

More information

HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary

HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary The Health Information Technology for Economic and Clinical Health Act (the HITECH Act), which became law in February of this

More information

University of Wisconsin-Madison Policy and Procedure

University of Wisconsin-Madison Policy and Procedure Page 1 of 12 I. Policy The Health Information Technology for Economic and Clinical Health Act ( HITECH ) regulations contain requirements for notifying individuals in the event of a breach of their unsecured

More information

NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA. March 2010

NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA. March 2010 NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA March 2010 Prepared By: Marisa Guevara and Marcie H. Zakheim Feldesman Tucker Leifer Fidell, LLP 2001

More information

Federal Breach Notification Decision Tree and Tools

Federal Breach Notification Decision Tree and Tools Federal Breach Notification and Tools Disclaimer This document is copyright 2013 by the Long Term Care Consortium (LTCC). These materials may be reproduced and used only by long-term health care providers

More information

POLICY NAME: NOTICE OF PRIVACY BREACHES

POLICY NAME: NOTICE OF PRIVACY BREACHES NOTE: This sample policy is drafted to comply with the HIPAA breach notification rules as amended January 2013. The user should review applicable laws and regulations and modify this sample policy as appropriate

More information

Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration

Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration Name of Policy: Policy Number: Department: Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration Approving Officer: Interim

More information

Guidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES

Guidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES DEPARTMENT OF HEALTH AND HUMAN SERVICES 45 CFR PARTS 160 and 164 Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable

More information

New HIPAA Rules and EHRs: ARRA & Breach Notification

New HIPAA Rules and EHRs: ARRA & Breach Notification New HIPAA Rules and EHRs: ARRA & Breach Notification Jim Sheldon-Dean Director of Compliance Services Lewis Creek Systems, LLC www.lewiscreeksystems.com and Raj Goel Chief Technology Officer Brainlink

More information

IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240

IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240 IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240 POLICY INFORMATION Major Functional Area (MFA): MFA X - Office of General Counsel & Compliance

More information

HIPAA and the HITECH Act Privacy and Security of Health Information in 2009

HIPAA and the HITECH Act Privacy and Security of Health Information in 2009 HIPAA and the HITECH Act Privacy and Security of Health Information in 2009 What is HIPAA? Health Insurance Portability & Accountability Act of 1996 Effective April 13, 2003 Federal Law HIPAA Purpose:

More information

M E M O R A N D U M. Definitions

M E M O R A N D U M. Definitions M E M O R A N D U M DATE: November 10, 2011 TO: FROM: RE: Krevolin & Horst, LLC HIPAA Obligations of Business Associates In connection with the launch of your hosted application service focused on practice

More information

HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN. Stewart C. Miller & Co., Inc. (Business Associate) AND

HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN. Stewart C. Miller & Co., Inc. (Business Associate) AND HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN Stewart C. Miller & Co., Inc. (Business Associate) AND City of West Lafayette Flexible Spending Plan (Covered Entity) TABLE OF CONTENTS

More information

FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA

FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA APPENDIX PR 12-A FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA LEGAL CITATION California Civil Code Section 1798.82 California Health and Safety (H&S) Code Section 1280.15 42 U.S.C. Section

More information

HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations

HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations Health Care Litigation Webinar Series March 22, 2012 Spence Pryor Paula Stannard Jason Popp 1 HIPAA/HITECH

More information

HIPAA Breach Reporting Tips & Tricks IADDA Annual Conference 2014

HIPAA Breach Reporting Tips & Tricks IADDA Annual Conference 2014 HIPAA Breach Reporting Tips & Tricks IADDA Annual Conference 2014 9/3/14 Gerald Jud E. DeLoss Disclaimer 2 o This presentation and its materials are for informational purposes only and not for the purpose

More information

H. R. 1 144. Subtitle D Privacy

H. R. 1 144. Subtitle D Privacy H. R. 1 144 (1) an analysis of the effectiveness of the activities for which the entity receives such assistance, as compared to the goals for such activities; and (2) an analysis of the impact of the

More information

BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS

BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS The following HIPAA Business Associate Terms and Conditions (referred to hereafter as the HIPAA Agreement ) are part of the Brevium Software License

