HIPAA Privacy Breach Notification Regulations
|
|
- Isabella Hamilton
- 8 years ago
- Views:
Transcription
1 Technical Bulletin Issue HIPAA Privacy Breach Notification Regulations On August 24, 2009 Health and Human Services (HHS) issued interim final regulations implementing the HIPAA Privacy Breach Notification requirements contained in the American Recovery and Reinvestment Act (ARRA). ARRA, which was enacted in February, added a new notification requirement when an individual s unsecured protected health information (PHI) is breached. Breach notifications will be required for any breach occurring after September 22, Regulations issued on April 27, 2009 provided guidance on when PHI is unsecured. These new regulations provide additional guidance in key areas including: What constitutes a breach To whom must the new breach notification be sent What information needs to be included in the notices When and how must notices be provided This Technical Bulletin addresses the guidance provided by HHS for privacy breach notification requirements for HIPAA covered entities and business associates. (The Federal Trade Commission (FTC) issued similar regulations for vendors of Personal Health Records (PHR) on August 25, 2009 which are not discussed in this Technical Bulletin.) What is a Breach ARRA defines a breach as the: unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of the protected health information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information. A breach requires notification when a covered entity or business associate experiences a breach of unsecured PHI. Encryption is not required under HIPAA. Encryption is an addressable implementation specification under HIPAA Security rules. However, information encrypted using HHS specified methods is secured. Notification is not required under HIPAA (but may be under a state law) if the PHI that was breached was secured. For more information on HHS s April 27 regulations defining unsecured PHI, please see our Technical Bulletin at: HHS provides additional guidance on what constitutes a breach which triggers the notification requirement: The information breached is PHI. The breach notification requirement does not apply to information that is not PHI such as de-identified information.
2 There has been an unauthorized acquisition, access, use or disclosure. Unauthorized means acquisition, access, use or disclosure that is not permitted under HIPAA privacy rules. If there is no HIPAA privacy violation, there is no breach. Regulators noted that uses or disclosures involving more than the minimum necessary amount may qualify as a breach. Compromises the security or privacy of the protected health information. HHS defines this as poses a significant risk of financial, reputational, or other harm to the individual. In order to determine if there is a significant risk, covered entities and business associates will need to perform a risk assessment. In conducting a risk assessment, HHS expects the covered entity or business associate to consider a number of factors such as the type and amount of PHI involved, who accessed the information, and the nature of the PHI. For example, if the PHI is disclosed in violation of the privacy rules, but the recipient is a HIPAA covered entity required to protect PHI, the incident may not be a breach. The number of individuals affected is not a factor in assessing the risk to determine if a breach has occurred. It will affect how notification is provided. Comment: One possible example of a privacy violation that may not be a breach based on the type of PHI involved is a list of employee s names & 3 rd quarter health care FSA balances (with no other information). Based on the limited information included it is unlikely that it could be used for a harm. A limited data set - which is PHI with 16 specific identifiers removed - is considered unsecured by HHS unless it is otherwise secured under HHS regulations. However, if both the individual s zip code and date of birth have been removed from the limited data set, HHS has stated that unauthorized access, use or disclosure would not compromise the security or privacy of the PHI. Therefore, it would not be a breach and no breach notification would be required. If either the date of birth or the zip code is included, a risk assessment must be performed to determine if a breach has occurred. ARRA includes three exceptions to the breach rule. These exceptions are situations where a HIPAA privacy violation has occurred, but the violation would not be considered a breach. Those exceptions along with HHS guidance are: 1. Unintentional acquisition, access or use of protected health information by an employee or individual acting under the authority of a covered entity or business associate, if the acquisition, access, or use was made in good faith, within the course and scope of employment or other professional relationship, and does not result in further use or disclosure. HHS used an example where a billing employee opens an with PHI mistakenly sent by a nurse. The billing employee realizes he is not the intended recipient, notifies the nurse of the mistake and deletes the Inadvertent disclosure of PHI from a person who is authorized to access PHI at a facility to another similarly situated person authorized to access PHI at the same facility if the information is not further used or disclosed without authorization. Inadvertent disclosures of PHI from a person who is authorized to access PHI at a covered entity or business associate to another person authorized to access PHI at the same covered entity or business associate are also exceptions. Regulators did not include a specific example for this exception. 3.The unauthorized person to whom PHI has been disclosed would not reasonably have been able to retain the information. HHS gave two examples. In the first example, a health plan Page 2 Issue
3 sends EOBs to the wrong person. The envelopes are returned by the post office unopened and marked undeliverable. In this case no breach occurred. If, however, any of the envelopes are not returned, this should be treated as a potential breach. In the second example, a nurse hands a patient someone else s discharge papers, but realizes her mistake and recovers the papers quickly. If the nurse can reasonably conclude that the patient could not have read the information, this would not be a breach. If unsecured PHI is accessed, used or disclosed in violation of the HIPAA privacy rules and the incident does not qualify for one of these three exceptions, the covered entity or business associate must conduct a risk assessment to determine if the unauthorized access, use or disclosure will compromise the privacy or security of the individual s PHI. The covered entity has the burden of proof in making this decision and is required to document its risk assessment and findings. Comment: One of the purposes of the risk assessment is to limit notifications to situations where there is a significant risk of harm. Too many notifications may confuse individuals. Too many notifications may also make it more difficult for individuals to determine when the situation poses a risk which creates the need for some action on their part. Unsecured Protected Health Information Unsecured protected health information is PHI that is not secured through the use of