Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule"

Transcription

1 HEALTHCARE October 2009 Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule This HIPAA Update provides a detailed description of the new breach notification requirements for HIPAA covered entities and business associates as required by interim final rule issued pursuant to the HITECH Act of The interim final rule (Breach Rule) published by the U.S. Department of Health and Human Services (HHS) on Aug. 24, 2009 became effective Sept. 23, It requires business associates and covered entities to notify individuals, HHS, and in some cases, the media, upon discovery of a breach of unsecured protected health information (PHI). The rules set out a three-part test for: determining whether a breach has occurred, further clarifies the definition of Unsecured PHI and establishes requirements for when a breach must be reported, who must make the report, and how the report must be made. The agency also clarified what role business associates have in reporting breaches of PHI. The new rule also requires covered entities and business associates to develop policies and procedures, train workforce members regarding the new breach provisions, and to implement reasonable systems for discovering breaches of unsecured PHI. Entities can now submit breach reports to HHS online at The HHS rule became effective on Sept. 23, However, the Secretary of HHS has delayed enforcement of the new regulations until Feb. 22, 2010 to give entities time to implement procedures necessary to comply with the new rule. I. The Definition of Breach ANALYSIS OF THE NEW BREACH RULES The Breach Rule expands upon the HITECH Act s definition of the term breach, creating a threepart test for determining whether a breach has occurred. Step 1: Was There a Violation of the Privacy Rule? Under the Breach Rule, a breach is defined as: the acquisition, access, use, or disclosure of protected health information in a manner not permitted [by the HIPAA Privacy Rules] which compromises

2 the security or privacy of the protected health information. This definition clarifies that a use or disclosure of PHI is not considered a breach unless such use or disclosure violates the HIPAA Privacy Rules. For example, a disclosure of PHI that is incident to an otherwise permissible use or disclosure, which occurs despite reasonable safeguards and proper minimum necessary procedures, would not be a violation of the Privacy Rule and, thus would not qualify as a breach. A violation of the HIPAA Security rule does not, per se, constitute a breach. However, if a violation of the Security Rule results in the use or disclosure of PHI that is not allowed under the Privacy Rule, such use or disclosure may fall within the definition of a breach. Step 2: Was There Harm to the Individual? The Breach Rule distinguishes between harmless or harmful disclosures. A disclosure does not qualify as a breach unless it causes some harm to the individual. To qualify as a breach, the harm must pose a significant risk of financial, reputational, or other harm to the individual. Covered entities and business associates will need to perform a risk assessment to determine if there is a significant risk of harm to the individual as a result of the impermissible use or disclosure of PHI. HHS lists several factors to consider in performing the risk assessment: Who made the impermissible use or to whom was the PHI impermissibly disclosed? Did the covered entity take immediate steps to mitigate an impermissible use or disclosure? Was the impermissibly disclosed PHI was returned prior to access for an improper purpose? What type and how much PHI was involved? For example, a covered entity may obtain a written confidentiality agreement with the recipient that the information will be destroyed or not further used or disclosed. According to HHS, if such an agreement eliminates or reduces the risk of harm to the individual to a less than significant risk, the security and privacy of the information has not been compromised, and therefore, no breach has occurred. HHS also indicated that impermissible uses or disclosures of limited data sets that include dates of birth and zip code identifiers may cause a pose a risk of significant harm, while limited data sets that do not contain birth dates or zip codes may pose less of a threat and therefore may not trigger a breach if used or disclosed impermissibly. Step 3: Is there an exception? The Breach Rule contains three exceptions to the definition of breach. The first exception provides that an unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a covered entity or business associate, if done in good faith and within the scope of authority, and which does not result in further use or disclosure in a manner not permitted under the Privacy Rule, is not a breach. Workforce member is defined under the HIPAA regulations to include employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity. Under the second exception any inadvertent disclosure by a person authorized to access the PHI at a covered entity or business associate to another person authorized to access the PHI at the same covered entity or business associate, or organized health care arrangement (OHCA) in which the covered entity participates, and the PHI is not further used or disclosed in a manner not permitted under the Privacy Rule. This exception essentially provides some flexibility to the minimum necessity standard and does not require reporting of uses or disclosures within an entity, business associate, or OHCA. A third exception provides that any disclosure in which a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

3 The three-part test to determine whether a breach has occurred can be summarized as follows: Was there an impermissible use or disclosure of PHI under the HIPAA Privacy Rule? Yes No No Breach Did the impermissible use or disclosure pose a significant risk of financial, reputational, or other harm to the individual? Yes No No Breach Does the incident fall under one of the exceptions? No Yes No Breach Breach Has Occurred II. Unsecured Protected Health Information The HITECH Act only requires notification when there has been a breach of Unsecured PHI, which is defined as PHI that is not secured through the use of a technology or methodology specified by the Secretary. The HITECH Act requires that HHS specify the technologies and methodologies that render PHI unusable, unreadable, or indecipherable to unauthorized individuals. The Breach Rule provides this additional clarification. It defines Unsecured PHI to mean PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in guidance. This reference relates back to the guidance issued by HHS on April 27, 2009 (Technology Guidance), which specified encryption and destruction as the technologies and methodologies for rendering PHI secured ; i.e. unusable, unreadable, or indecipherable to unauthorized individuals. It is important to recognize that HHS s Technology Guidance on secured/unsecured PHI does not modify a covered entity s requirements under the HIPAA Security Rule. Currently, the Security Rule does not require encryption. Therefore, if a covered entity chooses to encrypt PHI in accordance with the Technology Guidance as a way to comply with the Security Rule, and the covered entity subsequently discovers a breach of that encrypted information, the covered entity will not be required to provide

