University of Wisconsin-Madison Policy and Procedure
|
|
|
- Patricia Malone
- 10 years ago
- Views:
Transcription
1 Page 1 of 6 I. Policy UW-Madison strives to ensure the privacy and security of all patient/clients protected health information in the maintenance, retention, and eventual destruction/disposal of such information. Destruction/disposal of this information in whatever format shall be carried out as described in this document, but always in a manner that leaves no possibility for reconstruction of information. This policy and procedure describes how records shall be disposed of/destroyed. When records may be disposed of/destroyed is outlined in applicable records retention schedules of the UW Health Care Component. II. Definitions A. Protected Health Information ( PHI ): Health information, or healthcare payment information, including demographic information, which identifies the individual or can be used to identify the individual. PHI does not include student records held by educational institutions or employment records held by employers. B. UW-Madison Health Care Component ( UW HCC ): Those units of the University of Wisconsin-Madison that have been designated by the University as part of its health care component under HIPAA. See Privacy Policy # 1.1 Designation of UW-Madison Health Care Component for a listing of these units. III. Procedures A. All destruction/disposal of PHI will be done in accordance with applicable federal and state law and any applicable records retention schedule of the UW HCC unit. Records that have satisfied the period of retention may be destroyed/disposed of by an appropriate method as described in III.G. below. B. Records involved in any open investigation, public records request, audit or litigation must not be destroyed/disposed of. If the UW HCC unit receives notification that any of the above situations have occurred or there is the potential for such, the record retention schedule shall be suspended for these records until such time as the situation has been resolved.
2 Page 2 of 6 C. Records containing PHI that are not originals and that have no retention of record requirements (i.e. provider copies, shadow charts, etc.) will be destroyed /disposed by shredding or other comparable method determined by each UW HCC unit. Certification of destruction of non-originals is not required. D. Records containing PHI scheduled for destruction/disposal will be secured against unauthorized or inappropriate access until the destruction/disposal of PHI is complete. E. A record of all destruction/disposal of original medical/client records or other original documents containing PHI will be made and retained permanently. Permanent retention is required because the records of destruction/disposal may be needed to demonstrate that the records containing PHI were destroyed/disposed of in the regular course of business. Records of destruction/disposal should include: 1. Date of destruction/disposal. 2. Method of destruction/disposal. 3. Description of the destroyed/disposed record series or medium. 4. Inclusive dates covered. 5. A statement that the records containing PHI were destroyed/disposed of in the normal course of business. 6. The signatures of the individuals supervising and witnessing the destruction/disposal (when appropriate). A sample certificate of destruction is available at the hipaa.wisc.edu webpage in the Forms tab. F. If destruction/disposal services are contracted, the contract shall: 1. Specify the method of destruction/disposal (such method must be consistent with those set forth in III.G. below). 2. Specify the time that will elapse between acquisition and destruction/disposal of data/media. 3. Establish safeguards against breaches in confidentiality. 4. Provide proof of destruction/disposal.
3 Page 3 of 6 See Privacy Policy # 6.1 Managing Arrangements with Business Associates of the University of Wisconsin-Madison for more details concerning the requirements of a business associate agreement. G. PHI will be destroyed/disposed of using a method that ensures the PHI cannot be recovered or reconstructed. Appropriate methods for destruction/disposal are outlined in the following table. Medium Audiotapes Computerized Data/ Computers & Hard Disk Drives (including within some fax machines and copiers) Computer Data/ Magnetic Media Recommendation Methods for destroying/disposing of audiotapes include recycling (tape over) or pulverizing. Methods of destruction/disposal should destroy/dispose of data permanently and irreversibly. Methods may include overwriting data with a series of characters or reformatting the disk (destroying everything on it). Deleting a file on a disk does not destroy/dispose of the data, but merely deletes the filename from the directory, preventing easy access and making the sector available on the disk so it may not be overwritten. Total data destruction/disposal does not occur until the back-up tapes have been overwritten. Methods may include overwriting data with a series of characters or reformatting the tape (destroying everything on it). Total data destruction does not occur until the back-up tapes have been overwritten. Magnetic degaussing will leave the sectors in random patterns with no preference to orientation, rendering previous data unrecoverable. Computer Diskettes Methods for destroying/disposing of diskettes include reformatting, pulverizing, or magnetic degaussing. Laser Disks Disks used in write once-read many (WORM) document imaging cannot be altered or reused, making pulverization an appropriate means of destruction/disposal.