More information

HIPAA Update. Bob Radecki W.J. Flynn and Associates, LLC

HIPAA Update. Bob Radecki W.J. Flynn and Associates, LLC HIPAA Update Bob Radecki W.J. Flynn and Associates, LLC Background ARRA American Recovery and Reinvestment Act of 2009 HITECH Health Information Technology for Economic and Clinical Act (Title XII, Part

More information

Updated HIPAA Regulations What Optometrists Need to Know Now. HIPAA Overview

Updated HIPAA Regulations What Optometrists Need to Know Now. HIPAA Overview Updated HIPAA Regulations What Optometrists Need to Know Now The U.S. Department of Health & Human Services Office for Civil Rights recently released updated regulations regarding the Health Insurance

More information

Model Business Associate Agreement

Model Business Associate Agreement Model Business Associate Agreement Instructions: The Texas Health Services Authority (THSA) has developed a model BAA for use between providers (Covered Entities) and HIEs (Business Associates). The model

More information

What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act

What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act by Lane W. Staines and Cheri D. Green On February 17, 2009, The American Recovery and Reinvestment Act

More information

AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE

AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE This Notice of Privacy Practices describes the legal obligations of Ave Maria University, Inc. (the plan ) and your legal rights regarding your protected health

More information

Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate

Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate Privacy, Data Security & Information Use September 16, 2010 Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate by John L. Nicholson and Meighan E. O'Reardon Effective

More information

SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY

SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY 1 School Board Policy 523.5 The School District of Black River Falls ( District ) is committed to compliance with the health information

More information

CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy

CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy Amended as of February 12, 2010 on the authority of the HIPAA Privacy Officer for Creative Solutions in Healthcare, Inc. TABLE OF CONTENTS ARTICLE

More information

HIPAA Breach Notification Policy

HIPAA Breach Notification Policy HIPAA Breach Notification Policy Purpose: To ensure compliance with applicable laws and regulations governing the privacy and security of protected health information, and to ensure that appropriate notice

More information

HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST. David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com

HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST. David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com Presenters David Schoolcraft, Member, Ogden Murphy Wallace, PLLC Taya Briley,

More information

CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS

CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS Dear Physician Member: Thank you for contacting the California Medical Association and thank you for your membership. In order to advocate on your behalf,

More information

HIPAA/HITECH Omnibus Final Rule - January 23, 2013

HIPAA/HITECH Omnibus Final Rule - January 23, 2013 HIPAA Omnibus Rule Please note: these slides are intended to provide an overview of general information, not an exhaustive review. No legal advice is being offered or intended. Do not rely on this information

More information

what your business needs to do about the new HIPAA rules

what your business needs to do about the new HIPAA rules what your business needs to do about the new HIPAA rules Whether you are an employer that provides health insurance for your employees, a business in the growing health care industry, or a hospital or

More information

Business Associate Agreement Involving the Access to Protected Health Information

Business Associate Agreement Involving the Access to Protected Health Information School/Unit: Rowan University School of Osteopathic Medicine Vendor: Business Associate Agreement Involving the Access to Protected Health Information This Business Associate Agreement ( BAA ) is entered

More information

NCHICA HITECH Act Breach Notification Risk Assessment Tool. Prepared by the NCHICA Privacy, Security & Legal Officials Workgroup

NCHICA HITECH Act Breach Notification Risk Assessment Tool. Prepared by the NCHICA Privacy, Security & Legal Officials Workgroup NCHICA HITECH Act Breach Notification Risk Assessment Tool Prepared by the NCHICA Privacy, Security & Legal Officials Workgroup NORTH CAROLINA HEALTHCARE INFORMATION AND COMMUNICATIONS ALLIANCE, INC August

More information

Section 2: HIPAA and the HITECH Act

Section 2: HIPAA and the HITECH Act Section 2: HIPAA and the HITECH Act 1 Introduction to HIPAA and the HITECH Act The Health Information Technology for Economic and Clinical Health (HITECH) Act was signed on February 17, 2009 as part of

More information

Page 1. NAOP HIPAA and Privacy Risks 3/11/2014. Privacy means being able to have control over how your information is collected, used, or shared;

Page 1. NAOP HIPAA and Privacy Risks 3/11/2014. Privacy means being able to have control over how your information is collected, used, or shared; Page 1 National Organization of Alternative Programs 2014 NOAP Educational Conference HIPAA and Privacy Risks Ira J Rothman, CPHIMS, CIPP/US/IT/E/G Senior Vice President - Privacy Official March 26, 2014