4 notification, even if there is a breach, because the information is not considered unsecured PHI. On the other hand, if a covered entity uses a method other than encryption, or uses an encryption algorithm that is not specified in the Technology Guidance, then although that covered entity may be in compliance with the Security Rule, if there is a breach of the PHI, the covered entity would have to provide breach notification to the affected individuals. HHS also clarifies several terms used in its Technology Guidance. The term data in motion includes data that is moving through a network, including wireless transmission, whether by or structured electronic interchange, while data at rest includes data that resides in databases, file systems, flash drives, memory, and any other structured storage method. Data in use includes data in the process of being created, retrieved, updated, or deleted, and data disposed includes discarded paper records or recycled electronic media. HHS also clarified that covered entities and business associates should keep encryption keys on a separate device from the data that they encrypt or decrypt. HHS specifically rejected redaction as an accepted alternative method to secure paper-based PHI. As a result, if paper documents are lost or stolen, are not redacted appropriately, and include PHI, the covered entity will likely be required to follow the notification requirements. III. Notification Requirements Notification to Individuals The HITECH Act requires a covered entity to notify each individual when the covered entity discovers or reasonably believes there has been a breach of unsecured PHI. The Breach Rule clarifies that a covered entity is deemed to have knowledge of a breach if such breach is known, or if by exercising reasonable diligence, the breach would have been known to any person who is a workforce member or agent of the covered entity, other than the person committing the breach. The federal common law of agency controls in determining who is an agent of the covered entity. HHS explained that reasonable diligence means the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances. Therefore, HHS expects covered entities and business associates to implement reasonable systems for discovery of breaches. Because knowledge of a workforce member or agents such as a business associate will be imputed to the covered entity, covered entities should adequately train their workforce and agents to timely report impermissible uses or disclosures of PHI. Notice is to be provided to the individual without unreasonable delay, and in no case later than 60 calendar days following discovery of the breach. The time for notification must be calculated beginning on the date that the breach is first discovered, not on the date that that a covered entity has completed an investigation of a possible breach. The Breach Rule mirrors the HITECH Act with respect to the contents of the notice required: A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; A description of the types of unsecured PHI involved in the breach; Any steps individuals should take to protect themselves from potential harm resulting from the breach; A brief description of the covered entity s actions to investigate the breach, mitigate harm to individuals, and protect against any further breaches; and

5 Contact procedures for individuals to ask questions or learn additional information, which must include a toll-free telephone number, an address, web site, or postal address. The HHS comments indicate that in providing notice, covered entities may be obligated to comply with other laws, such as Title VI of the Civil Rights Act of 1964 and the Americans with Disabilities Act, which could include providing the notice in languages other than English or alternate formats such as large print or Braille. The HITECH Act includes provisions for actual and substitute notice to the individual. The Breach Rule adopted this statutory language and requires a covered entity to provide notice in written form by firstclass mail to the last known address of the individual or by electronic mail, if the individual agrees to receive electronic notice, and such agreement has not been withdrawn. HHS also clarified that if the affected individual is a minor or otherwise lacks legal capacity, the covered entity may send notice to the individual s personal representative. If the individual is deceased, notice must be sent to next of kin only if the covered entity knows the individual is deceased and has the address of the decedent s next of kin or personal representative. The covered entity is not required to obtain the deceased s contact information if it does not have the information at the time of the breach. If the covered entity does not have sufficient contact information for some or all individuals, substitute notice must be provided. If there are fewer than ten individuals involved, the covered entity may provide substitute notice through an alternative form of written notice, such as electronic mail (even if the individual has not specifically agreed to electronic notice) or by telephone or other means. If the covered entity lacks any current contact information for the individuals, posting such notice on the internet may be appropriate, as long as the posting is done in a manner that is reasonably calculated to reach the individuals. If a covered entity has insufficient or out of date information for ten or more individuals, then substitute notice must be provided through a conspicuous positing on the home page of its website or conspicuous notice in major print or broadcast media, for a period of 90 days. The substitute notice must be provided in a manner that is reasonably calculated to reach the affected individuals. HHS interprets the term home page to include the home page for visitors to the covered entity s website and the landing page or login page for existing account holders, or a hyperlink on the entity s home page that links to the substitute notice. In addition, the substitute notice provision requires the covered entity to have a toll-free phone number for 90 days so individuals can obtain more information about the breach. Notification to the Media If a breach of unsecured PHI involves more than 500 residents of a state or jurisdiction, the HITECH Act requires a covered entity to provide notice to a prominent media outlet in addition to providing the individual notice described above. HHS expects that most covered entities will provide notice to the media under this section in the form of a press release. However, a press release will only satisfy the substitute individual notice requirement if the press release is actually run by the media outlet. In the Breach Rule, HHS clarified that the term jurisdiction is a geographic area smaller than a state, such as a county or town. HHS declined to define prominent media outlet and stated that what constitutes a prominent media outlet will differ depending on the state or jurisdiction affected. For example, if a breach affected individuals across an entire state, the appropriate media may be a major, general interest newspaper with daily circulation throughout the state. On the other hand, if the breach involved only individuals in the same city, the appropriate media may be a general interest newspaper with daily circulation throughout the city. Notification to HHS

