Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule"

Transcription

1 HEALTHCARE October 2009 Barnes & Thornburg LLP HIPAA Update: HITECH Act Breach Notification Rule This HIPAA Update provides a detailed description of the new breach notification requirements for HIPAA covered entities and business associates as required by interim final rule issued pursuant to the HITECH Act of The interim final rule (Breach Rule) published by the U.S. Department of Health and Human Services (HHS) on Aug. 24, 2009 became effective Sept. 23, It requires business associates and covered entities to notify individuals, HHS, and in some cases, the media, upon discovery of a breach of unsecured protected health information (PHI). The rules set out a three-part test for: determining whether a breach has occurred, further clarifies the definition of Unsecured PHI and establishes requirements for when a breach must be reported, who must make the report, and how the report must be made. The agency also clarified what role business associates have in reporting breaches of PHI. The new rule also requires covered entities and business associates to develop policies and procedures, train workforce members regarding the new breach provisions, and to implement reasonable systems for discovering breaches of unsecured PHI. Entities can now submit breach reports to HHS online at The HHS rule became effective on Sept. 23, However, the Secretary of HHS has delayed enforcement of the new regulations until Feb. 22, 2010 to give entities time to implement procedures necessary to comply with the new rule. I. The Definition of Breach ANALYSIS OF THE NEW BREACH RULES The Breach Rule expands upon the HITECH Act s definition of the term breach, creating a threepart test for determining whether a breach has occurred. Step 1: Was There a Violation of the Privacy Rule? Under the Breach Rule, a breach is defined as: the acquisition, access, use, or disclosure of protected health information in a manner not permitted [by the HIPAA Privacy Rules] which compromises

2 the security or privacy of the protected health information. This definition clarifies that a use or disclosure of PHI is not considered a breach unless such use or disclosure violates the HIPAA Privacy Rules. For example, a disclosure of PHI that is incident to an otherwise permissible use or disclosure, which occurs despite reasonable safeguards and proper minimum necessary procedures, would not be a violation of the Privacy Rule and, thus would not qualify as a breach. A violation of the HIPAA Security rule does not, per se, constitute a breach. However, if a violation of the Security Rule results in the use or disclosure of PHI that is not allowed under the Privacy Rule, such use or disclosure may fall within the definition of a breach. Step 2: Was There Harm to the Individual? The Breach Rule distinguishes between harmless or harmful disclosures. A disclosure does not qualify as a breach unless it causes some harm to the individual. To qualify as a breach, the harm must pose a significant risk of financial, reputational, or other harm to the individual. Covered entities and business associates will need to perform a risk assessment to determine if there is a significant risk of harm to the individual as a result of the impermissible use or disclosure of PHI. HHS lists several factors to consider in performing the risk assessment: Who made the impermissible use or to whom was the PHI impermissibly disclosed? Did the covered entity take immediate steps to mitigate an impermissible use or disclosure? Was the impermissibly disclosed PHI was returned prior to access for an improper purpose? What type and how much PHI was involved? For example, a covered entity may obtain a written confidentiality agreement with the recipient that the information will be destroyed or not further used or disclosed. According to HHS, if such an agreement eliminates or reduces the risk of harm to the individual to a less than significant risk, the security and privacy of the information has not been compromised, and therefore, no breach has occurred. HHS also indicated that impermissible uses or disclosures of limited data sets that include dates of birth and zip code identifiers may cause a pose a risk of significant harm, while limited data sets that do not contain birth dates or zip codes may pose less of a threat and therefore may not trigger a breach if used or disclosed impermissibly. Step 3: Is there an exception? The Breach Rule contains three exceptions to the definition of breach. The first exception provides that an unintentional acquisition, access, or use of PHI by a workforce member or person acting under the authority of a covered entity or business associate, if done in good faith and within the scope of authority, and which does not result in further use or disclosure in a manner not permitted under the Privacy Rule, is not a breach. Workforce member is defined under the HIPAA regulations to include employees, volunteers, trainees, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity. Under the second exception any inadvertent disclosure by a person authorized to access the PHI at a covered entity or business associate to another person authorized to access the PHI at the same covered entity or business associate, or organized health care arrangement (OHCA) in which the covered entity participates, and the PHI is not further used or disclosed in a manner not permitted under the Privacy Rule. This exception essentially provides some flexibility to the minimum necessity standard and does not require reporting of uses or disclosures within an entity, business associate, or OHCA. A third exception provides that any disclosure in which a covered entity or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain such information.

3 The three-part test to determine whether a breach has occurred can be summarized as follows: Was there an impermissible use or disclosure of PHI under the HIPAA Privacy Rule? Yes No No Breach Did the impermissible use or disclosure pose a significant risk of financial, reputational, or other harm to the individual? Yes No No Breach Does the incident fall under one of the exceptions? No Yes No Breach Breach Has Occurred II. Unsecured Protected Health Information The HITECH Act only requires notification when there has been a breach of Unsecured PHI, which is defined as PHI that is not secured through the use of a technology or methodology specified by the Secretary. The HITECH Act requires that HHS specify the technologies and methodologies that render PHI unusable, unreadable, or indecipherable to unauthorized individuals. The Breach Rule provides this additional clarification. It defines Unsecured PHI to mean PHI that is not rendered unusable, unreadable, or indecipherable to unauthorized individuals through the use of a technology or methodology specified by the Secretary in guidance. This reference relates back to the guidance issued by HHS on April 27, 2009 (Technology Guidance), which specified encryption and destruction as the technologies and methodologies for rendering PHI secured ; i.e. unusable, unreadable, or indecipherable to unauthorized individuals. It is important to recognize that HHS s Technology Guidance on secured/unsecured PHI does not modify a covered entity s requirements under the HIPAA Security Rule. Currently, the Security Rule does not require encryption. Therefore, if a covered entity chooses to encrypt PHI in accordance with the Technology Guidance as a way to comply with the Security Rule, and the covered entity subsequently discovers a breach of that encrypted information, the covered entity will not be required to provide