a technology or methodology specified by HHS. The April 27 regulations provide detailed information on the technologies and methodologies which HHS considers will render protected health information unusable, unreadable or indecipherable to unauthorized individuals. In general, only two methods are acceptable encryption using specific National Institute of Standards and Technology (NIST) standards or destruction. The August 24 guidance does not add any new methods or technologies for securing PHI. It does, however, make it clear that the term unsecured protected health information can include information in any form or medium including electronic, paper or oral form. In addition, the guidance states that where PHI is encrypted, the encryption or decryption key must be kept on a separate device from the data it encrypts or decrypts to avoid a breach. The preamble to the regulations also discusses two other methods for securing PHI which HHS considered and specifically rejected. The first is redaction of paper records which HHS does not view as a standardized methodology with proven capabilities to destroy or render the underlying information unreadable, unusable or indecipherable. Only the destruction of paper is deemed secure. The second is the use of access controls such as a firewall. While access controls are required under the HIPAA security rules and important security tools, they will not render the information unreadable, unusable or indecipherable. Comment: While redaction and access controls are not sufficient to secure PHI, they do reduce the potential for unauthorized access. The use of one of these methods may be an important consideration during the risk assessment when the covered entity or business associate must determine if an impermissible use or disclosure of PHI constitutes a breach. Comment: Office of Management and Budget (OMB) memorandum M provides information on how federal government agencies have been handling potential breach of personally identifiable information and the subsequent risk assessments. These are pertinent to the HIPPA determination process and the need for breach notifications. While the memo is pre-arra, it provides some very Page 3 Issue
4 useful information. For a copy of that memorandum: To Whom Must Breach Notification Be Sent In the event of a breach, the covered entity is required to send notices to affected individuals and Health and Human Services (HHS). In cases where the breach affects more than 500 individuals in a jurisdiction, notification must also be made to prominent media outlets. Individual Notifications Following the discovery of the breach of unsecured PHI, the covered entity must notify every individual whose unsecured PHI has been (or is reasonably believed by the covered entity to have been) accessed, acquired, used or disclosed as a result of the breach. Notification to Health and Human Services The covered entity is required to report all breaches to HHS. The method and timing of the report depends on the number of individuals affected by the breach. If fewer than 500 individuals are affected, the covered entity must keep a log and report the breach within 60 days after the end of the calendar year in which the breach occurred. For 2009, this will only include breaches occurring after September 22. If 500 or more individuals are affected by a breach, the covered entity is required to report the breach to HHS as soon as reasonably possible (see When and How Notices Must be Provided below). HHS will post the names of covered entities with a breach affecting 500 or more individuals on its web site. Notification to Prominent Media Outlets If the breach involves more than 500 individuals in a single State or jurisdiction, the covered entity is required to notify prominent media outlets where affected individuals likely reside. State is defined to include the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, and Guam. Jurisdiction is defined as a geographic area smaller than a State such as a county, city or town. If the breach involves more than 500 individuals who live in different jurisdictions, media notification is not required. For example, if a breach involves 200 individuals living in Maryland, 200 individuals living in Virginia and 200 individuals living in the District of Columbia, media notification is not required. Notification must be sent to a prominent media outlet. HHS states that what constitutes a prominent media outlet will differ depending on the State or jurisdiction involved. For a breach affecting more than 500 individuals in a particular State, a prominent media outlet may be a major, general interest newspaper with a daily circulation throughout the State. A newspaper serving only one town and distributed on a monthly basis, or a daily newspaper of specialized interest (such as sport, politics) would not be viewed as a prominent media outlet. If the individuals affected by the breach reside in a more limited area such as a city, then a major, general-interest newspaper with daily circulation throughout that city may be a prominent media outlet. A prominent media outlet may also be a major television station where the individuals reside in a city. For larger geographical areas, the media outlet must serve the larger Page 4 Issue
5 area. In cases involving more than one jurisdiction, the covered entity may need to notify more than one media outlet. What Information Needs to Be Included in the Notices The notice must be written in plain language and contain five specific items: 1. A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; 2. A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); 3. Any steps individuals should take to protect themselves from potential harm resulting from the breach; 4. A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and 5. Contact procedures for individuals to ask questions or learn additional information, which must include a toll-free number, an address, web site, or postal address. The notice should include a description of the type of information involved, but should not include any sensitive information. The covered entity may also wish to include additional information such as a suggestion that the individual contact his or her credit card company or how to contact credit reporting bureaus, if appropriate. Instructions for what information to send to HHS will be posted on the HHS website. While not specified, the required information will probably be the same or similar to the information required in the individual notices. Notification to the media outlet must include the same content as required for the individual notices. The format is not specified, but it may take the form of a press release. When and How Notices Must be Provided HHS guidance describes what will be considered timely notice and what methods must be used to provide the required notices. The rules cover notices to individuals, HHS and if required, to major media outlets. The time frame for sending notices is the same for all notices except the notice to HHS for breaches affecting fewer than 500 individuals. When Must Notices Be Provided The covered entity is permitted to take a reasonable amount of time to investigate the circumstances to conduct a risk assessment to determine that a breach has occurred and to collect the information which must be included in the notices. Individual notices must be provided without unreasonable delay and in no case later than 60 calendar days after the date the breach is discovered by the covered entity. Page 5 Issue