6 The HITECH Act requires a covered entity to notify HHS immediately if there is a breach of unsecured PHI involving 500 or more individuals. HHS interprets the term immediately to mean that a covered entity should send notice to HHS concurrently with the notification sent to an individual (without unreasonable delay but in no case later than 60 calendar days following discovery of a breach). The HHS notification requirement differs from the media notification requirement. A covered entity must notify HHS of breaches involving 500 or more individuals, even if the 500 individuals were not located in the same state or jurisdiction. For example, if a covered entity discovers a breach involving 300 Maryland residents and 300 District of Columbia residents, notification must be provided to the individuals and concurrently to HHS, but not to the media. The HITECH Act requires covered entities to maintain a log of all breaches involving less than 500 individuals, and to submit the log to HHS on an annual basis. HHS has specified that the annual report must be submitted to HHS no later than 60 days after the end of each calendar year. In addition, pursuant to the HIPAA Privacy Rule, covered entities must maintain the log or other documentation for six years. The Breach Rule also provides that the notification to HHS must be submitted in a manner to be specified on the HHS web site. HHS has also noted that for calendar year 2009, the covered entity is only required to submit information to HHS for breaches that occur after Sept. 23, 2009, the effective date of the regulation. In October 2009 HHS established a new Web site that permits online reporting of breaches to HHS. Breaches may be reported at IV. Business Associates Under the HITECH Act, when a business associate discovers a breach of Unsecured PHI, the business associate must notify the covered entity so the covered entity can notify affected individuals. The Breach Rule clarifies that if a business associate maintains PHI for multiple covered entities, the business associate only needs to notify a covered entity regarding the relevant breaches. However, if the business associate cannot determine which covered entities were included in the breach, the business associate may need to notify all potential covered entities. The Breach Rule clarifies that a breach shall be treated as discovered by a business associate on the first day on which the breach is known to the business associate, or would have been known to the business associate by exercising reasonable diligence. Like covered entities, business associates are assumed to have the knowledge of their employees, officers, or other agents. Thus, business associates, like covered entities, should establish policies and procedures and train their personnel to report impermissible uses and disclosures. Generally, a business associate must provide notice to the covered entity without unreasonable delay, and in no case later than 60 days following discovery of a breach. If a business associate is acting as an agent of a covered entity, the business associate s discovery of the breach will be imputed to the covered entity. Accordingly, the covered entity must provide notification based on the time the business associate discovers the breach, not from the time the business associate notifies the covered entity. On the other hand, if the business associate is an independent contractor of the covered entity, the covered entity must provide notice based on the time that the business associate notifies the covered entity of the breach. In the Breach Rule, HHS recognized that business associates may not be able to provide the identity of each individual whose unsecured PHI was breached. Therefore, the rule indicates that such identification must be provided to the covered entity to the extent possible. The Breach Rule also requires the business associate to provide the covered entity with any other available information that the covered entity is required

7 to include in the notification to the individual. HHS emphasized that a business associate should not delay the initial notification to the covered entity in order to collect information needed for notification to the individual. HHS specifically noted in its comments that the Breach Rule is not intended to interfere with the relationships between business associates and covered entities, and that both entities will continue to have the flexibility to determine their respective obligations. HHS encouraged the parties to consider which entity is in the best position to provide notice to the individual, depending on the circumstances of the relationship. V. Administrative Requirements and Burden of Proof The Breach Rule requires covered entities to comply with the administrative requirements of the Privacy Rule with respect to the breach notification requirements. This means that covered entities and business associates must develop and document policies and procedures, train workforce members, and impose sanctions for failure to comply with the breach notification procedures. In addition, when a covered entity or business associate knows of an impermissible use or disclosure of PHI, it should maintain documentation that all required notifications were made, or, alternatively, that it conducted the three-part test and determined there was not a breach. Preemption HIPAA preempts contrary state law, with certain exceptions. HHS indicates in the interim final rule that such exceptions do not apply to the breach notification regulations. Therefore, contrary state law will be preempted by the breach notification regulations. For more information, contact the following attorneys in Barnes & Thornburg LLP s Healthcare Department: Stacy Cook, Indianapolis ( ); Ellen Layton, Chicago ( ); or Kate O Brien, Chicago ( ). Visit for additional information on the firm s Healthcare Department and legal services Barnes & Thornburg LLP. All Rights Reserved. This page, and all information on it, is proprietary and the property of Barnes & Thornburg LLP. It may not be reproduced, in any form, without the express written consent of Barnes & Thornburg. This Barnes & Thornburg LLP publication should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own lawyer on any specific legal questions you may have concerning your situation. Please send address changes or requests to opt out of these alerts to.

BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION

BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION Summary November 2009 On August 24, 2009, the Department of Health and Human Services (HHS) published an interim final rule (the Rule ) that

More information

HIPAA Privacy Breach Notification Regulations

HIPAA Privacy Breach Notification Regulations Technical Bulletin Issue 8 2009 HIPAA Privacy Breach Notification Regulations On August 24, 2009 Health and Human Services (HHS) issued interim final regulations implementing the HIPAA Privacy Breach Notification

More information

POLICY AND PROCEDURE MANUAL

POLICY AND PROCEDURE MANUAL Pennington Biomedical POLICY NO. 412.22 POLICY AND PROCEDURE MANUAL Origin Date: 02/04/2013 Impacts: ALL PERSONNEL Effective Date: 03/17/2014 Subject: HIPAA BREACH NOTIFICATION Last Revised: Source: LEGAL

More information

HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES

HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES SALISH BHO HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES Policy Name: HIPAA BREACH NOTIFICATION REQUIREMENTS Policy Number: 5.16 Reference: 45 CFR Parts 164 Effective Date: 03/2016 Revision Date(s):

More information

COMPLIANCE ALERT 10-12

COMPLIANCE ALERT 10-12 HAWAII HEALTH SYSTEMS C O R P O R A T I O N "Touching Lives Every Day COMPLIANCE ALERT 10-12 HIPAA Expansion under the American Recovery and Reinvestment Act of 2009 The American Recovery and Reinvestment

More information

UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14

UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14 UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14 RULES Issued August 19, 2009 Requires Covered Entities to notify individuals of a breach as well as HHS without reasonable delay or within