More information

SAMPLE BUSINESS ASSOCIATE AGREEMENT

SAMPLE BUSINESS ASSOCIATE AGREEMENT SAMPLE BUSINESS ASSOCIATE AGREEMENT THIS AGREEMENT IS TO BE USED ONLY AS A SAMPLE IN DEVELOPING YOUR OWN BUSINESS ASSOCIATE AGREEMENT. ANYONE USING THIS DOCUMENT AS GUIDANCE SHOULD DO SO ONLY IN CONSULT

More information

The Basics of HIPAA Privacy and Security and HITECH

The Basics of HIPAA Privacy and Security and HITECH The Basics of HIPAA Privacy and Security and HITECH Protecting Patient Privacy Disclaimer The content of this webinar is to introduce the principles associated with HIPAA and HITECH regulations and is

More information

GLENN COUNTY HEALTH AND HUMAN SERVICES AGENCY. HIPAA Policies and Procedures 06/30/2014

GLENN COUNTY HEALTH AND HUMAN SERVICES AGENCY. HIPAA Policies and Procedures 06/30/2014 GLENN COUNTY HEALTH AND HUMAN SERVICES AGENCY HIPAA Policies and Procedures 06/30/2014 Glenn County Health and Human Services Agency HIPAA Policies and Procedures TABLE OF CONTENTS HIPAA Policy Number

More information

Shipman & Goodwin LLP. HIPAA Alert STIMULUS PACKAGE SIGNIFICANTLY EXPANDS HIPAA REQUIREMENTS

Shipman & Goodwin LLP. HIPAA Alert STIMULUS PACKAGE SIGNIFICANTLY EXPANDS HIPAA REQUIREMENTS Shipman & Goodwin LLP HIPAA Alert March 2009 STIMULUS PACKAGE SIGNIFICANTLY EXPANDS HIPAA REQUIREMENTS The economic stimulus package, officially named the American Recovery and Reinvestment Act of 2009

More information

Use & Disclosure of Protected Health Information by Business Associates

Use & Disclosure of Protected Health Information by Business Associates Applicability: Policy Title: Policy Number: Use & Disclosure of Protected Health Information by Business Associates PP-12 Superseded Policy(ies) or Entity Policy: N/A Date Established: January 31, 2003

More information

HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI

HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI January 23, 2013 HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI Executive Summary HHS has issued final regulations that address recent legislative

More information

FORM OF HIPAA BUSINESS ASSOCIATE AGREEMENT

FORM OF HIPAA BUSINESS ASSOCIATE AGREEMENT FORM OF HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( Agreement ) is made and entered into to be effective as of, 20 (the Effective Date ), by and between ( Covered Entity ) and

More information

BUSINESS ASSOCIATE AGREEMENT

BUSINESS ASSOCIATE AGREEMENT BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT ( Agreement ) is entered into by and between (the Covered Entity ), and Iowa State Association of Counties (the Business Associate ). RECITALS

More information

Identity Theft Prevention and Security Breach Notification Policy. Purpose:

Identity Theft Prevention and Security Breach Notification Policy. Purpose: Identity Theft Prevention and Security Breach Notification Policy Purpose: Lahey Clinic is committed to protecting the privacy of the Personal Health Information ( PHI ) of our patients and the Personal

More information

REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES PLEASE REVIEW IT CAREFULLY.

REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES PLEASE REVIEW IT CAREFULLY. REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION (PHI) ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS

More information

Terms and Conditions Relating to Protected Health Information ( City PHI Terms ) Revised and Effective as of September 23, 2013

Terms and Conditions Relating to Protected Health Information ( City PHI Terms ) Revised and Effective as of September 23, 2013 Terms and Conditions Relating to Protected Health Information ( City PHI Terms ) Revised and Effective as of September 23, 2013 The City of Philadelphia is a Covered Entity as defined in the regulations

More information

by Alicia H. Sable and Robert Hudock August 2009

by Alicia H. Sable and Robert Hudock August 2009 The New HIPAA Breach Notification Rules: A Guide for Covered Entities and Business Associates to the Breach Reporting Obligations under the HITECH Act and HHS Regulations by Alicia H. Sable and Robert