6 Covered entities may provide the required information to individuals with information in multiple mailings, as information becomes available, as long as the notices with all of the required content are sent within the 60-day time period. HHS makes it clear that this 60 day time frame is the outer limit for providing notification. If the covered entity has determined that a breach occurs and has the information needed for the notice within 10 days, sending the notice on the 60 th day would be an unreasonable delay. The clock for sending the notices starts when the covered entity discovers the breach. Breaches are treated as discovered on the first day that the breach is known, or by exercising reasonable diligence would have been known, to the covered entity. A breach is considered known when any person in the covered entity s workforce (other than the person committing the breach) knows of the breach. Workforce is defined to include more than just employees. For example, it includes volunteers and trainees who are under the control of the covered entity. The guidance makes it clear that the 60 day time frame begins when the incident is discovered, not when the covered entity has investigated the event and determined that it constitutes a breach. Covered entities should establish procedures to report incidents and to ensure that workforce members are adequately trained and aware of the importance of timely reporting of privacy and security incidents (as well of the potential consequences for failure to report incidents). Comment: Covered entities may want to conduct at least some basic training of their workforce since the discovery of a security incident by any member of the covered entity s workforce will start the 60 day clock. Basic training could include information such as what types of security incidents must be reported, how, when and to whom. A delay is permitted where a law enforcement official determines that the notice would impede a criminal investigation or cause damage to national security. The covered entity may temporarily delay a notification (including any web site posting) based on an oral request for the time period requested by law enforcement up to 30 days. The covered entity must document the request including the requested delay period and the identity of the law enforcement official. If the law enforcement request is written, the covered entity may delay notification based on the time frame in the written request. If a business associate of the covered entity is an agent of the covered entity (determined in accordance with the federal common law of agency), the covered entity will be treated as knowing about the breach when the business associate first knows about the breach. If a business associate is not an agent of the covered entity, the business associate must notify the covered entity without unreasonable delay and in all cases within 60 calendar days. (See Notification by a Business Associate below.) For breaches involving fewer than 500 individuals, information must be reported to HHS within 60 days after the end of the calendar year. Methods for Providing Notification Individual notices must be sent via first class mail to the individual s last known address. Written notice may be provided in the form of electronic mail, provided the individual agrees to receive electronic notice (and has not withdrawn agreement). If the individual is a minor or lacks legal capacity due to a physical or mental condition, the notice may be sent to the parent or other person who is the personal representative of the individual. If the individual is deceased, notice must be sent to the last known address of the next of kin (or a personal representative who has the authority to act on behalf of the decedent or the decedent s estate if the covered entity has contact information for that person rather than next of kin.) Page 6 Issue
7 In some cases the covered entity may not have sufficient contact information for some or all of the affected individuals. In other cases notices may be returned as undeliverable. In these cases the covered entity is permitted to use a substitute form for the notice. Substitute notice must have the same contents and should be provided as soon as reasonably possible after the covered entity realizes that it has incomplete or out of date information. Substitute notice is not required for next of kin of a deceased individual if the covered entity has out of date or no contact information. If there are fewer than 10 individuals for whom the covered entity has incomplete or out of date address information, the covered entity may use an alternative form to provide notification such as telephone or depending on the information available to the covered entity. If the covered entity has incomplete or out of date contact information for 10 or more individuals, then substitute notice must be provided through a conspicuous posting on the covered entity s web site. The posting must be on the home page or provide a prominent hyperlink to the notice on its home page and must include a toll free number for individuals to call with questions or to get more information. The hyperlink should be noticeable and worded to convey the nature and importance of the information. The notice may be located in the login page for existing account holders. The link must be on the web site for at least 90 days. If the covered entity does not have (or prefers not to use) a website, it may post the notice in major print or broadcast media where affected individuals are likely to reside. The notice must be continued for at least 90 days and include the toll free number. In urgent situations (not defined) where there is a possible imminent misuse of the unsecured protected health information, the covered entity may also provide notice by other means such as telephone. However, this notice must be in addition to the written notice sent via first class mail. Notification by a Business Associate Business associates are required to notify a covered entity in the event of a breach of unsecured protected health information. The regulations do not specify to whom or how the business associate will notify the covered entity. In the preamble, HHS states that covered entities and business associates should determine when and how the required reporting will be accomplished. Procedures and time frames agreed upon will need to be incorporated into business associate agreements. If the business associate is an agent of the covered entity (determined based on the federal common law of agency), the covered entity will be treated as having discovered the breach when the business associate discovers the breach. The rules for determining when a breach is discovered by as business associate are the same as those used by a covered entity. If the business associate in not an agent of the covered entity (i.e. the business associate is an independent contractor), the business associate should notify the covered entity as soon as possible of the breach, but in no event more than within 60 calendar days after discovery. In all cases, the business associate must provide the covered entity with the names of affected individuals to the extent the business associate has that information. In some circumstances, the business associate may have no or incomplete information about the identity of individuals whose unsecured PHI has been breached. The example included by HHS is a records storage company that stores several hundred boxes of the covered entity s paper medical records. If several boxes are missing, the record storage company may not know the individuals whose records were contained in the missing boxes. Page 7 Issue