4 notification, even if there is a breach, because the information is not considered unsecured PHI. On the other hand, if a covered entity uses a method other than encryption, or uses an encryption algorithm that is not specified in the Technology Guidance, then although that covered entity may be in compliance with the Security Rule, if there is a breach of the PHI, the covered entity would have to provide breach notification to the affected individuals. HHS also clarifies several terms used in its Technology Guidance. The term data in motion includes data that is moving through a network, including wireless transmission, whether by or structured electronic interchange, while data at rest includes data that resides in databases, file systems, flash drives, memory, and any other structured storage method. Data in use includes data in the process of being created, retrieved, updated, or deleted, and data disposed includes discarded paper records or recycled electronic media. HHS also clarified that covered entities and business associates should keep encryption keys on a separate device from the data that they encrypt or decrypt. HHS specifically rejected redaction as an accepted alternative method to secure paper-based PHI. As a result, if paper documents are lost or stolen, are not redacted appropriately, and include PHI, the covered entity will likely be required to follow the notification requirements. III. Notification Requirements Notification to Individuals The HITECH Act requires a covered entity to notify each individual when the covered entity discovers or reasonably believes there has been a breach of unsecured PHI. The Breach Rule clarifies that a covered entity is deemed to have knowledge of a breach if such breach is known, or if by exercising reasonable diligence, the breach would have been known to any person who is a workforce member or agent of the covered entity, other than the person committing the breach. The federal common law of agency controls in determining who is an agent of the covered entity. HHS explained that reasonable diligence means the business care and prudence expected from a person seeking to satisfy a legal requirement under similar circumstances. Therefore, HHS expects covered entities and business associates to implement reasonable systems for discovery of breaches. Because knowledge of a workforce member or agents such as a business associate will be imputed to the covered entity, covered entities should adequately train their workforce and agents to timely report impermissible uses or disclosures of PHI. Notice is to be provided to the individual without unreasonable delay, and in no case later than 60 calendar days following discovery of the breach. The time for notification must be calculated beginning on the date that the breach is first discovered, not on the date that that a covered entity has completed an investigation of a possible breach. The Breach Rule mirrors the HITECH Act with respect to the contents of the notice required: A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; A description of the types of unsecured PHI involved in the breach; Any steps individuals should take to protect themselves from potential harm resulting from the breach; A brief description of the covered entity s actions to investigate the breach, mitigate harm to individuals, and protect against any further breaches; and

5 Contact procedures for individuals to ask questions or learn additional information, which must include a toll-free telephone number, an address, web site, or postal address. The HHS comments indicate that in providing notice, covered entities may be obligated to comply with other laws, such as Title VI of the Civil Rights Act of 1964 and the Americans with Disabilities Act, which could include providing the notice in languages other than English or alternate formats such as large print or Braille. The HITECH Act includes provisions for actual and substitute notice to the individual. The Breach Rule adopted this statutory language and requires a covered entity to provide notice in written form by firstclass mail to the last known address of the individual or by electronic mail, if the individual agrees to receive electronic notice, and such agreement has not been withdrawn. HHS also clarified that if the affected individual is a minor or otherwise lacks legal capacity, the covered entity may send notice to the individual s personal representative. If the individual is deceased, notice must be sent to next of kin only if the covered entity knows the individual is deceased and has the address of the decedent s next of kin or personal representative. The covered entity is not required to obtain the deceased s contact information if it does not have the information at the time of the breach. If the covered entity does not have sufficient contact information for some or all individuals, substitute notice must be provided. If there are fewer than ten individuals involved, the covered entity may provide substitute notice through an alternative form of written notice, such as electronic mail (even if the individual has not specifically agreed to electronic notice) or by telephone or other means. If the covered entity lacks any current contact information for the individuals, posting such notice on the internet may be appropriate, as long as the posting is done in a manner that is reasonably calculated to reach the individuals. If a covered entity has insufficient or out of date information for ten or more individuals, then substitute notice must be provided through a conspicuous positing on the home page of its website or conspicuous notice in major print or broadcast media, for a period of 90 days. The substitute notice must be provided in a manner that is reasonably calculated to reach the affected individuals. HHS interprets the term home page to include the home page for visitors to the covered entity s website and the landing page or login page for existing account holders, or a hyperlink on the entity s home page that links to the substitute notice. In addition, the substitute notice provision requires the covered entity to have a toll-free phone number for 90 days so individuals can obtain more information about the breach. Notification to the Media If a breach of unsecured PHI involves more than 500 residents of a state or jurisdiction, the HITECH Act requires a covered entity to provide notice to a prominent media outlet in addition to providing the individual notice described above. HHS expects that most covered entities will provide notice to the media under this section in the form of a press release. However, a press release will only satisfy the substitute individual notice requirement if the press release is actually run by the media outlet. In the Breach Rule, HHS clarified that the term jurisdiction is a geographic area smaller than a state, such as a county or town. HHS declined to define prominent media outlet and stated that what constitutes a prominent media outlet will differ depending on the state or jurisdiction affected. For example, if a breach affected individuals across an entire state, the appropriate media may be a major, general interest newspaper with daily circulation throughout the state. On the other hand, if the breach involved only individuals in the same city, the appropriate media may be a general interest newspaper with daily circulation throughout the city. Notification to HHS