More information

Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455. Notification of Security Breach Policy

Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455. Notification of Security Breach Policy Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455 Notification of Security Breach Policy Purpose: This policy has been adopted for the purpose of complying with the Health

More information

Breach Notification Policy

Breach Notification Policy 1. Breach Notification Team. Breach Notification Policy Ferris State University ( Ferris State ), a hybrid entity with health care components, has established a Breach Notification Team, which consists

More information

STANDARD ADMINISTRATIVE PROCEDURE

STANDARD ADMINISTRATIVE PROCEDURE STANDARD ADMINISTRATIVE PROCEDURE 16.99.99.M0.26 Investigation and Response to Breach of Unsecured Protected Health Information (HITECH) Approved October 27, 2014 Next scheduled review: October 27, 2019

More information

This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in

This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in the HIPAA Omnibus Rule of 2013. As part of the American

More information

CHART YOUR HIPAA COURSE...

CHART YOUR HIPAA COURSE... CHART YOUR HIPAA COURSE... HHS ISSUES SECURITY BREACH NOTIFICATION RULES PUBLISHED IN FEDERAL REGISTER 8/24/09 EFFECTIVE 9/23/09 The Department of Health and Human Services ( HHS ) has issued interim final

More information

Everett School Employee Benefit Trust. Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law

Everett School Employee Benefit Trust. Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law Everett School Employee Benefit Trust Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law Introduction The Everett School Employee Benefit Trust ( Trust ) adopts this policy

More information

New HIPAA Breach Notification Rule: Know Your Responsibilities. Loudoun Medical Group Spring 2010

New HIPAA Breach Notification Rule: Know Your Responsibilities. Loudoun Medical Group Spring 2010 New HIPAA Breach Notification Rule: Know Your Responsibilities Loudoun Medical Group Spring 2010 Health Information Technology for Economic and Clinical Health Act (HITECH) As part of the Recovery Act,

More information

Community First Health Plans Breach Notification for Unsecured PHI

Community First Health Plans Breach Notification for Unsecured PHI Community First Health Plans Breach Notification for Unsecured PHI The presentation is for informational purposes only. It is the responsibility of the Business Associate to ensure awareness and compliance

More information

ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016

ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016 Page 1 of 9 CITY OF CHESAPEAKE, VIRGINIA NUMBER: 2.62 ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016 SUPERCEDES: N/A SUBJECT: HUMAN RESOURCES DEPARTMENT CITY OF CHESAPEAKE EMPLOYEE/RETIREE GROUP HEALTH

More information

Checklist for HITECH Breach Readiness

Checklist for HITECH Breach Readiness Checklist for HITECH Breach Readiness Checklist for HITECH Breach Readiness Figure 1 describes a checklist that may be used to assess for breach preparedness for the organization. It is based on published

More information

The ReHabilitation Center. 1439 Buffalo Street. Olean. NY. 14760

The ReHabilitation Center. 1439 Buffalo Street. Olean. NY. 14760 Procedure Name: HITECH Breach Notification The ReHabilitation Center 1439 Buffalo Street. Olean. NY. 14760 Purpose To amend The ReHabilitation Center s HIPAA Policy and Procedure to include mandatory breach

More information

Guidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES

Guidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES DEPARTMENT OF HEALTH AND HUMAN SERVICES 45 CFR PARTS 160 and 164 Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable

More information

HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST. David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com

HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST. David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com Presenters David Schoolcraft, Member, Ogden Murphy Wallace, PLLC Taya Briley,

More information

HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013

HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013 HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013 Orchard Creek Health Care is required by law to maintain the privacy of protected health information (PHI) of our residents. If you feel

More information

IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240

IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240 IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240 POLICY INFORMATION Major Functional Area (MFA): MFA X - Office of General Counsel & Compliance

More information

Information Privacy and Security Program. Title: EC.PS.01.02

Information Privacy and Security Program. Title: EC.PS.01.02 Page: 1 of 9 I. PURPOSE: The purpose of this standard is to ensure that affected individuals, the media, and the Secretary of Health and Human Services (HHS) are appropriately notified of any Breach of

More information

Data Breach, Electronic Health Records and Healthcare Reform

Data Breach, Electronic Health Records and Healthcare Reform Data Breach, Electronic Health Records and Healthcare Reform (This presentation is for informational purposes only and it is not intended, and should not be relied upon, as legal advice.) Overview of HIPAA

More information

NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA. March 2010

NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA. March 2010 NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA March 2010 Prepared By: Marisa Guevara and Marcie H. Zakheim Feldesman Tucker Leifer Fidell, LLP 2001

More information

HIPAA BREACH RESPONSE POLICY

HIPAA BREACH RESPONSE POLICY http://dhmh.maryland.gov/sitepages/op02.aspx (OIG) DHMH POLICY 01.03.07 Effective Date: July 22, 2014 I. EXECUTIVE SUMMARY The Department of Health and Mental Hygiene (DHMH) is committed to protecting

More information

H. R. 1 144. Subtitle D Privacy

H. R. 1 144. Subtitle D Privacy H. R. 1 144 (1) an analysis of the effectiveness of the activities for which the entity receives such assistance, as compared to the goals for such activities; and (2) an analysis of the impact of the

More information

Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule

Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule Patricia D. King, Esq. Associate General Counsel Swedish Covenant Hospital Chicago, IL I. Business Associates under

More information

FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA

FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA APPENDIX PR 12-A FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA LEGAL CITATION California Civil Code Section 1798.82 California Health and Safety (H&S) Code Section 1280.15 42 U.S.C. Section

More information

M E M O R A N D U M. Definitions

M E M O R A N D U M. Definitions M E M O R A N D U M DATE: November 10, 2011 TO: FROM: RE: Krevolin & Horst, LLC HIPAA Obligations of Business Associates In connection with the launch of your hosted application service focused on practice