8 Since under some circumstances the business associate may be in the best position to gather the information required for the breach notification, business associates are required to provide the covered entity with other information which the covered entity will need for the required notices. Covered entities and business associates are expected to continue to specify in their agreements obligations such as when, how and to whom a breach will be reported and who will send the individual notifications. In some cases, the business associate may be in a better position to provide those notices. The covered entity and business associate should coordinate their efforts to avoid providing duplicates notices. Comment: While the covered entity and business associate may agree to have the business associate send the individual notices, it appears that the covered entity is required to provide required notification to HHS (and, if needed, the media). State Laws In general, HIPAA provides that State laws which conflict will be preempted. State laws which are similar including those with more stringent requirements that do not conflict with HIPAA requirements are not preempted. Currently a number of states have some form (e.g., personal information rather than health information) of breach notification laws. It is HHS belief that generally covered entities will be able to comply with both State laws and HIPAA. However, covered entities will need to review their own State laws to make this determination. Effective Date These rules are effective for breaches of unsecured protected health information occurring after September 22, However, HHS has said they will use their regulatory discretion not to impose sanctions for failure to provide the required notices for breaches that are discovered before February 22, During this time period they expect covered entities to comply with the rules and will work with covered entities providing technical assistance and voluntary corrective action to achieve compliance. Action Steps Even with HHS use of enforcement discretion not to impose sanctions for breaches that are discovered before February 22, covered entities (and business associates) have only a short time to become familiar with the new rules and take needed action. Some key action steps are: 1. Review current PHI. Perform an assessment of PHI that the covered entity currently receives, uses, stores or transmits. Determine how much and what type of PHI is involved, who has access, how PHI is received and sent, and how the information is currently protected. Reviewing storage of PHI on portable devices such as laptops, hard drives, CD-ROMs and flash drives will be particularly important since those devices may constitute the greatest risk. 2. Reduce PHI. To the extent feasible, the covered entity may choose to reduce the amount of PHI it uses, stores, receives or shares. The smaller the amount of PHI, the lower the potential for a breach. Page 8 Issue
9 3. Inventory PHI. Take inventory of all of the covered entity s PHI for future reference. The covered entity may also want to reorganize how it handles PHI and/or improve recordkeeping of its paper PHI. 4. Determine if any PHI should be encrypted. Depending on the amount of PHI, type involved and the amount of storage and transmission, a covered entity may decide to encrypt some, or all, of its PHI. The covered entity should work with its IT staff to determine if encryption is appropriate. 5. Update Policies & Procedures. Review current policies and procedures, add appropriate provisions and processes to cover the new breach notification rules. This may also be a good time to make any other needed updates (e.g., if there has been a change in how the covered entity uses PHI, this would be an excellent opportunity to update the documentation). 6. Training. The new breach notification rules will have a significant impact on who is trained and how covered entities provide HIPAA training. In the past, the covered entity could limit training to individuals who would have access to PHI such as HR staff. Under the new rules, a breach will be treated as discovered when any member of the covered entity s workforce becomes aware of the incident. Covered entities may want to provide some training on recognizing and reporting security incidents to all members of its workforce. This may also be an excellent opportunity to update HIPAA training in general and conduct refresher training where needed. 7. Develop Breach Procedures. Create policies and procedures for identifying and responding to security incidents that may constitute breaches. For example, determine what types of incidents workforce members will be required to report, how to report incidents and who must be notified. The covered entity will also need to develop processes for collecting information and sending notices in the event of a breach. 8. Update Documentation. Modify current policy and procedure documents, any training materials such as manuals, the HIPAA privacy policy and notice; and amend the formal Plan document. 9. Amend Business Associate Agreements. Update business associate agreements to include the new breach notification rules. As part of the process determine the roles of the covered entity and business associate in the event that the business associate experiences a breach. As part of this process, it would be prudent for the covered entity to ensure that it has updated information. 10. Monitor Developments. Covered entities may want to check the HHS web site to keep current on developments. The url for the main HIPAA privacy website is: The intent of this Technical Bulletin is to provide general information on employee benefit issues. It should be not construed as legal advice and, as with any interpretation of law; plan sponsors should seek proper legal advice for application of these rules to their plans Gallagher Benefit Services. Page 9 Issue
Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455. Notification of Security Breach Policy
Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455 Notification of Security Breach Policy Purpose: This policy has been adopted for the purpose of complying with the Health
More informationBarnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule
HEALTHCARE October 2009 Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule This HIPAA Update provides a detailed description of the new breach notification requirements for HIPAA
More informationPOLICY AND PROCEDURE MANUAL
Pennington Biomedical POLICY NO. 412.22 POLICY AND PROCEDURE MANUAL Origin Date: 02/04/2013 Impacts: ALL PERSONNEL Effective Date: 03/17/2014 Subject: HIPAA BREACH NOTIFICATION Last Revised: Source: LEGAL
More informationHow To Notify Of A Security Breach In Health Care Records