6 The HITECH Act requires a covered entity to notify HHS immediately if there is a breach of unsecured PHI involving 500 or more individuals. HHS interprets the term immediately to mean that a covered entity should send notice to HHS concurrently with the notification sent to an individual (without unreasonable delay but in no case later than 60 calendar days following discovery of a breach). The HHS notification requirement differs from the media notification requirement. A covered entity must notify HHS of breaches involving 500 or more individuals, even if the 500 individuals were not located in the same state or jurisdiction. For example, if a covered entity discovers a breach involving 300 Maryland residents and 300 District of Columbia residents, notification must be provided to the individuals and concurrently to HHS, but not to the media. The HITECH Act requires covered entities to maintain a log of all breaches involving less than 500 individuals, and to submit the log to HHS on an annual basis. HHS has specified that the annual report must be submitted to HHS no later than 60 days after the end of each calendar year. In addition, pursuant to the HIPAA Privacy Rule, covered entities must maintain the log or other documentation for six years. The Breach Rule also provides that the notification to HHS must be submitted in a manner to be specified on the HHS web site. HHS has also noted that for calendar year 2009, the covered entity is only required to submit information to HHS for breaches that occur after Sept. 23, 2009, the effective date of the regulation. In October 2009 HHS established a new Web site that permits online reporting of breaches to HHS. Breaches may be reported at IV. Business Associates Under the HITECH Act, when a business associate discovers a breach of Unsecured PHI, the business associate must notify the covered entity so the covered entity can notify affected individuals. The Breach Rule clarifies that if a business associate maintains PHI for multiple covered entities, the business associate only needs to notify a covered entity regarding the relevant breaches. However, if the business associate cannot determine which covered entities were included in the breach, the business associate may need to notify all potential covered entities. The Breach Rule clarifies that a breach shall be treated as discovered by a business associate on the first day on which the breach is known to the business associate, or would have been known to the business associate by exercising reasonable diligence. Like covered entities, business associates are assumed to have the knowledge of their employees, officers, or other agents. Thus, business associates, like covered entities, should establish policies and procedures and train their personnel to report impermissible uses and disclosures. Generally, a business associate must provide notice to the covered entity without unreasonable delay, and in no case later than 60 days following discovery of a breach. If a business associate is acting as an agent of a covered entity, the business associate s discovery of the breach will be imputed to the covered entity. Accordingly, the covered entity must provide notification based on the time the business associate discovers the breach, not from the time the business associate notifies the covered entity. On the other hand, if the business associate is an independent contractor of the covered entity, the covered entity must provide notice based on the time that the business associate notifies the covered entity of the breach. In the Breach Rule, HHS recognized that business associates may not be able to provide the identity of each individual whose unsecured PHI was breached. Therefore, the rule indicates that such identification must be provided to the covered entity to the extent possible. The Breach Rule also requires the business associate to provide the covered entity with any other available information that the covered entity is required

7 to include in the notification to the individual. HHS emphasized that a business associate should not delay the initial notification to the covered entity in order to collect information needed for notification to the individual. HHS specifically noted in its comments that the Breach Rule is not intended to interfere with the relationships between business associates and covered entities, and that both entities will continue to have the flexibility to determine their respective obligations. HHS encouraged the parties to consider which entity is in the best position to provide notice to the individual, depending on the circumstances of the relationship. V. Administrative Requirements and Burden of Proof The Breach Rule requires covered entities to comply with the administrative requirements of the Privacy Rule with respect to the breach notification requirements. This means that covered entities and business associates must develop and document policies and procedures, train workforce members, and impose sanctions for failure to comply with the breach notification procedures. In addition, when a covered entity or business associate knows of an impermissible use or disclosure of PHI, it should maintain documentation that all required notifications were made, or, alternatively, that it conducted the three-part test and determined there was not a breach. Preemption HIPAA preempts contrary state law, with certain exceptions. HHS indicates in the interim final rule that such exceptions do not apply to the breach notification regulations. Therefore, contrary state law will be preempted by the breach notification regulations. For more information, contact the following attorneys in Barnes & Thornburg LLP s Healthcare Department: Stacy Cook, Indianapolis ( ); Ellen Layton, Chicago ( ); or Kate O Brien, Chicago ( ). Visit for additional information on the firm s Healthcare Department and legal services Barnes & Thornburg LLP. All Rights Reserved. This page, and all information on it, is proprietary and the property of Barnes & Thornburg LLP. It may not be reproduced, in any form, without the express written consent of Barnes & Thornburg. This Barnes & Thornburg LLP publication should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own lawyer on any specific legal questions you may have concerning your situation. Please send address changes or requests to opt out of these alerts to.

HIPAA Breach Notification Interim Final Rule

HIPAA Breach Notification Interim Final Rule HIPAA Breach Notification Interim Final Rule The American Recovery and Reinvestment Act of 2009 ( the Act ) made several changes to the HIPAA privacy rules including adding a requirement for notice to

More information

What You Need to Know About the New HIPAA Breach Notification Rule 1

What You Need to Know About the New HIPAA Breach Notification Rule 1 What You Need to Know About the New HIPAA Breach Notification Rule 1 New regulations effective September 23, 2009 require all physicians who are covered by HIPAA to notify patients if there are breaches

More information

HIPAA Privacy Breach Notification Regulations

HIPAA Privacy Breach Notification Regulations Technical Bulletin Issue 8 2009 HIPAA Privacy Breach Notification Regulations On August 24, 2009 Health and Human Services (HHS) issued interim final regulations implementing the HIPAA Privacy Breach Notification

More information

BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION

BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION BREACH NOTIFICATION FOR UNSECURED PROTECTED HEALTH INFORMATION Summary November 2009 On August 24, 2009, the Department of Health and Human Services (HHS) published an interim final rule (the Rule ) that

More information

Georgia Regional Academic Community Health Information Exchange (GRAChIE) Breach Notification Policy Effective Date: May, 2012 Revision Date: New

Georgia Regional Academic Community Health Information Exchange (GRAChIE) Breach Notification Policy Effective Date: May, 2012 Revision Date: New Objective The objective of this policy is to provide guidance for breach notification by Georgia Regional Academic Community Health Information Exchange (hereafter referred to as GRAChIE) when unauthorized

More information

UNIVERSITY OF WYOMING HIPAA POLICY 3.6 BREACH

UNIVERSITY OF WYOMING HIPAA POLICY 3.6 BREACH UNIVERSITY OF WYOMING HIPAA POLICY 3.6 BREACH I. PURPOSE: The purpose of this policy is to outline the processes and procedures for determining whether the security or privacy of PHI has been compromised

More information

HHS Issues Rule Requiring Individuals Be Notified of Breaches of Their Health Information

HHS Issues Rule Requiring Individuals Be Notified of Breaches of Their Health Information HHS Issues Rule Requiring Individuals Be Notified of Breaches of Their Health Information New regulations requiring health care professionals, health plans, and other entities covered by the Health Insurance

More information

POLICY AND PROCEDURE MANUAL

POLICY AND PROCEDURE MANUAL Pennington Biomedical POLICY NO. 412.22 POLICY AND PROCEDURE MANUAL Origin Date: 02/04/2013 Impacts: ALL PERSONNEL Effective Date: 03/17/2014 Subject: HIPAA BREACH NOTIFICATION Last Revised: Source: LEGAL

More information

New HIPAA Regulations Require Notification of Breaches of Unsecured Protected Health Information

New HIPAA Regulations Require Notification of Breaches of Unsecured Protected Health Information New HIPAA Regulations Require Notification of Breaches of Unsecured Protected Health Information GEORGE CHORIATIS In this article, the author discusses the new Health Insurance Portability and Accountability

More information

BREACH NOTIFICATION POLICY

BREACH NOTIFICATION POLICY PRIVACY 2.0 BREACH NOTIFICATION POLICY Scope: All subsidiaries of Universal Health Services, Inc., including facilities and UHS of Delaware Inc. (collectively, UHS ), including UHS covered entities ( Facilities

More information

Health Information Technology for Economic and Clinical Health Act ( HITECH ), part of the American Recovery and Reinvestment Act of 2009 ( ARRA ).