More information

Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration

Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration Name of Policy: Policy Number: Department: Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration Approving Officer: Interim

More information

Regulatory Update: HITECH s HHS and FTC Security Breach Notification Requirements

Regulatory Update: HITECH s HHS and FTC Security Breach Notification Requirements Regulatory Update: HITECH s HHS and FTC Security Breach Notification Requirements August 27, 2009 Boston Brussels Chicago Düsseldorf Houston London Los Angeles Miami Milan Munich New York Orange County

More information

What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act

What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act by Lane W. Staines and Cheri D. Green On February 17, 2009, The American Recovery and Reinvestment Act

More information

HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary

HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary The Health Information Technology for Economic and Clinical Health Act (the HITECH Act), which became law in February of this

More information

Identity Theft Prevention and Security Breach Notification Policy. Purpose:

Identity Theft Prevention and Security Breach Notification Policy. Purpose: Identity Theft Prevention and Security Breach Notification Policy Purpose: Lahey Clinic is committed to protecting the privacy of the Personal Health Information ( PHI ) of our patients and the Personal

More information

BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS

BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS The following HIPAA Business Associate Terms and Conditions (referred to hereafter as the HIPAA Agreement ) are part of the Brevium Software License

More information

HIPAA and the HITECH Act Privacy and Security of Health Information in 2009

HIPAA and the HITECH Act Privacy and Security of Health Information in 2009 HIPAA and the HITECH Act Privacy and Security of Health Information in 2009 What is HIPAA? Health Insurance Portability & Accountability Act of 1996 Effective April 13, 2003 Federal Law HIPAA Purpose:

More information

HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI

HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI January 23, 2013 HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI Executive Summary HHS has issued final regulations that address recent legislative

More information

Updated HIPAA Regulations What Optometrists Need to Know Now. HIPAA Overview

Updated HIPAA Regulations What Optometrists Need to Know Now. HIPAA Overview Updated HIPAA Regulations What Optometrists Need to Know Now The U.S. Department of Health & Human Services Office for Civil Rights recently released updated regulations regarding the Health Insurance

More information

HIPAA Update Focus on Breach Prevention

HIPAA Update Focus on Breach Prevention HIPAA Update Focus on Breach Prevention Objectives By the end of this program, participants should be able to: Identify top reasons why breaches occur Review the breach definition and notification process

More information

CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS

CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS Dear Physician Member: Thank you for contacting the California Medical Association and thank you for your membership. In order to advocate on your behalf,

More information

AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE

AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE This Notice of Privacy Practices describes the legal obligations of Ave Maria University, Inc. (the plan ) and your legal rights regarding your protected health

More information

New HIPAA Rules and EHRs: ARRA & Breach Notification

New HIPAA Rules and EHRs: ARRA & Breach Notification New HIPAA Rules and EHRs: ARRA & Breach Notification Jim Sheldon-Dean Director of Compliance Services Lewis Creek Systems, LLC www.lewiscreeksystems.com and Raj Goel Chief Technology Officer Brainlink

More information

NOTICE OF THE NATHAN ADELSON HOSPICE PRIVACY PRACTICES

NOTICE OF THE NATHAN ADELSON HOSPICE PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION PLEASE REVIEW IT CAREFULLY. DEFINITIONS PROTECTED HEALTH INFORMATION (PHI):

More information

SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY

SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY 1 School Board Policy 523.5 The School District of Black River Falls ( District ) is committed to compliance with the health information

More information

REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES PLEASE REVIEW IT CAREFULLY.

REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES PLEASE REVIEW IT CAREFULLY. REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION (PHI) ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS

More information

HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations

HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations Health Care Litigation Webinar Series March 22, 2012 Spence Pryor Paula Stannard Jason Popp 1 HIPAA/HITECH

More information

Limited Data Set Data Use Agreement

Limited Data Set Data Use Agreement Limited Data Set Data Use Agreement This Agreement is made and entered into by and between (hereinafter Applicant ) and the State of Florida Agency for Health Care Administration, Florida Center for Health

More information

Violation Become a Privacy Breach? Agenda

Violation Become a Privacy Breach? Agenda How Does a HIPAA Violation Become a Privacy Breach? Karen Voiles, MBA, CHC, CHPC, CHRC Senior Managing Consultant, Compliance Agenda Differentiating between HIPAA violation and reportable breach Best practices

More information

HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN. Stewart C. Miller & Co., Inc. (Business Associate) AND

HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN. Stewart C. Miller & Co., Inc. (Business Associate) AND HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN Stewart C. Miller & Co., Inc. (Business Associate) AND City of West Lafayette Flexible Spending Plan (Covered Entity) TABLE OF CONTENTS

More information

Chris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A.

Chris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A. Chris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A., UC Health 7093020v1 Examples from the News Review of HIPAA Breach Regulations

More information

Model Business Associate Agreement

Model Business Associate Agreement Model Business Associate Agreement Instructions: The Texas Health Services Authority (THSA) has developed a model BAA for use between providers (Covered Entities) and HIEs (Business Associates). The model

More information

12/19/2014. HIPAA More Important Than You Realize. Administrative Simplification Privacy Rule Security Rule

12/19/2014. HIPAA More Important Than You Realize. Administrative Simplification Privacy Rule Security Rule HIPAA More Important Than You Realize J. Ira Bedenbaugh Consulting Shareholder February 20, 2015 This material was used by Elliott Davis Decosimo during an oral presentation; it is not a complete record

More information

BUSINESS ASSOCIATE AGREEMENT. Business Associate. Business Associate shall mean.