CHART YOUR HIPAA COURSE... HHS ISSUES SECURITY BREACH NOTIFICATION RULES PUBLISHED IN FEDERAL REGISTER 8/24/09 EFFECTIVE 9/23/09 The Department of Health and Human Services ( HHS ) has issued interim final
More informationEverett School Employee Benefit Trust. Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law
Everett School Employee Benefit Trust Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law Introduction The Everett School Employee Benefit Trust ( Trust ) adopts this policy
More informationCOMPLIANCE ALERT 10-12
HAWAII HEALTH SYSTEMS C O R P O R A T I O N "Touching Lives Every Day COMPLIANCE ALERT 10-12 HIPAA Expansion under the American Recovery and Reinvestment Act of 2009 The American Recovery and Reinvestment
More informationHIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES
SALISH BHO HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES Policy Name: HIPAA BREACH NOTIFICATION REQUIREMENTS Policy Number: 5.16 Reference: 45 CFR Parts 164 Effective Date: 03/2016 Revision Date(s):
More informationBreach Notification Policy
1. Breach Notification Team. Breach Notification Policy Ferris State University ( Ferris State ), a hybrid entity with health care components, has established a Breach Notification Team, which consists
More informationThe ReHabilitation Center. 1439 Buffalo Street. Olean. NY. 14760
Procedure Name: HITECH Breach Notification The ReHabilitation Center 1439 Buffalo Street. Olean. NY. 14760 Purpose To amend The ReHabilitation Center s HIPAA Policy and Procedure to include mandatory breach
More informationCommunity First Health Plans Breach Notification for Unsecured PHI
Community First Health Plans Breach Notification for Unsecured PHI The presentation is for informational purposes only. It is the responsibility of the Business Associate to ensure awareness and compliance
More informationBREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION
BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION Summary November 2009 On August 24, 2009, the Department of Health and Human Services (HHS) published an interim final rule (the Rule ) that
More informationInformation Privacy and Security Program. Title: EC.PS.01.02
Page: 1 of 9 I. PURPOSE: The purpose of this standard is to ensure that affected individuals, the media, and the Secretary of Health and Human Services (HHS) are appropriately notified of any Breach of
More informationADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016
Page 1 of 9 CITY OF CHESAPEAKE, VIRGINIA NUMBER: 2.62 ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016 SUPERCEDES: N/A SUBJECT: HUMAN RESOURCES DEPARTMENT CITY OF CHESAPEAKE EMPLOYEE/RETIREE GROUP HEALTH
More informationHIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013
HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013 Orchard Creek Health Care is required by law to maintain the privacy of protected health information (PHI) of our residents. If you feel
More informationThis presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in
This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in the HIPAA Omnibus Rule of 2013. As part of the American
More informationChecklist for HITECH Breach Readiness
Checklist for HITECH Breach Readiness Checklist for HITECH Breach Readiness Figure 1 describes a checklist that may be used to assess for breach preparedness for the organization. It is based on published
More informationData Breach, Electronic Health Records and Healthcare Reform
Data Breach, Electronic Health Records and Healthcare Reform (This presentation is for informational purposes only and it is not intended, and should not be relied upon, as legal advice.) Overview of HIPAA
More informationNACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA. March 2010
NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA March 2010 Prepared By: Marisa Guevara and Marcie H. Zakheim Feldesman Tucker Leifer Fidell, LLP 2001
More informationNew HIPAA Breach Notification Rule: Know Your Responsibilities. Loudoun Medical Group Spring 2010
New HIPAA Breach Notification Rule: Know Your Responsibilities Loudoun Medical Group Spring 2010 Health Information Technology for Economic and Clinical Health Act (HITECH) As part of the Recovery Act,
More informationHIPAA BREACH RESPONSE POLICY
http://dhmh.maryland.gov/sitepages/op02.aspx (OIG) DHMH POLICY 01.03.07 Effective Date: July 22, 2014 I. EXECUTIVE SUMMARY The Department of Health and Mental Hygiene (DHMH) is committed to protecting
More informationSTANDARD ADMINISTRATIVE PROCEDURE
STANDARD ADMINISTRATIVE PROCEDURE 16.99.99.M0.26 Investigation and Response to Breach of Unsecured Protected Health Information (HITECH) Approved October 27, 2014 Next scheduled review: October 27, 2019
More informationBusiness Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule
Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule Patricia D. King, Esq. Associate General Counsel Swedish Covenant Hospital Chicago, IL I. Business Associates under
More informationHHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary
HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary The Health Information Technology for Economic and Clinical Health Act (the HITECH Act), which became law in February of this
More informationUNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14
UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14 RULES Issued August 19, 2009 Requires Covered Entities to notify individuals of a breach as well as HHS without reasonable delay or within
More informationGuidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES
DEPARTMENT OF HEALTH AND HUMAN SERVICES 45 CFR PARTS 160 and 164 Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable
More informationReporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration
Name of Policy: Policy Number: Department: Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration Approving Officer: Interim
More informationNew HIPAA Rules and EHRs: ARRA & Breach Notification
New HIPAA Rules and EHRs: ARRA & Breach Notification Jim Sheldon-Dean Director of Compliance Services Lewis Creek Systems, LLC www.lewiscreeksystems.com and Raj Goel Chief Technology Officer Brainlink
More informationIDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240
IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240 POLICY INFORMATION Major Functional Area (MFA): MFA X - Office of General Counsel & Compliance
More informationHIPAA and the HITECH Act Privacy and Security of Health Information in 2009
HIPAA and the HITECH Act Privacy and Security of Health Information in 2009 What is HIPAA? Health Insurance Portability & Accountability Act of 1996 Effective April 13, 2003 Federal Law HIPAA Purpose:
More informationHIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN. Stewart C. Miller & Co., Inc. (Business Associate) AND
HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN Stewart C. Miller & Co., Inc. (Business Associate) AND City of West Lafayette Flexible Spending Plan (Covered Entity) TABLE OF CONTENTS
More informationM E M O R A N D U M. Definitions
M E M O R A N D U M DATE: November 10, 2011 TO: FROM: RE: Krevolin & Horst, LLC HIPAA Obligations of Business Associates In connection with the launch of your hosted application service focused on practice
More informationHIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations
HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations Health Care Litigation Webinar Series March 22, 2012 Spence Pryor Paula Stannard Jason Popp 1 HIPAA/HITECH
More informationFEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA
APPENDIX PR 12-A FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA LEGAL CITATION California Civil Code Section 1798.82 California Health and Safety (H&S) Code Section 1280.15 42 U.S.C. Section
More informationH. R. 1 144. Subtitle D Privacy
H. R. 1 144 (1) an analysis of the effectiveness of the activities for which the entity receives such assistance, as compared to the goals for such activities; and (2) an analysis of the impact of the
More informationCREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy Amended as of February 12, 2010 on the authority of the HIPAA Privacy Officer for Creative Solutions in Healthcare, Inc. TABLE OF CONTENTS ARTICLE
More informationAVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE
AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE This Notice of Privacy Practices describes the legal obligations of Ave Maria University, Inc. (the plan ) and your legal rights regarding your protected health
More informationData Breach Notification Burden Grows With First State Insurance Commissioner Mandate
Privacy, Data Security & Information Use September 16, 2010 Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate by John L. Nicholson and Meighan E. O'Reardon Effective
More informationBREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS
BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS The following HIPAA Business Associate Terms and Conditions (referred to hereafter as the HIPAA Agreement ) are part of the Brevium Software License
More informationSCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY
SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY 1 School Board Policy 523.5 The School District of Black River Falls ( District ) is committed to compliance with the health information
More informationModel Business Associate Agreement
Model Business Associate Agreement Instructions: The Texas Health Services Authority (THSA) has developed a model BAA for use between providers (Covered Entities) and HIEs (Business Associates). The model
More informationUpdated HIPAA Regulations What Optometrists Need to Know Now. HIPAA Overview
Updated HIPAA Regulations What Optometrists Need to Know Now The U.S. Department of Health & Human Services Office for Civil Rights recently released updated regulations regarding the Health Insurance
More informationWhat Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act
What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act by Lane W. Staines and Cheri D. Green On February 17, 2009, The American Recovery and Reinvestment Act
More informationHITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST. David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com
HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com Presenters David Schoolcraft, Member, Ogden Murphy Wallace, PLLC Taya Briley,
More informationHIPAA Breach Notification Policy
HIPAA Breach Notification Policy Purpose: To ensure compliance with applicable laws and regulations governing the privacy and security of protected health information, and to ensure that appropriate notice
More informationPage 1. NAOP HIPAA and Privacy Risks 3/11/2014. Privacy means being able to have control over how your information is collected, used, or shared;
Page 1 National Organization of Alternative Programs 2014 NOAP Educational Conference HIPAA and Privacy Risks Ira J Rothman, CPHIMS, CIPP/US/IT/E/G Senior Vice President - Privacy Official March 26, 2014
More informationHHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI
January 23, 2013 HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI Executive Summary HHS has issued final regulations that address recent legislative
More informationCMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS
CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS Dear Physician Member: Thank you for contacting the California Medical Association and thank you for your membership. In order to advocate on your behalf,
More informationBusiness Associate Agreement Involving the Access to Protected Health Information
School/Unit: Rowan University School of Osteopathic Medicine Vendor: Business Associate Agreement Involving the Access to Protected Health Information This Business Associate Agreement ( BAA ) is entered
More informationGLENN COUNTY HEALTH AND HUMAN SERVICES AGENCY. HIPAA Policies and Procedures 06/30/2014
GLENN COUNTY HEALTH AND HUMAN SERVICES AGENCY HIPAA Policies and Procedures 06/30/2014 Glenn County Health and Human Services Agency HIPAA Policies and Procedures TABLE OF CONTENTS HIPAA Policy Number
More informationwhat your business needs to do about the new HIPAA rules
what your business needs to do about the new HIPAA rules Whether you are an employer that provides health insurance for your employees, a business in the growing health care industry, or a hospital or
More informationNCHICA HITECH Act Breach Notification Risk Assessment Tool. Prepared by the NCHICA Privacy, Security & Legal Officials Workgroup
NCHICA HITECH Act Breach Notification Risk Assessment Tool Prepared by the NCHICA Privacy, Security & Legal Officials Workgroup NORTH CAROLINA HEALTHCARE INFORMATION AND COMMUNICATIONS ALLIANCE, INC August
More informationSAMPLE BUSINESS ASSOCIATE AGREEMENT
SAMPLE BUSINESS ASSOCIATE AGREEMENT THIS AGREEMENT IS TO BE USED ONLY AS A SAMPLE IN DEVELOPING YOUR OWN BUSINESS ASSOCIATE AGREEMENT. ANYONE USING THIS DOCUMENT AS GUIDANCE SHOULD DO SO ONLY IN CONSULT
More informationThe Basics of HIPAA Privacy and Security and HITECH
The Basics of HIPAA Privacy and Security and HITECH Protecting Patient Privacy Disclaimer The content of this webinar is to introduce the principles associated with HIPAA and HITECH regulations and is
More informationShipman & Goodwin LLP. HIPAA Alert STIMULUS PACKAGE SIGNIFICANTLY EXPANDS HIPAA REQUIREMENTS
Shipman & Goodwin LLP HIPAA Alert March 2009 STIMULUS PACKAGE SIGNIFICANTLY EXPANDS HIPAA REQUIREMENTS The economic stimulus package, officially named the American Recovery and Reinvestment Act of 2009
More informationFORM OF HIPAA BUSINESS ASSOCIATE AGREEMENT
FORM OF HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( Agreement ) is made and entered into to be effective as of, 20 (the Effective Date ), by and between ( Covered Entity ) and
More informationUse & Disclosure of Protected Health Information by Business Associates
Applicability: Policy Title: Policy Number: Use & Disclosure of Protected Health Information by Business Associates PP-12 Superseded Policy(ies) or Entity Policy: N/A Date Established: January 31, 2003
More informationBUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT ( Agreement ) is entered into by and between (the Covered Entity ), and Iowa State Association of Counties (the Business Associate ). RECITALS
More informationIdentity Theft Prevention and Security Breach Notification Policy. Purpose:
Identity Theft Prevention and Security Breach Notification Policy Purpose: Lahey Clinic is committed to protecting the privacy of the Personal Health Information ( PHI ) of our patients and the Personal
More informationREPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES PLEASE REVIEW IT CAREFULLY.
REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION (PHI) ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS
More informationHIPAA Privacy and Security Changes in the American Recovery and Reinvestment Act
International Life Sciences Arbitration Health Industry Alert If you have questions or would like additional information on the material covered in this Alert, please contact the author: Brad M. Rostolsky
More informationHIPAA 101. March 18, 2015 Webinar
HIPAA 101 March 18, 2015 Webinar Agenda Acronyms to Know HIPAA Basics What is HIPAA and to whom does it apply? What is protected by HIPAA? Privacy Rule Security Rule HITECH Basics Breaches and Responses
More informationTerms and Conditions Relating to Protected Health Information ( City PHI Terms ) Revised and Effective as of September 23, 2013
Terms and Conditions Relating to Protected Health Information ( City PHI Terms ) Revised and Effective as of September 23, 2013 The City of Philadelphia is a Covered Entity as defined in the regulations
More informationBusiness Associate Agreement
This Business Associate Agreement Is Related To and a Part of the Following Underlying Agreement: Effective Date of Underlying Agreement: Vendor: Business Associate Agreement This Business Associate Agreement
More informationHIPAA Business Associate Agreement
HIPAA Business Associate Agreement User of any Nemaris Inc. (Nemaris) products or services including but not limited to Surgimap Spine, Surgimap ISSG, Surgimap SRS, Surgimap Office, Surgimap Ortho, Surgimap
More informationOctober 22, 2009. 45 CFR PARTS 160 and 164
October 22, 2009 U.S. Department of Health and Human Services Office for Civil Rights Attention: HITECH Breach Notification Hubert H. Humphrey Building Room 509 F 200 Independence Avenue, SW Washington,
More informationHIPAA BREACH NOTIFICATION REQUIREMENTS. Heman A. Marshall, III July 25, 2014
1 HIPAA BREACH NOTIFICATION REQUIREMENTS Heman A. Marshall, III July 25, 2014 2 SCENARIO FOR VBA SUMMER MEETING The Medical Marijuana Growers Association (MMGA) Health Plan, which is a self-fund plan,
More informationStatement of Policy. Reason for Policy
Table of Contents Statement of Policy 2 Reason for Policy 2 HIPAA Liaison 2 Individuals and Entities Affected by Policy 2 Who Should Know Policy 3 Exclusions 3 Website Address for Policy 3 Definitions
More informationBUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (the BAA ) is made and entered into as of the day of, 20, by and between Delta Dental of California (the Covered Entity ) and (the Business
More informationBy Ross C. D Emanuele, John T. Soshnik, and Kari Bomash, Dorsey & Whitney LLP Minneapolis, MN
Major Changes to HIPAA Security and Privacy Rules Enacted in Economic Stimulus Package By Ross C. D Emanuele, John T. Soshnik, and Kari Bomash, Dorsey & Whitney LLP Minneapolis, MN The HITECH Act is the
More informationName of Other Party: Address of Other Party: Effective Date: Reference Number as applicable:
PLEASE NOTE: THIS DOCUMENT IS SUBMITTED AS A SAMPLE, FOR INFORMATIONAL PURPOSES ONLY TO ABC ORGANIZATION. HIPAA SOLUTIONS LC IS NOT ENGAGED IN THE PRACTICE OF LAW IN ANY STATE, JURISDICTION, OR VENUE OF
More informationMy Docs Online HIPAA Compliance
My Docs Online HIPAA Compliance Updated 10/02/2013 Using My Docs Online in a HIPAA compliant fashion depends on following proper usage guidelines, which can vary based on a particular use, but have several
More informationAm I a Business Associate?
Am I a Business Associate? Now What? JENNIFER L. RATHBURN Quarles & Brady LLP KATEA M. RAVEGA Quarles & Brady LLP agenda» Overview of HIPAA / HITECH» Business Associate ( BA ) Basics» What Do BAs Have
More informationInfinedi HIPAA Business Associate Agreement RECITALS SAMPLE
Infinedi HIPAA Business Associate Agreement This Business Associate Agreement ( Agreement ) is entered into this day of, 20 between ( Company ) and Infinedi, LLC, a Limited Liability Corporation, ( Contractor
More informationHIPAA Omnibus Rule Overview. Presented by: Crystal Stanton MicroMD Marketing Communication Specialist
HIPAA Omnibus Rule Overview Presented by: Crystal Stanton MicroMD Marketing Communication Specialist 1 HIPAA Omnibus Rule - Agenda History of the Omnibus Rule What is the HIPAA Omnibus Rule and its various
More informationNOTICE OF THE NATHAN ADELSON HOSPICE PRIVACY PRACTICES
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION PLEASE REVIEW IT CAREFULLY. DEFINITIONS PROTECTED HEALTH INFORMATION (PHI):
More informationBUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( Agreement ) between Inphonite, LLC ( Business Associate and you, as our Customer ( Covered Entity ) (each individually, a Party, and collectively,
More informationBUSINESS ASSOCIATE AGREEMENT. (Contractor name and address), hereinafter referred to as Business Associate;
BUSINESS ASSOCIATE AGREEMENT (Agreement #) THIS DOCUMENT CONSTITUTES AN AGREEMENT BETWEEN: AND (Contractor name and address), hereinafter referred to as Business Associate; The Department of Behavioral
More informationBUSINESS ASSOCIATE AGREEMENT Tribal Contract
DEPARTMENT OF HEALTH SERVICES Division of Enterprise Services F-00714 (08/2013) STATE OF WISCONSIN BUSINESS ASSOCIATE AGREEMENT Tribal Contract This Business Associate Agreement is made between the Wisconsin
More informationHIPAA Omnibus Rule Practice Impact. Kristen Heffernan MicroMD Director of Prod Mgt and Marketing
HIPAA Omnibus Rule Practice Impact Kristen Heffernan MicroMD Director of Prod Mgt and Marketing 1 HIPAA Omnibus Rule Agenda History of the Rule HIPAA Stats Rule Overview Use of Personal Health Information
More informationHealth Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know
Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know Note: Information provided to NCRA by Melodi Gates, Associate with Patton Boggs, LLC Privacy and data protection
More information12/19/2014. HIPAA More Important Than You Realize. Administrative Simplification Privacy Rule Security Rule
HIPAA More Important Than You Realize J. Ira Bedenbaugh Consulting Shareholder February 20, 2015 This material was used by Elliott Davis Decosimo during an oral presentation; it is not a complete record
More informationHIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( BA Agreement ) is entered into by Medtep Inc., a Delaware corporation ( Business Associate ) and the covered entity ( Covered Entity
More informationDisclaimer: Template Business Associate Agreement (45 C.F.R. 164.308)
HIPAA Business Associate Agreement Sample Notice Disclaimer: Template Business Associate Agreement (45 C.F.R. 164.308) The information provided in this document does not constitute, and is no substitute
More informationHHS announces sweeping changes to the HIPAA Privacy and Security Rules in the final HIPAA Omnibus Rule
JANUARY 23, 2013 HHS announces sweeping changes to the HIPAA Privacy and Security Rules in the final HIPAA Omnibus Rule By Linn Foster Freedman, Kathryn M. Sylvia, Lindsay Maleson, and Brooke A. Lane On
More informationH I P AA B U S I N E S S AS S O C I ATE AGREEMENT
H I P AA B U S I N E S S AS S O C I ATE AGREEMENT This HIPAA BUSINESS ASSOCIATE AGREEMENT (the BAA ) is entered into by and between Opticare of Utah, Inc. ( Covered Entity ), and,( Business Associate ).