Health Information Technology for Economic and Clinical Health Act ( HITECH ), part of the American Recovery and Reinvestment Act of 2009 ( ARRA ). Client Advisory Health Care/Technology August 31, 2009 HHS Issues Security Breach Notice Rule On August 24, the Department of Health and Human Services ( HHS ) published its rule (the Rule ) implementing

More information

HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES

HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES SALISH BHO HIPAA AND MEDICAID COMPLIANCE POLICIES AND PROCEDURES Policy Name: HIPAA BREACH NOTIFICATION REQUIREMENTS Policy Number: 5.16 Reference: 45 CFR Parts 164 Effective Date: 03/2016 Revision Date(s):

More information

COMPLIANCE ALERT 10-12

COMPLIANCE ALERT 10-12 HAWAII HEALTH SYSTEMS C O R P O R A T I O N "Touching Lives Every Day COMPLIANCE ALERT 10-12 HIPAA Expansion under the American Recovery and Reinvestment Act of 2009 The American Recovery and Reinvestment

More information

QUEST, INC BREACH NOTIFICATION POLICY

QUEST, INC BREACH NOTIFICATION POLICY QUEST, INC BREACH NOTIFICATION POLICY Dev September 2012 Page Number I. Breach Notification Template HIPAA Breach Notification Policy Table of Contents 1 A. Generally 1 B. When a Breach is Considered to

More information

Definitions: 45 CFR As used in this subpart, the following terms have the following meanings:

Definitions: 45 CFR As used in this subpart, the following terms have the following meanings: HITECH/HIPAA Breach Notification Regulations This summary was prepared by the New Jersey Department of Human Services Privacy Officer on February 24, 2010 for distribution at the Division of Addiction

More information

3.) The Breach Notification Rule (Part 164, Subpart D)

3.) The Breach Notification Rule (Part 164, Subpart D) 3.) The Breach Notification Rule (Part 164, Subpart D) 164.400 Applicability 164.402 Definitions (breach, unsecured protected health information) 164.404 Notification to individuals 164.406 Notification

More information

NEW JERSEY DATA BREACH NOTIFICATION & IDENTITY THEFT PREVENTION POLICY **DISCLAIMER**

NEW JERSEY DATA BREACH NOTIFICATION & IDENTITY THEFT PREVENTION POLICY **DISCLAIMER** NEW JERSEY DATA BREACH NOTIFICATION & IDENTITY THEFT PREVENTION POLICY **DISCLAIMER** This document was prepared to assist the typical physician practice in seeking to undertake reasonable measures to

More information

LIVINGSTON COUNTY ADMINISTRATIVE PROCEDURE HIPAA-4. Breach Notification for Unsecured Protected Health Information

LIVINGSTON COUNTY ADMINISTRATIVE PROCEDURE HIPAA-4. Breach Notification for Unsecured Protected Health Information LIVINGSTON COUNTY ADMINISTRATIVE PROCEDURE HIPAA-4 SUBJECT: ORGANIZATION RESPONSIBLE: Breach Notification for Unsecured Protected Health Information Information Technology Security Manager Office of Information

More information

UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14

UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14 UNDERSTANDING THE HIPAA/HITECH BREACH NOTIFICATION RULE 2/25/14 RULES Issued August 19, 2009 Requires Covered Entities to notify individuals of a breach as well as HHS without reasonable delay or within

More information

Breach Notification Policy

Breach Notification Policy 1. Breach Notification Team. Breach Notification Policy Ferris State University ( Ferris State ), a hybrid entity with health care components, has established a Breach Notification Team, which consists

More information

Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455. Notification of Security Breach Policy

Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455. Notification of Security Breach Policy Five Rivers Medical Center, Inc. 2801 Medical Center Drive Pocahontas, AR 72455 Notification of Security Breach Policy Purpose: This policy has been adopted for the purpose of complying with the Health

More information

POLICY NAME: NOTICE OF PRIVACY BREACHES

POLICY NAME: NOTICE OF PRIVACY BREACHES NOTE: This sample policy is drafted to comply with the HIPAA breach notification rules as amended January 2013. The user should review applicable laws and regulations and modify this sample policy as appropriate

More information

STANDARD ADMINISTRATIVE PROCEDURE

STANDARD ADMINISTRATIVE PROCEDURE STANDARD ADMINISTRATIVE PROCEDURE 16.99.99.M0.26 Investigation and Response to Breach of Unsecured Protected Health Information (HITECH) Approved October 27, 2014 Next scheduled review: October 27, 2019

More information

LOUISIANA HEALTH CARE QUALITY FORUM

LOUISIANA HEALTH CARE QUALITY FORUM POLICY: Data Breach Notification and Investigation EFFECTIVE: 10-01-2011 DEPARTMENT: LHCQF; LaHIE REVISED: PURPOSE To facilitate compliance with the Health Information Technology for Economic and Clinical

More information

Health Care HHS, FTC ISSUE BREACH NOTIFICATION RULES FOR ELECTRONIC HEALTH INFORMATION I. SCOPE OF THE BREACH NOTIFICATION RULES

Health Care HHS, FTC ISSUE BREACH NOTIFICATION RULES FOR ELECTRONIC HEALTH INFORMATION I. SCOPE OF THE BREACH NOTIFICATION RULES Health Care September 1, 2009 HHS, FTC ISSUE BREACH NOTIFICATION RULES FOR ELECTRONIC HEALTH INFORMATION On August 19, 2009, the U.S. Department of Health and Human Services ( HHS ) issued an interim final