4 Page 4 of 6 Medium Microfilm/ Microfiche Paper Records Videotapes Recommendation Methods for destroying/disposing of microfilm or microfiche include recycling and pulverizing. Paper records should be destroyed/disposed of in a manner that leaves no possibility for reconstruction of information. Appropriate methods for destroying/disposing of paper records include: burning, shredding, pulping, and pulverizing. Methods for destroying/disposing of videotapes include recycling (tape over) or pulverizing. H. Additional Information on Disposal of Discarded Paper Containing PHI. On occasion, when copying or faxing documents containing PHI, additional copies are made which are not subject to a retention schedule (because they are copies, not originals) and which may be disposed of immediately after the purpose for which they were made has been fulfilled. Such paper copies may be disposed of in recycle bins or waste receptacles only as described below: 1. Unsecured recycle bins/waste receptacles should be located in areas where the public will not be able to access them. 2. When possible, dispose of paper waste containing PHI in receptacles that are secured by locking mechanisms or that are located behind locked doors after regular business hours. Locked containers must be used with copy machines located in insecure or unattended areas. 3. Paper documents containing PHI may be placed in recycle bins/waste receptacles as described above only if the paper in such bins or receptacles will be disposed of in a manner that leaves no possibility for reconstruction of the information as described in the chart in III.G. above. J. The methods of destruction/disposal will be reassessed periodically, based on current technology, accepted practices, and availability of timely and costeffective destruction/disposal services.
5 Page 5 of 6 IV. Documentation Requirements A record of all destruction/disposal of original medical/client records or other original documents containing PHI will be made and retained permanently as described in III.E. above using a form substantially similar to the Sample Certificate of Destruction form available at hipaa.wisc.edu. V. Forms Sample Certificate of Destruction VI. References Wisconsin Statutes (Disposal of records) Wisconsin Statutes (Disposition of records-cease practice) Wisconsin Statutes (Fetal tracings) 45 CFR (c) (HIPAA Privacy Rule) VII. Related Policies Policy Number 6.1 Managing Arrangements with Business Associates of the University of Wisconsin-Madison Policy Number 8.5 Security of Faxed, Printed, and Copied Documents VIII. For Further Information For further information concerning this policy, please contact the UW-Madison HIPAA Privacy Officer or the appropriate unit HIPAA Privacy Coordinator or sub-coordinator. Contact information is available within the Contact Us tab at hipaa.wisc.edu. Reviewed By Chancellor Chancellor s Task Force on HIPAA Privacy UW-Madison HIPAA Privacy Officer UW-Madison Office of Legal Affairs
6 Page 6 of 6 Approved By Interim HIPAA Privacy and Security Operations Committee
Record Custodian to Health Information Steward Best Practices in Record Retention, Storage, and Destruction
Record Custodian to Health Information Steward Best Practices in Record Retention, Storage, and Destruction Indian Health Services Health Information Management Meeting Sharon Lewis, MBA, RHIA, CHPS, CPHQ
University of Wisconsin-Madison Policy and Procedure
Page 1 of 14 I. Policy II. A. The, the units of the UW-Madison Health Care Component and each individual or unit within UW-Madison that is a Business Associate of a covered entity (hereafter collectively
HIPAA Training for Hospice Staff and Volunteers
HIPAA Training for Hospice Staff and Volunteers Hospice Education Network Objectives Explain the purpose of the HIPAA privacy and security regulations Name three patient privacy rights Discuss what you
UNIVERSITY OF MASSACHUSETTS RECORD MANAGEMENT, RETENTION AND DISPOSITION POLICY
DOC. T99-061 Passed by the BoT 8/4/99 UNIVERSITY OF MASSACHUSETTS RECORD MANAGEMENT, RETENTION AND DISPOSITION POLICY The President of the University shall adopt guidelines to require that each campus
HIPAA Training for Staff and Volunteers
HIPAA Training for Staff and Volunteers Objectives Explain the purpose of the HIPAA privacy, security and breach notification regulations Name three patient privacy rights Discuss what you can do to help
BUSINESS ASSOCIATE AGREEMENT Tribal Contract
DEPARTMENT OF HEALTH SERVICES Division of Enterprise Services F-00714 (08/2013) STATE OF WISCONSIN BUSINESS ASSOCIATE AGREEMENT Tribal Contract This Business Associate Agreement is made between the Wisconsin
PRIVACY AND INFORMATION SECURITY INCIDENT REPORTING
PRIVACY AND INFORMATION SECURITY INCIDENT REPORTING PURPOSE The purpose of this policy is to describe the procedures by which Workforce members of UCLA Health System and David Geffen School of Medicine
SOUTHWEST VIRGINIA COMMUNITY COLLEGE RECORDS MANAGEMENT POLICY
SOUTHWEST VIRGINIA COMMUNITY COLLEGE RECORDS MANAGEMENT POLICY Statement of Intent This policy establishes the general responsibilities for management, retention, and disposition of SOUTHWEST VIRGINIA
RETENTION OF UNIVERSITY RECORDS
RETENTION OF UNIVERSITY RECORDS Policy Statement Northwestern University and various federal and state laws require that different types of records be retained for specific periods of time. The University