More informationHackers, Slackers & Packers: Preventing Data Loss & Dealing with the Inevitable. Data Breaches Are All Too Common
Hackers, Slackers & Packers: Preventing Data Loss & Dealing with the Inevitable Steven J. Fox (sjfox@postschell.com) Peter D. Hardy (phardy@postschell.com) Robert Brandfass (BrandfassR@wvuh.com) (Mr. Brandfass
More informationBUSINESS ASSOCIATE AGREEMENT. Business Associate. Business Associate shall mean.
BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement is made as of the day of, 2010, by and between Methodist Lebonheur Healthcare, on behalf of itself and all of its affiliates ( Covered Entity
More informationHIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement ("BA AGREEMENT") supplements and is made a part of any and all agreements entered into by and between The Regents of the University
More informationBUSINESS ASSOCIATE AGREEMENT HIPAA Protected Health Information
BUSINESS ASSOCIATE AGREEMENT HIPAA Protected Health Information I. PREAMBLE ( Covered Entity ) and ( Business Associate ) (jointly the Parties ) wish to enter into an Agreement to comply with the requirements
More informationHealthcare Practice. Breach Notification Requirements Under HIPAA/HITECH Act and Oregon Consumer Identity Theft Protection Act. Oregon.
Healthcare Practice Breach Notification Requirements Under HIPAA/HITECH Act and Consumer Identity Theft Protection Act August 2013 Anchorage Beijing New York Portland Seattle Washington, D.C. www.gsblaw.com
More informationViolation Become a Privacy Breach? Agenda
How Does a HIPAA Violation Become a Privacy Breach? Karen Voiles, MBA, CHC, CHPC, CHRC Senior Managing Consultant, Compliance Agenda Differentiating between HIPAA violation and reportable breach Best practices
More informationBUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT is made and entered into as of the day of, 2013 ( Effective Date ), by and between [Physician Practice] on behalf of itself and each of its
More informationHIPAA Policy, Protection, and Pitfalls ARTHUR J. GALLAGHER & CO. BUSINESS WITHOUT BARRIERS
HIPAA Policy, Protection, and Pitfalls Overview HIPAA Privacy Basics What s covered by HIPAA privacy rules, and what isn t? Interlude on the Hands-Off Group Health Plan When does this exception apply,
More informationChris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A.
Chris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A., UC Health 7093020v1 Examples from the News Review of HIPAA Breach Regulations
More informationRegulatory Update: HITECH s HHS and FTC Security Breach Notification Requirements
Regulatory Update: HITECH s HHS and FTC Security Breach Notification Requirements August 27, 2009 Boston Brussels Chicago Düsseldorf Houston London Los Angeles Miami Milan Munich New York Orange County
More informationThis form may not be modified without prior approval from the Department of Justice.
This form may not be modified without prior approval from the Department of Justice. Delete this header in execution (signature) version of agreement. HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate
More informationBUSINESS ASSOCIATE AGREEMENT BETWEEN LEWIS & CLARK COLLEGE AND ALLEGIANCE BENEFIT PLAN MANAGEMENT, INC. I. PREAMBLE
BUSINESS ASSOCIATE AGREEMENT BETWEEN LEWIS & CLARK COLLEGE AND ALLEGIANCE BENEFIT PLAN MANAGEMENT, INC. I. PREAMBLE Lewis & Clark College and Allegiance Benefit Plan Management, Inc., (jointly the Parties
More informationCan Your Diocese Afford to Fail a HIPAA Audit?
Can Your Diocese Afford to Fail a HIPAA Audit? PETULA WORKMAN & PHIL BUSHNELL MAY 2016 2016 ARTHUR J. GALLAGHER & CO. BUSINESS WITHOUT BARRIERS Agenda Overview Privacy Security Breach Notification Miscellaneous
More informationBUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT 1. DEFINITIONS: 1.1 Undefined Terms: Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms defined by the Health Insurance Portability
More informationBUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT (this Agreement ), effective as of May 1, 2014 (the Effective Date ), by and between ( Covered Entity ) and Orchard Software Corporation,
More information