More information

organization's patient protected health information (PHI) occurs. as any other federal or state notification law.

organization's patient protected health information (PHI) occurs. as any other federal or state notification law. I. APPLICABILITY Entire organization and its business associate (BAs) and the BA's Subcontractors. II. PURPOSE To provide guidance for breach notification by covered entities and breaches by their business

More information

Dates Revised: September 23, 2013; July 1, 2014; December 14, 2015

Dates Revised: September 23, 2013; July 1, 2014; December 14, 2015 Policy Level: Policy Title: Policy Number: Breach Notification PP-29 Superseded Policy(ies) or Entity Policy: N/A Date Established: March 17, 2010 Date Effective: December 14, 2015 Dates Revised: September

More information

Federal Breach Notification Decision Tree and Tools

Federal Breach Notification Decision Tree and Tools Federal Breach Notification and Tools Disclaimer This document is copyright 2013 by the Long Term Care Consortium (LTCC). These materials may be reproduced and used only by long-term health care providers

More information

Everett School Employee Benefit Trust. Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law

Everett School Employee Benefit Trust. Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law Everett School Employee Benefit Trust Reportable Breach Notification Policy HIPAA HITECH Rules and Washington State Law Introduction The Everett School Employee Benefit Trust ( Trust ) adopts this policy

More information

CHART YOUR HIPAA COURSE...

CHART YOUR HIPAA COURSE... CHART YOUR HIPAA COURSE... HHS ISSUES SECURITY BREACH NOTIFICATION RULES PUBLISHED IN FEDERAL REGISTER 8/24/09 EFFECTIVE 9/23/09 The Department of Health and Human Services ( HHS ) has issued interim final

More information

This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in

This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in the HIPAA Omnibus Rule of 2013. As part of the American

More information

ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016

ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016 Page 1 of 9 CITY OF CHESAPEAKE, VIRGINIA NUMBER: 2.62 ADMINISTRATIVE REGULATION EFFECTIVE DATE: 1/1/2016 SUPERCEDES: N/A SUBJECT: HUMAN RESOURCES DEPARTMENT CITY OF CHESAPEAKE EMPLOYEE/RETIREE GROUP HEALTH

More information

Breach Notification and Enforcement Update

Breach Notification and Enforcement Update Breach Notification and Enforcement Update Presented to the Seattle Western Pension & Benefits Council June 16, 2015 Sarah Brown Investigator U.S. Department of Health and Human Services Office for Civil

More information

University of Wisconsin-Madison Policy and Procedure

University of Wisconsin-Madison Policy and Procedure Page 1 of 12 I. Policy The Health Information Technology for Economic and Clinical Health Act ( HITECH ) regulations contain requirements for notifying individuals in the event of a breach of their unsecured

More information

The ReHabilitation Center. 1439 Buffalo Street. Olean. NY. 14760

The ReHabilitation Center. 1439 Buffalo Street. Olean. NY. 14760 Procedure Name: HITECH Breach Notification The ReHabilitation Center 1439 Buffalo Street. Olean. NY. 14760 Purpose To amend The ReHabilitation Center s HIPAA Policy and Procedure to include mandatory breach

More information

Community First Health Plans Breach Notification for Unsecured PHI

Community First Health Plans Breach Notification for Unsecured PHI Community First Health Plans Breach Notification for Unsecured PHI The presentation is for informational purposes only. It is the responsibility of the Business Associate to ensure awareness and compliance

More information

Checklist for HITECH Breach Readiness

Checklist for HITECH Breach Readiness Checklist for HITECH Breach Readiness Checklist for HITECH Breach Readiness Figure 1 describes a checklist that may be used to assess for breach preparedness for the organization. It is based on published

More information

New HIPAA Breach Notification Rule: Know Your Responsibilities. Loudoun Medical Group Spring 2010

New HIPAA Breach Notification Rule: Know Your Responsibilities. Loudoun Medical Group Spring 2010 New HIPAA Breach Notification Rule: Know Your Responsibilities Loudoun Medical Group Spring 2010 Health Information Technology for Economic and Clinical Health Act (HITECH) As part of the Recovery Act,

More information

HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013

HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013 HIPPA and HITECH NOTIFICATION Effective Date: September 23, 2013 Orchard Creek Health Care is required by law to maintain the privacy of protected health information (PHI) of our residents. If you feel

More information

IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240

IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240 IDAHO STATE UNIVERSITY POLICIES AND PROCEDURES (ISUPP) HIPAA Privacy - Data Breach Notification Policy 10240 POLICY INFORMATION Major Functional Area (MFA): MFA X - Office of General Counsel & Compliance

More information

Guidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES

Guidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES DEPARTMENT OF HEALTH AND HUMAN SERVICES 45 CFR PARTS 160 and 164 Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable

More information

POLICY AUTHORITY Chancellor for Health Sciences and Dean of the School of Medicine

POLICY AUTHORITY Chancellor for Health Sciences and Dean of the School of Medicine Applies To: All HSC, UNMH, UNMCC, UNM-MG Responsible Department: Privacy Office Revised: New 10/2010 Policy Patient Age Group: ( ) N/A ( X) All Ages ( ) Newborns ( ) Pediatric ( ) Adult POLICY STATEMENT

More information

Information Privacy and Security Program. Title: EC.PS.01.02

Information Privacy and Security Program. Title: EC.PS.01.02 Page: 1 of 9 I. PURPOSE: The purpose of this standard is to ensure that affected individuals, the media, and the Secretary of Health and Human Services (HHS) are appropriately notified of any Breach of

More information

HIPAA/HITECH Omnibus Final Rule - January 23, 2013

HIPAA/HITECH Omnibus Final Rule - January 23, 2013 HIPAA Omnibus Rule Please note: these slides are intended to provide an overview of general information, not an exhaustive review. No legal advice is being offered or intended. Do not rely on this information

More information

HIPAA Update. Bob Radecki W.J. Flynn and Associates, LLC

HIPAA Update. Bob Radecki W.J. Flynn and Associates, LLC HIPAA Update Bob Radecki W.J. Flynn and Associates, LLC Background ARRA American Recovery and Reinvestment Act of 2009 HITECH Health Information Technology for Economic and Clinical Act (Title XII, Part