BUSINESS ASSOCIATE AGREEMENT. Business Associate. Business Associate shall mean. BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement is made as of the day of, 2010, by and between Methodist Lebonheur Healthcare, on behalf of itself and all of its affiliates ( Covered Entity

More information

SUMMARY OF CHANGES HIPAA AND OHIO PRIVACY LAWS

SUMMARY OF CHANGES HIPAA AND OHIO PRIVACY LAWS Franklin J. Hickman Janet L. Lowder David A. Myers Elena A. Lidrbauch Judith C. Saltzman Mary B. McKee Lisa Montoni Garvin Andrea Aycinena Penton Building 1300 East Ninth Street Suite 1020 Cleveland, OH

More information

NCHICA HITECH Act Breach Notification Risk Assessment Tool. Prepared by the NCHICA Privacy, Security & Legal Officials Workgroup

NCHICA HITECH Act Breach Notification Risk Assessment Tool. Prepared by the NCHICA Privacy, Security & Legal Officials Workgroup NCHICA HITECH Act Breach Notification Risk Assessment Tool Prepared by the NCHICA Privacy, Security & Legal Officials Workgroup NORTH CAROLINA HEALTHCARE INFORMATION AND COMMUNICATIONS ALLIANCE, INC August

More information

Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate

Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate Privacy, Data Security & Information Use September 16, 2010 Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate by John L. Nicholson and Meighan E. O'Reardon Effective

More information

SAMPLE BUSINESS ASSOCIATE AGREEMENT

SAMPLE BUSINESS ASSOCIATE AGREEMENT SAMPLE BUSINESS ASSOCIATE AGREEMENT THIS AGREEMENT IS TO BE USED ONLY AS A SAMPLE IN DEVELOPING YOUR OWN BUSINESS ASSOCIATE AGREEMENT. ANYONE USING THIS DOCUMENT AS GUIDANCE SHOULD DO SO ONLY IN CONSULT

More information

CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy

CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy Amended as of February 12, 2010 on the authority of the HIPAA Privacy Officer for Creative Solutions in Healthcare, Inc. TABLE OF CONTENTS ARTICLE

More information

Business Associate Agreement

Business Associate Agreement Business Associate Agreement This Agreement is entered into as of ("Effective Date"), between ( Covered Entity ), and ( Business Associate ). RECITALS WHEREAS, Business Associate provides services on behalf

More information

Long-Expected Omnibus HIPAA Rule Implements Significant Privacy and Security Regulations for Entities and Business Associates

Long-Expected Omnibus HIPAA Rule Implements Significant Privacy and Security Regulations for Entities and Business Associates Legal Update February 11, 2013 Long-Expected Omnibus HIPAA Rule Implements Significant Privacy and Security Regulations for Entities and Business Associates On January 17, 2013, the Department of Health

More information

what your business needs to do about the new HIPAA rules

what your business needs to do about the new HIPAA rules what your business needs to do about the new HIPAA rules Whether you are an employer that provides health insurance for your employees, a business in the growing health care industry, or a hospital or

More information

HHS announces sweeping changes to the HIPAA Privacy and Security Rules in the final HIPAA Omnibus Rule

HHS announces sweeping changes to the HIPAA Privacy and Security Rules in the final HIPAA Omnibus Rule JANUARY 23, 2013 HHS announces sweeping changes to the HIPAA Privacy and Security Rules in the final HIPAA Omnibus Rule By Linn Foster Freedman, Kathryn M. Sylvia, Lindsay Maleson, and Brooke A. Lane On

More information

Disclaimer: Template Business Associate Agreement (45 C.F.R. 164.308)

Disclaimer: Template Business Associate Agreement (45 C.F.R. 164.308) HIPAA Business Associate Agreement Sample Notice Disclaimer: Template Business Associate Agreement (45 C.F.R. 164.308) The information provided in this document does not constitute, and is no substitute

More information

My Docs Online HIPAA Compliance

My Docs Online HIPAA Compliance My Docs Online HIPAA Compliance Updated 10/02/2013 Using My Docs Online in a HIPAA compliant fashion depends on following proper usage guidelines, which can vary based on a particular use, but have several

More information

HIPAA Omnibus Rule Overview. Presented by: Crystal Stanton MicroMD Marketing Communication Specialist

HIPAA Omnibus Rule Overview. Presented by: Crystal Stanton MicroMD Marketing Communication Specialist HIPAA Omnibus Rule Overview Presented by: Crystal Stanton MicroMD Marketing Communication Specialist 1 HIPAA Omnibus Rule - Agenda History of the Omnibus Rule What is the HIPAA Omnibus Rule and its various

More information

GLENN COUNTY HEALTH AND HUMAN SERVICES AGENCY. HIPAA Policies and Procedures 06/30/2014

GLENN COUNTY HEALTH AND HUMAN SERVICES AGENCY. HIPAA Policies and Procedures 06/30/2014 GLENN COUNTY HEALTH AND HUMAN SERVICES AGENCY HIPAA Policies and Procedures 06/30/2014 Glenn County Health and Human Services Agency HIPAA Policies and Procedures TABLE OF CONTENTS HIPAA Policy Number

More information

Business Associate Agreement Involving the Access to Protected Health Information

Business Associate Agreement Involving the Access to Protected Health Information School/Unit: Rowan University School of Osteopathic Medicine Vendor: Business Associate Agreement Involving the Access to Protected Health Information This Business Associate Agreement ( BAA ) is entered

More information

HIPAA BUSINESS ASSOCIATE AGREEMENT

HIPAA BUSINESS ASSOCIATE AGREEMENT HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement ("BA AGREEMENT") supplements and is made a part of any and all agreements entered into by and between The Regents of the University