More information

HIPAA Business Associate Agreement

HIPAA Business Associate Agreement HIPAA Business Associate Agreement User of any Nemaris Inc. (Nemaris) products or services including but not limited to Surgimap Spine, Surgimap ISSG, Surgimap SRS, Surgimap Office, Surgimap Ortho, Surgimap

More information

HIPAA Privacy and Security Changes in the American Recovery and Reinvestment Act

HIPAA Privacy and Security Changes in the American Recovery and Reinvestment Act International Life Sciences Arbitration Health Industry Alert If you have questions or would like additional information on the material covered in this Alert, please contact the author: Brad M. Rostolsky

More information

Business Associate Agreement

Business Associate Agreement This Business Associate Agreement Is Related To and a Part of the Following Underlying Agreement: Effective Date of Underlying Agreement: Vendor: Business Associate Agreement This Business Associate Agreement

More information

October 22, 2009. 45 CFR PARTS 160 and 164

October 22, 2009. 45 CFR PARTS 160 and 164 October 22, 2009 U.S. Department of Health and Human Services Office for Civil Rights Attention: HITECH Breach Notification Hubert H. Humphrey Building Room 509 F 200 Independence Avenue, SW Washington,

More information

Am I a Business Associate?

Am I a Business Associate? Am I a Business Associate? Now What? JENNIFER L. RATHBURN Quarles & Brady LLP KATEA M. RAVEGA Quarles & Brady LLP agenda» Overview of HIPAA / HITECH» Business Associate ( BA ) Basics» What Do BAs Have

More information

HIPAA 101. March 18, 2015 Webinar

HIPAA 101. March 18, 2015 Webinar HIPAA 101 March 18, 2015 Webinar Agenda Acronyms to Know HIPAA Basics What is HIPAA and to whom does it apply? What is protected by HIPAA? Privacy Rule Security Rule HITECH Basics Breaches and Responses

More information

HIPAA Omnibus Rule Overview. Presented by: Crystal Stanton MicroMD Marketing Communication Specialist

HIPAA Omnibus Rule Overview. Presented by: Crystal Stanton MicroMD Marketing Communication Specialist HIPAA Omnibus Rule Overview Presented by: Crystal Stanton MicroMD Marketing Communication Specialist 1 HIPAA Omnibus Rule - Agenda History of the Omnibus Rule What is the HIPAA Omnibus Rule and its various

More information

HIPAA Omnibus Rule Practice Impact. Kristen Heffernan MicroMD Director of Prod Mgt and Marketing

HIPAA Omnibus Rule Practice Impact. Kristen Heffernan MicroMD Director of Prod Mgt and Marketing HIPAA Omnibus Rule Practice Impact Kristen Heffernan MicroMD Director of Prod Mgt and Marketing 1 HIPAA Omnibus Rule Agenda History of the Rule HIPAA Stats Rule Overview Use of Personal Health Information

More information

By Ross C. D Emanuele, John T. Soshnik, and Kari Bomash, Dorsey & Whitney LLP Minneapolis, MN

By Ross C. D Emanuele, John T. Soshnik, and Kari Bomash, Dorsey & Whitney LLP Minneapolis, MN Major Changes to HIPAA Security and Privacy Rules Enacted in Economic Stimulus Package By Ross C. D Emanuele, John T. Soshnik, and Kari Bomash, Dorsey & Whitney LLP Minneapolis, MN The HITECH Act is the

More information

NOTICE OF THE NATHAN ADELSON HOSPICE PRIVACY PRACTICES

NOTICE OF THE NATHAN ADELSON HOSPICE PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION PLEASE REVIEW IT CAREFULLY. DEFINITIONS PROTECTED HEALTH INFORMATION (PHI):

More information

Infinedi HIPAA Business Associate Agreement RECITALS SAMPLE

Infinedi HIPAA Business Associate Agreement RECITALS SAMPLE Infinedi HIPAA Business Associate Agreement This Business Associate Agreement ( Agreement ) is entered into this day of, 20 between ( Company ) and Infinedi, LLC, a Limited Liability Corporation, ( Contractor

More information

BUSINESS ASSOCIATE AGREEMENT

BUSINESS ASSOCIATE AGREEMENT BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (the BAA ) is made and entered into as of the day of, 20, by and between Delta Dental of California (the Covered Entity ) and (the Business

More information

Statement of Policy. Reason for Policy

Statement of Policy. Reason for Policy Table of Contents Statement of Policy 2 Reason for Policy 2 HIPAA Liaison 2 Individuals and Entities Affected by Policy 2 Who Should Know Policy 3 Exclusions 3 Website Address for Policy 3 Definitions