More information

HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST. David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com

HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST. David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com HITECH ACT UPDATE HIPAA BREACH NOTIFICATION RULE WEB CAST David G. Schoolcraft Ogden Murphy Wallace, PLLC dschoolcraft@omwlaw.com Presenters David Schoolcraft, Member, Ogden Murphy Wallace, PLLC Taya Briley,

More information

HIPAA Breach Reporting Tips & Tricks IADDA Annual Conference 2014

HIPAA Breach Reporting Tips & Tricks IADDA Annual Conference 2014 HIPAA Breach Reporting Tips & Tricks IADDA Annual Conference 2014 9/3/14 Gerald Jud E. DeLoss Disclaimer 2 o This presentation and its materials are for informational purposes only and not for the purpose

More information

BREACH MANAGEMENT & NOTIFICATION POLICY

BREACH MANAGEMENT & NOTIFICATION POLICY PURPOSE To ensure that the impermissible or unauthorized use or disclosure of an Individual s Protected Health Information (PHI) will be reported and Participants shall comply with the notification requirements

More information

Data Breach, Electronic Health Records and Healthcare Reform

Data Breach, Electronic Health Records and Healthcare Reform Data Breach, Electronic Health Records and Healthcare Reform (This presentation is for informational purposes only and it is not intended, and should not be relied upon, as legal advice.) Overview of HIPAA

More information

SALT LAKE COUNTY COUNTYWIDE POLICY ON HIPAA BREACH NOTIFICATION REQUIREMENTS

SALT LAKE COUNTY COUNTYWIDE POLICY ON HIPAA BREACH NOTIFICATION REQUIREMENTS SALT LAKE COUNTY COUNTYWIDE POLICY ON HIPAA BREACH NOTIFICATION REQUIREMENTS Reference Purpose Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 United States Code 1320d et seq.;

More information

FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA

FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA APPENDIX PR 12-A FEDERAL AND STATE BREACH NOTIFICATION LAWS FOR CALIFORNIA LEGAL CITATION California Civil Code Section 1798.82 California Health and Safety (H&S) Code Section 1280.15 42 U.S.C. Section

More information

by Alicia H. Sable and Robert Hudock August 2009

by Alicia H. Sable and Robert Hudock August 2009 The New HIPAA Breach Notification Rules: A Guide for Covered Entities and Business Associates to the Breach Reporting Obligations under the HITECH Act and HHS Regulations by Alicia H. Sable and Robert

More information

NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA. March 2010

NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA. March 2010 NACHC Issue Brief Changes to the Health Insurance Portability and Accountability Act Included in ARRA March 2010 Prepared By: Marisa Guevara and Marcie H. Zakheim Feldesman Tucker Leifer Fidell, LLP 2001

More information

Section 2: HIPAA and the HITECH Act

Section 2: HIPAA and the HITECH Act Section 2: HIPAA and the HITECH Act 1 Introduction to HIPAA and the HITECH Act The Health Information Technology for Economic and Clinical Health (HITECH) Act was signed on February 17, 2009 as part of

More information

Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration

Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration Name of Policy: Policy Number: Department: Reporting of Security Breach of Protected Health Information including Personal Health Information 3364-100-90-15 Hospital Administration Approving Officer: Interim

More information

Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule

Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule Business Associates and Breach Reporting Under HITECH and the Omnibus Final HIPAA Rule Patricia D. King, Esq. Associate General Counsel Swedish Covenant Hospital Chicago, IL I. Business Associates under

More information

TTUHSC HIPAA Privacy Changes HITECH Act August 28, 2009

TTUHSC HIPAA Privacy Changes HITECH Act August 28, 2009 New "Defined" Terms Breach; Electronic health record (different from electronic PHI); Personal Health Record (different from PHI); Vendor of Personal Health Records; Unsecured PHI Electronic Health Record

More information

H. R. 1 144. Subtitle D Privacy

H. R. 1 144. Subtitle D Privacy H. R. 1 144 (1) an analysis of the effectiveness of the activities for which the entity receives such assistance, as compared to the goals for such activities; and (2) an analysis of the impact of the

More information

Responding to HIPAA Breaches

Responding to HIPAA Breaches Responding to HIPAA Breaches 11/06/2015 by Kim Stanger HIPAA privacy and security breaches can result in fines of $100 to $50,000 to covered entities (including healthcare providers and health plans) and

More information

Andrew B. Wachler, Esq. Amy K. Fehn, Esq. Wachler & Associates, P.C. Royal Oak, MI

Andrew B. Wachler, Esq. Amy K. Fehn, Esq. Wachler & Associates, P.C. Royal Oak, MI T H E A B A HEA L T H L A W S E C T I O N THE HEALTH LAWYER IN THIS ISSUE The HITECH Breach Notification Rules: Understanding the New Obligations...1 Race and Ethnicity: BiDil at the Intersection of Health

More information

What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act

What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act What Health Care Entities Need to Know about HIPAA and the American Recovery and Reinvestment Act by Lane W. Staines and Cheri D. Green On February 17, 2009, The American Recovery and Reinvestment Act

More information

HIPAA BREACH RESPONSE POLICY

HIPAA BREACH RESPONSE POLICY http://dhmh.maryland.gov/sitepages/op02.aspx (OIG) DHMH POLICY 01.03.07 Effective Date: July 22, 2014 I. EXECUTIVE SUMMARY The Department of Health and Mental Hygiene (DHMH) is committed to protecting

More information

M E M O R A N D U M. Definitions

M E M O R A N D U M. Definitions M E M O R A N D U M DATE: November 10, 2011 TO: FROM: RE: Krevolin & Horst, LLC HIPAA Obligations of Business Associates In connection with the launch of your hosted application service focused on practice

More information

Regulatory Update: HITECH s HHS and FTC Security Breach Notification Requirements

Regulatory Update: HITECH s HHS and FTC Security Breach Notification Requirements Regulatory Update: HITECH s HHS and FTC Security Breach Notification Requirements August 27, 2009 Boston Brussels Chicago Düsseldorf Houston London Los Angeles Miami Milan Munich New York Orange County