More information

October 22, 2009. 45 CFR PARTS 160 and 164

October 22, 2009. 45 CFR PARTS 160 and 164 October 22, 2009 U.S. Department of Health and Human Services Office for Civil Rights Attention: HITECH Breach Notification Hubert H. Humphrey Building Room 509 F 200 Independence Avenue, SW Washington,

More information

Breach Notification Decision Process 1/1/2014

Breach Notification Decision Process 1/1/2014 WEDI Strategic National Implementation Process (SNIP) Privacy and Security Workgroup Breach Risk Assessment Issue Brief Breach Notification Decision Process 1/1/2014 Workgroup for Electronic Data Interchange

More information

By Ross C. D Emanuele, John T. Soshnik, and Kari Bomash, Dorsey & Whitney LLP Minneapolis, MN

By Ross C. D Emanuele, John T. Soshnik, and Kari Bomash, Dorsey & Whitney LLP Minneapolis, MN Major Changes to HIPAA Security and Privacy Rules Enacted in Economic Stimulus Package By Ross C. D Emanuele, John T. Soshnik, and Kari Bomash, Dorsey & Whitney LLP Minneapolis, MN The HITECH Act is the

More information

Healthcare Practice. Breach Notification Requirements Under HIPAA/HITECH Act and Oregon Consumer Identity Theft Protection Act. Oregon.

Healthcare Practice. Breach Notification Requirements Under HIPAA/HITECH Act and Oregon Consumer Identity Theft Protection Act. Oregon. Healthcare Practice Breach Notification Requirements Under HIPAA/HITECH Act and Consumer Identity Theft Protection Act August 2013 Anchorage Beijing New York Portland Seattle Washington, D.C. www.gsblaw.com

More information

Am I a Business Associate?

Am I a Business Associate? Am I a Business Associate? Now What? JENNIFER L. RATHBURN Quarles & Brady LLP KATEA M. RAVEGA Quarles & Brady LLP agenda» Overview of HIPAA / HITECH» Business Associate ( BA ) Basics» What Do BAs Have

More information

INFORMATION SECURITY & HIPAA COMPLIANCE MPCA

INFORMATION SECURITY & HIPAA COMPLIANCE MPCA INFORMATION SECURITY & HIPAA COMPLIANCE MPCA Annual Conference August 5, 201 Agenda 1 HIPAA 2 The New Healthcare Paradigm Internal Compliance 4 Conclusion 2 1 HIPAA 1 Earning Their Trust 4 HIPAA 5 Health

More information

Healthcare Practice. HIPAA/HITECH Act vs. Oregon Consumer Identity Theft Protection Act. February 2010

Healthcare Practice. HIPAA/HITECH Act vs. Oregon Consumer Identity Theft Protection Act. February 2010 Healthcare Practice HIPAA/HITECH Act vs. Oregon Consumer Identity Theft Protection Act February 2010 HIPAA/HITECH Background Healthcare Practice Stephen Rose srose@gsblaw.com 206.464.3939 Ext 1375 Larry

More information

HIPAA for Business Associates

HIPAA for Business Associates HIPAA for Business Associates February 11, 2015 Teresa D. Locke This presentation is similar to any other legal education materials designed to provide general information on pertinent legal topics. The

More information

SaaS. Business Associate Agreement

SaaS. Business Associate Agreement SaaS Business Associate Agreement This Business Associate Agreement ( BA Agreement ) becomes effective pursuant to the terms of Section 5 of the End User Service Agreement ( EUSA ) between Customer ( Covered

More information

HIPAA Omnibus Rule Practice Impact. Kristen Heffernan MicroMD Director of Prod Mgt and Marketing

HIPAA Omnibus Rule Practice Impact. Kristen Heffernan MicroMD Director of Prod Mgt and Marketing HIPAA Omnibus Rule Practice Impact Kristen Heffernan MicroMD Director of Prod Mgt and Marketing 1 HIPAA Omnibus Rule Agenda History of the Rule HIPAA Stats Rule Overview Use of Personal Health Information

More information

HIPAA 101. March 18, 2015 Webinar

HIPAA 101. March 18, 2015 Webinar HIPAA 101 March 18, 2015 Webinar Agenda Acronyms to Know HIPAA Basics What is HIPAA and to whom does it apply? What is protected by HIPAA? Privacy Rule Security Rule HITECH Basics Breaches and Responses

More information

Appendix : Business Associate Agreement

Appendix : Business Associate Agreement I. Authority: Pursuant to 45 C.F.R. 164.502(e), the Indian Health Service (IHS), as a covered entity, is required to enter into an agreement with a business associate, as defined by 45 C.F.R. 160.103,

More information

Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com

Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. hhughes@uslegalsupport.com www.uslegalsupport.com HIPAA Privacy Rule Sets standards for confidentiality and privacy of individually

More information

FACT SHEET: Ransomware and HIPAA

FACT SHEET: Ransomware and HIPAA FACT SHEET: Ransomware and HIPAA A recent U.S. Government interagency report indicates that, on average, there have been 4,000 daily ransomware attacks since early 2016 (a 300% increase over the 1,000

More information

Healthcare Practice. HIPAA/HITECH Act vs. the Washington Data Breach Notification Act. November 2009

Healthcare Practice. HIPAA/HITECH Act vs. the Washington Data Breach Notification Act. November 2009 Healthcare Practice HIPAA/HITECH Act vs. the Washington Data Breach Notification Act November 2009 HIPAA/HITECH Background Healthcare Practice Stephen Rose srose@gsblaw.com 206.464.3939 Ext 1375 Larry

More information

Name of Other Party: Address of Other Party: Effective Date: Reference Number as applicable:

Name of Other Party: Address of Other Party: Effective Date: Reference Number as applicable: PLEASE NOTE: THIS DOCUMENT IS SUBMITTED AS A SAMPLE, FOR INFORMATIONAL PURPOSES ONLY TO ABC ORGANIZATION. HIPAA SOLUTIONS LC IS NOT ENGAGED IN THE PRACTICE OF LAW IN ANY STATE, JURISDICTION, OR VENUE OF

More information

Use & Disclosure of Protected Health Information by Business Associates

Use & Disclosure of Protected Health Information by Business Associates Applicability: Policy Title: Policy Number: Use & Disclosure of Protected Health Information by Business Associates PP-12 Superseded Policy(ies) or Entity Policy: N/A Date Established: January 31, 2003

More information

HIPAA In The Workplace. What Every Employee Should Know and Remember

HIPAA In The Workplace. What Every Employee Should Know and Remember HIPAA In The Workplace What Every Employee Should Know and Remember What is HIPAA? The Health Insurance Portability and Accountability Act of 1996 Portable Accountable Rules for Privacy Rules for Security

More information

HIPAA-P06 Use and Disclosure of De-identified Data and Limited Data Sets

HIPAA-P06 Use and Disclosure of De-identified Data and Limited Data Sets HIPAA-P06 Use and Disclosure of De-identified Data and Limited Data Sets FULL POLICY CONTENTS Scope Policy Statement Reason for Policy Definitions ADDITIONAL DETAILS Web Address Forms Related Information

More information

HSHS BUSINESS ASSOCIATE AGREEMENT BACKGROUND AND RECITALS

HSHS BUSINESS ASSOCIATE AGREEMENT BACKGROUND AND RECITALS HSHS BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement, ( Agreement ) is entered into on the date(s) set forth below by and between Hospital Sisters Health System on its own behalf and

More information

Can Your Diocese Afford to Fail a HIPAA Audit?

Can Your Diocese Afford to Fail a HIPAA Audit? Can Your Diocese Afford to Fail a HIPAA Audit? PETULA WORKMAN & PHIL BUSHNELL MAY 2016 2016 ARTHUR J. GALLAGHER & CO. BUSINESS WITHOUT BARRIERS Agenda Overview Privacy Security Breach Notification Miscellaneous

More information

Infinedi HIPAA Business Associate Agreement RECITALS SAMPLE

Infinedi HIPAA Business Associate Agreement RECITALS SAMPLE Infinedi HIPAA Business Associate Agreement This Business Associate Agreement ( Agreement ) is entered into this day of, 20 between ( Company ) and Infinedi, LLC, a Limited Liability Corporation, ( Contractor

More information

FirstCarolinaCare Insurance Company Business Associate Agreement

FirstCarolinaCare Insurance Company Business Associate Agreement FirstCarolinaCare Insurance Company Business Associate Agreement THIS BUSINESS ASSOCIATE AGREEMENT ("Agreement"), is made and entered into as of, 20 (the "Effective Date") between FirstCarolinaCare Insurance

More information

HIPAA BREACH NOTIFICATION REQUIREMENTS. Heman A. Marshall, III July 25, 2014

HIPAA BREACH NOTIFICATION REQUIREMENTS. Heman A. Marshall, III July 25, 2014 1 HIPAA BREACH NOTIFICATION REQUIREMENTS Heman A. Marshall, III July 25, 2014 2 SCENARIO FOR VBA SUMMER MEETING The Medical Marijuana Growers Association (MMGA) Health Plan, which is a self-fund plan,

More information

HIPAA Compliance: Are you prepared for the new regulatory changes?

HIPAA Compliance: Are you prepared for the new regulatory changes? HIPAA Compliance: Are you prepared for the new regulatory changes? Baker Tilly CARIS Innovation, Inc. April 30, 2013 Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed

More information

HIPAA Business Associate Agreement

HIPAA Business Associate Agreement HIPAA Business Associate Agreement User of any Nemaris Inc. (Nemaris) products or services including but not limited to Surgimap Spine, Surgimap ISSG, Surgimap SRS, Surgimap Office, Surgimap Ortho, Surgimap

More information

Business Associate Agreement

Business Associate Agreement This Business Associate Agreement Is Related To and a Part of the Following Underlying Agreement: Effective Date of Underlying Agreement: Vendor: Business Associate Agreement This Business Associate Agreement

More information

Business Associates and HIPAA

Business Associates and HIPAA Business Associates and HIPAA What BAs need to know to comply with HIPAA privacy and security rules by Dom Nicastro White paper The lax days of complying with privacy and security laws are over for business

More information

Table of Contents INTRODUCTION AND PURPOSE 1

Table of Contents INTRODUCTION AND PURPOSE 1 HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 ( HIPAA ) COMPLIANCE PROGRAM Adopted December 2008: Revised February 2009, May, 2012, and August 2013 Table of Contents INTRODUCTION AND PURPOSE

More information

Business Associate and Data Use Agreement

Business Associate and Data Use Agreement Business Associate and Data Use Agreement This Business Associate and Data Use Agreement (the Agreement ) is entered into by and between ( Covered Entity ) and HealtHIE Nevada ( Business Associate ). W

More information

H I P AA B U S I N E S S AS S O C I ATE AGREEMENT

H I P AA B U S I N E S S AS S O C I ATE AGREEMENT H I P AA B U S I N E S S AS S O C I ATE AGREEMENT This HIPAA BUSINESS ASSOCIATE AGREEMENT (the BAA ) is entered into by and between Opticare of Utah, Inc. ( Covered Entity ), and,( Business Associate ).

More information

This form may not be modified without prior approval from the Department of Justice.

This form may not be modified without prior approval from the Department of Justice. This form may not be modified without prior approval from the Department of Justice. Delete this header in execution (signature) version of agreement. HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate

More information