More information

Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know

Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know Note: Information provided to NCRA by Melodi Gates, Associate with Patton Boggs, LLC Privacy and data protection

More information

BUSINESS ASSOCIATE AGREEMENT. (Contractor name and address), hereinafter referred to as Business Associate;

BUSINESS ASSOCIATE AGREEMENT. (Contractor name and address), hereinafter referred to as Business Associate; BUSINESS ASSOCIATE AGREEMENT (Agreement #) THIS DOCUMENT CONSTITUTES AN AGREEMENT BETWEEN: AND (Contractor name and address), hereinafter referred to as Business Associate; The Department of Behavioral

More information

12/19/2014. HIPAA More Important Than You Realize. Administrative Simplification Privacy Rule Security Rule

12/19/2014. HIPAA More Important Than You Realize. Administrative Simplification Privacy Rule Security Rule HIPAA More Important Than You Realize J. Ira Bedenbaugh Consulting Shareholder February 20, 2015 This material was used by Elliott Davis Decosimo during an oral presentation; it is not a complete record

More information

HIPAA BREACH NOTIFICATION REQUIREMENTS. Heman A. Marshall, III July 25, 2014

HIPAA BREACH NOTIFICATION REQUIREMENTS. Heman A. Marshall, III July 25, 2014 1 HIPAA BREACH NOTIFICATION REQUIREMENTS Heman A. Marshall, III July 25, 2014 2 SCENARIO FOR VBA SUMMER MEETING The Medical Marijuana Growers Association (MMGA) Health Plan, which is a self-fund plan,

More information

HHS announces sweeping changes to the HIPAA Privacy and Security Rules in the final HIPAA Omnibus Rule

HHS announces sweeping changes to the HIPAA Privacy and Security Rules in the final HIPAA Omnibus Rule JANUARY 23, 2013 HHS announces sweeping changes to the HIPAA Privacy and Security Rules in the final HIPAA Omnibus Rule By Linn Foster Freedman, Kathryn M. Sylvia, Lindsay Maleson, and Brooke A. Lane On

More information

BUSINESS ASSOCIATE AGREEMENT Tribal Contract

BUSINESS ASSOCIATE AGREEMENT Tribal Contract DEPARTMENT OF HEALTH SERVICES Division of Enterprise Services F-00714 (08/2013) STATE OF WISCONSIN BUSINESS ASSOCIATE AGREEMENT Tribal Contract This Business Associate Agreement is made between the Wisconsin

More information

BUSINESS ASSOCIATE AGREEMENT. Business Associate. Business Associate shall mean.

BUSINESS ASSOCIATE AGREEMENT. Business Associate. Business Associate shall mean. BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement is made as of the day of, 2010, by and between Methodist Lebonheur Healthcare, on behalf of itself and all of its affiliates ( Covered Entity

More information

Name of Other Party: Address of Other Party: Effective Date: Reference Number as applicable:

Name of Other Party: Address of Other Party: Effective Date: Reference Number as applicable: PLEASE NOTE: THIS DOCUMENT IS SUBMITTED AS A SAMPLE, FOR INFORMATIONAL PURPOSES ONLY TO ABC ORGANIZATION. HIPAA SOLUTIONS LC IS NOT ENGAGED IN THE PRACTICE OF LAW IN ANY STATE, JURISDICTION, OR VENUE OF

More information

Disclaimer: Template Business Associate Agreement (45 C.F.R. 164.308)

Disclaimer: Template Business Associate Agreement (45 C.F.R. 164.308) HIPAA Business Associate Agreement Sample Notice Disclaimer: Template Business Associate Agreement (45 C.F.R. 164.308) The information provided in this document does not constitute, and is no substitute

More information

HIPAA BUSINESS ASSOCIATE AGREEMENT

HIPAA BUSINESS ASSOCIATE AGREEMENT HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement ("BA AGREEMENT") supplements and is made a part of any and all agreements entered into by and between The Regents of the University

More information

My Docs Online HIPAA Compliance

My Docs Online HIPAA Compliance My Docs Online HIPAA Compliance Updated 10/02/2013 Using My Docs Online in a HIPAA compliant fashion depends on following proper usage guidelines, which can vary based on a particular use, but have several

More information