More information

HITECH FINAL RULE BREACH NOTIFICATION. Leslie J. Pfeffer, BS, CHP Interim University HIPAA Privacy Officer Indiana University

HITECH FINAL RULE BREACH NOTIFICATION. Leslie J. Pfeffer, BS, CHP Interim University HIPAA Privacy Officer Indiana University HITECH FINAL RULE BREACH NOTIFICATION Leslie J. Pfeffer, BS, CHP Interim University HIPAA Privacy Officer Indiana University HIPAA HITECH Final Rule Modifies the Breach Notification Rule replacing the

More information

Updated HIPAA Regulations What Optometrists Need to Know Now. HIPAA Overview

Updated HIPAA Regulations What Optometrists Need to Know Now. HIPAA Overview Updated HIPAA Regulations What Optometrists Need to Know Now The U.S. Department of Health & Human Services Office for Civil Rights recently released updated regulations regarding the Health Insurance

More information

HIPAA and the HITECH Act Privacy and Security of Health Information in 2009

HIPAA and the HITECH Act Privacy and Security of Health Information in 2009 HIPAA and the HITECH Act Privacy and Security of Health Information in 2009 What is HIPAA? Health Insurance Portability & Accountability Act of 1996 Effective April 13, 2003 Federal Law HIPAA Purpose:

More information

HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary

HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary HHS Issues Breach Reporting Regulations under the HITECH Act Executive Summary The Health Information Technology for Economic and Clinical Health Act (the HITECH Act), which became law in February of this

More information

BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS

BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS BREVIUM HIPAA BUSINESS ASSOCIATE TERMS AND CONDITIONS The following HIPAA Business Associate Terms and Conditions (referred to hereafter as the HIPAA Agreement ) are part of the Brevium Software License

More information

CHART YOUR HIPAA COURSE... HITECH Act Security Breach Notification Requirement

CHART YOUR HIPAA COURSE... HITECH Act Security Breach Notification Requirement CHART YOUR HIPAA COURSE... Security Breach Notification Requirement Scope HIPAA Covered Entities In case of "breach," HIPAA covered entity (health plan, provider, clearinghouse) must notify each individual

More information

CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS

CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS CMA BUSINESS ASSOCIATE AGREEMENT WITH CMA MEMBERS Dear Physician Member: Thank you for contacting the California Medical Association and thank you for your membership. In order to advocate on your behalf,

More information

Identity Theft Prevention and Security Breach Notification Policy. Purpose:

Identity Theft Prevention and Security Breach Notification Policy. Purpose: Identity Theft Prevention and Security Breach Notification Policy Purpose: Lahey Clinic is committed to protecting the privacy of the Personal Health Information ( PHI ) of our patients and the Personal

More information

AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE

AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE AVE MARIA UNIVERSITY HIPAA PRIVACY NOTICE This Notice of Privacy Practices describes the legal obligations of Ave Maria University, Inc. (the plan ) and your legal rights regarding your protected health

More information

HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI

HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI January 23, 2013 HHS Finalizes HIPAA Privacy and Data Security Rules, Including Stricter Rules for Breaches of Unsecured PHI Executive Summary HHS has issued final regulations that address recent legislative

More information

Mapping to HIPAA Audit Protocols

Mapping to HIPAA Audit Protocols Mapping to HIPAA Audit Protocols In June 2011, KPMG was awarded the contract to conduct HIPAA audits and develop an audit protocol on behalf of Health and Human Services (HHS) Office for Civil Rights (OCR).

More information

HIPAA PRIVACY RULE PAT-608: BREACH NOTIFICATION POLICY

HIPAA PRIVACY RULE PAT-608: BREACH NOTIFICATION POLICY HIPAA PRIVACY RULE PAT-608: BREACH NOTIFICATION POLICY I. POLICY: USC 1 shall comply with breach notification requirements under federal and state laws, including the HIPAA privacy and security regulations

More information

HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN. Stewart C. Miller & Co., Inc. (Business Associate) AND

HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN. Stewart C. Miller & Co., Inc. (Business Associate) AND HIPAA PRIVACY AND SECURITY RULES BUSINESS ASSOCIATE AGREEMENT BETWEEN Stewart C. Miller & Co., Inc. (Business Associate) AND City of West Lafayette Flexible Spending Plan (Covered Entity) TABLE OF CONTENTS

More information

Re: RIN 0991-AB56; Breach Notification for Unsecured Protected Health Information; Interim Final Rule, 74 Fed. Reg (August 24, 2009).

Re: RIN 0991-AB56; Breach Notification for Unsecured Protected Health Information; Interim Final Rule, 74 Fed. Reg (August 24, 2009). Kathleen Sebelius, Secretary U.S. Department of Health and Human Service Office for Civil Rights Attention: HITECH Breach Notification Hubert H. Humphrey Building, Room 509F 200 Independence Avenue, SW

More information

HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations

HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations HIPAA Data Breaches: Managing Them Internally and in Response to Civil/Criminal Investigations Health Care Litigation Webinar Series March 22, 2012 Spence Pryor Paula Stannard Jason Popp 1 HIPAA/HITECH

More information

HIPAA Update Focus on Breach Prevention

HIPAA Update Focus on Breach Prevention HIPAA Update Focus on Breach Prevention Objectives By the end of this program, participants should be able to: Identify top reasons why breaches occur Review the breach definition and notification process

More information

Rutgers University HIPAA BUSINESS ASSOCIATE AGREEMENT

Rutgers University HIPAA BUSINESS ASSOCIATE AGREEMENT Rutgers University HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement Is Related To and a Part of the Following Underlying Agreement: Effective Date of Underlying Agreement: School/Unit:

More information

Chris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A.

Chris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A. Chris Bennington, Esq., INCompliance Consulting Shannon DeBra, Esq., Bricker & Eckler LLP Victoria Norton, R.N., J.D., M.B.A., UC Health 7093020v1 Examples from the News Review of HIPAA Breach Regulations

More information

Violation Become a Privacy Breach? Agenda

Violation Become a Privacy Breach? Agenda How Does a HIPAA Violation Become a Privacy Breach? Karen Voiles, MBA, CHC, CHPC, CHRC Senior Managing Consultant, Compliance Agenda Differentiating between HIPAA violation and reportable breach Best practices

More information

REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES PLEASE REVIEW IT CAREFULLY.

REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES PLEASE REVIEW IT CAREFULLY. REPRODUCTIVE ASSOCIATES OF DELAWARE (RAD) NOTICE OF PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW PROTECTED HEALTH INFORMATION (PHI) ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS

More information

12/19/2014. HIPAA More Important Than You Realize. Administrative Simplification Privacy Rule Security Rule

12/19/2014. HIPAA More Important Than You Realize. Administrative Simplification Privacy Rule Security Rule HIPAA More Important Than You Realize J. Ira Bedenbaugh Consulting Shareholder February 20, 2015 This material was used by Elliott Davis Decosimo during an oral presentation; it is not a complete record

More information

Revisiting the PHI Breach Under HIPAA and HITECH and Considerations for Ophthalmologists

Revisiting the PHI Breach Under HIPAA and HITECH and Considerations for Ophthalmologists ONCE MORE UNTO THE BREACH, DEAR FRIENDS, ONCE MORE Revisiting the PHI Breach Under HIPAA and HITECH and Considerations for Ophthalmologists Neil H. Ekblom, Esq. 885 Third Avenue, 16th Floor, New York,

More information

SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY

SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY SCHOOL DISTRICT OF BLACK RIVER FALLS HIPAA PRIVACY AND SECURITY POLICY 1 School Board Policy 523.5 The School District of Black River Falls ( District ) is committed to compliance with the health information

More information

NOTICE OF THE NATHAN ADELSON HOSPICE PRIVACY PRACTICES

NOTICE OF THE NATHAN ADELSON HOSPICE PRIVACY PRACTICES THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION PLEASE REVIEW IT CAREFULLY. DEFINITIONS PROTECTED HEALTH INFORMATION (PHI):

More information

IMPORTANT HIPAA CHANGES SUSAN J. FREED. THE DAVIS BROWN TOWER th STREET, SUITE 1300 DES MOINES, IA

IMPORTANT HIPAA CHANGES SUSAN J. FREED. THE DAVIS BROWN TOWER th STREET, SUITE 1300 DES MOINES, IA IMPORTANT HIPAA CHANGES SUSAN J. FREED THE DAVIS BROWN TOWER 215 10 th STREET, SUITE 1300 DES MOINES, IA 50309 515-288-2500 WWW.DAVISBROWNLAW.COM DAVIS BROWN KOEHN SHORS & ROBERTS P.C. #1651683 IMPORTANT

More information

Limited Data Set Data Use Agreement

Limited Data Set Data Use Agreement Limited Data Set Data Use Agreement This Agreement is made and entered into by and between (hereinafter Applicant ) and the State of Florida Agency for Health Care Administration, Florida Center for Health

More information

Model Business Associate Agreement

Model Business Associate Agreement Model Business Associate Agreement Instructions: The Texas Health Services Authority (THSA) has developed a model BAA for use between providers (Covered Entities) and HIEs (Business Associates). The model

More information

BUSINESS ASSOCIATE AGREEMENT. Business Associate. Business Associate shall mean.

BUSINESS ASSOCIATE AGREEMENT. Business Associate. Business Associate shall mean. BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement is made as of the day of, 2010, by and between Methodist Lebonheur Healthcare, on behalf of itself and all of its affiliates ( Covered Entity

More information

Business Associate Agreement

Business Associate Agreement Business Associate Agreement This Agreement is entered into as of ("Effective Date"), between ( Covered Entity ), and ( Business Associate ). RECITALS WHEREAS, Business Associate provides services on behalf

More information

New HIPAA Rules and EHRs: ARRA & Breach Notification

New HIPAA Rules and EHRs: ARRA & Breach Notification New HIPAA Rules and EHRs: ARRA & Breach Notification Jim Sheldon-Dean Director of Compliance Services Lewis Creek Systems, LLC www.lewiscreeksystems.com and Raj Goel Chief Technology Officer Brainlink

More information

SAMPLE BUSINESS ASSOCIATE AGREEMENT

SAMPLE BUSINESS ASSOCIATE AGREEMENT SAMPLE BUSINESS ASSOCIATE AGREEMENT THIS AGREEMENT IS TO BE USED ONLY AS A SAMPLE IN DEVELOPING YOUR OWN BUSINESS ASSOCIATE AGREEMENT. ANYONE USING THIS DOCUMENT AS GUIDANCE SHOULD DO SO ONLY IN CONSULT

More information

Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate

Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate Privacy, Data Security & Information Use September 16, 2010 Data Breach Notification Burden Grows With First State Insurance Commissioner Mandate by John L. Nicholson and Meighan E. O'Reardon Effective

More information

Identifying and Responding to HIPAA Breaches

Identifying and Responding to HIPAA Breaches Identifying and Responding to HIPAA Breaches Kim C. Stanger (2-16) 1 This presentation is similar to any other legal education materials designed to provide general information on pertinent legal topics.

More information

DATA SHARING & BREACH PROTOCOLS UNDER THE FINAL HIPAA PRIVACY RULE

DATA SHARING & BREACH PROTOCOLS UNDER THE FINAL HIPAA PRIVACY RULE DATA SHARING & BREACH PROTOCOLS UNDER THE FINAL HIPAA PRIVACY RULE I. INTRODUCTION: The Health Insurance Portability and Accountability Act (HIPAA) Administrative Simplification provisions apply to three

More information

October 22, 2009. 45 CFR PARTS 160 and 164

October 22, 2009. 45 CFR PARTS 160 and 164 October 22, 2009 U.S. Department of Health and Human Services Office for Civil Rights Attention: HITECH Breach Notification Hubert H. Humphrey Building Room 509 F 200 Independence Avenue, SW Washington,

More information

SUMMARY OF CHANGES HIPAA AND OHIO PRIVACY LAWS

SUMMARY OF CHANGES HIPAA AND OHIO PRIVACY LAWS Franklin J. Hickman Janet L. Lowder David A. Myers Elena A. Lidrbauch Judith C. Saltzman Mary B. McKee Lisa Montoni Garvin Andrea Aycinena Penton Building 1300 East Ninth Street Suite 1020 Cleveland, OH

More information