HIPAA Compliance (DSHS and HCA) Preamble: This section of the Contract is the Business Associate Agreement as
HIPAA Compliance (DSHS and HCA) Preamble: This section of the Contract is the Business Associate Agreement as required by HIPAA. 1. Definitions. a. Business Associate, as used in this Contract, means the
HIPAA Security. Jeanne Smythe, UNC-CH Jack McCoy, ECU Chad Bebout, UNC-CH Doug Brown, UNC-CH
HIPAA Security Jeanne Smythe, UNC-CH Jack McCoy, ECU Chad Bebout, UNC-CH Doug Brown, UNC-CH What is this? Federal Regulations August 21, 1996 HIPAA Became Law October 16, 2003 Transaction Codes and Identifiers
The second section of the HIPAA Security Rule is related to physical safeguards. Physical safeguards are physical measures, policies and procedures
The second section of the HIPAA Security Rule is related to physical safeguards. Physical safeguards are physical measures, policies and procedures to protect and secure a covered entity s electronic information
RUTGERS POLICY. Approval Authority: Executive Vice President for Academic Affairs and Senior Vice President for Administration
RUTGERS POLICY Section: 30.4.5 Section Title: Business Services Policy Name: Records Management Formerly Book: Formerly Policy 50.3.10 Approval Authority: Executive Vice President for Academic Affairs
Approved By: Agency Name Management
Policy Title: Effective Date: Revision Date: Approval(s): LASO: CSO: Agency Head: Media Protection Policy Every 2 years or as needed Purpose: The intent of the Media Protection Policy is to ensure the
Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. [email protected] www.uslegalsupport.com
Heather L. Hughes, J.D. HIPAA Privacy Officer U.S. Legal Support, Inc. [email protected] www.uslegalsupport.com HIPAA Privacy Rule Sets standards for confidentiality and privacy of individually
Managing Records: Retention, Destruction and Disposal
Managing Records: Retention, Destruction and Disposal Presentation by Jennifer L. Cox, J.D. Cox & Osowiecki, LLC Hartford, CT April 10, 2014 Today s Program Identify the universe of records involved Distinguish
NCI-Frederick Safety and Environmental Compliance Manual 03/2013
E-1. Records Management I. Scope The Records Management Office maintains a comprehensive records management system meeting regulatory and contractual requirements ensuring documentation is readily accessible.
POLICY AND GUIDELINES FOR THE MANAGEMENT OF ELECTRONIC RECORDS INCLUDING ELECTRONIC MAIL (E-MAIL) SYSTEMS
POLICY AND GUIDELINES FOR THE MANAGEMENT OF ELECTRONIC RECORDS INCLUDING ELECTRONIC MAIL (E-MAIL) SYSTEMS 1. Purpose Establish and clarify a records management policy for municipal officers with respect
FRONTIER REGIONAL/UNION#38 SCHOOL DISTRICTS. Records Retention Policy for Electronic Correspondence
EH I. Introduction FRONTIER REGIONAL/UNION#38 SCHOOL DISTRICTS Records Retention Policy for Electronic Correspondence All business conducted by government agencies are subject to the Public Records law
This policy is not designed to use systems backup for the following purposes:
Number: AC IT POL 003 Subject: Backup and Restore Policy 1. PURPOSE The backup and restore policy establishes the need and rules for performing periodic system backup to permit timely restoration of Africa
Media Disposition and Sanitation Procedure
Media Disposition and Sanitation Procedure Revision History Version Date Editor Nature of Change 1.0 11/14/06 Kelly Matt Initial Release Table of Contents 1.0 Overview... 1 2.0 Purpose... 1 3.0 Scope...
Montana Local Government Records Management Guidelines
Montana Local Government Records Management Guidelines Prepared and Published by the Montana Local Government Records Committee Rev 3.0 Sep 2010 TABLE OF CONTENTS Introduction i Authority...ii Definitions...
California State University, Sacramento INFORMATION SECURITY PROGRAM
California State University, Sacramento INFORMATION SECURITY PROGRAM 1 I. Preamble... 3 II. Scope... 3 III. Definitions... 4 IV. Roles and Responsibilities... 5 A. Vice President for Academic Affairs...
LSUHSC-NEW ORLEANS RECORDS RETENTION AND DISPOSITION POLICY
LSUHSC-NEW ORLEANS RECORDS RETENTION AND DISPOSITION POLICY PURPOSE The purpose of this document is to establish a policy on records retention and disposition, for records in both electronic and hardcopy
SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)
UNIVERSITY OF PITTSBURGH POLICY SUBJECT: SECURITY OF ELECTRONIC MEDICAL RECORDS COMPLIANCE WITH THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) DATE: March 18, 2005 I. SCOPE This
Page 1. NAOP HIPAA and Privacy Risks 3/11/2014. Privacy means being able to have control over how your information is collected, used, or shared;
Page 1 National Organization of Alternative Programs 2014 NOAP Educational Conference HIPAA and Privacy Risks Ira J Rothman, CPHIMS, CIPP/US/IT/E/G Senior Vice President - Privacy Official March 26, 2014
Electronic Records Management in the City of Philadelphia
Electronic Records Management in the City of Philadelphia I. Introduction II. Issues for Managing Electronic Records III. Records Management Officer's Responsibilities IV. Electronic Records Management
SOUTHWEST VIRGINIA COMMUNITY COLLEGE RECORDS MANAGEMENT PROGRAM. Revised January 15, 2014
SOUTHWEST VIRGINIA COMMUNITY COLLEGE RECORDS MANAGEMENT PROGRAM Revised January 15, 2014 Page 1 Introduction In compliance with the Code of Virginia, Section 42.1085, Southwest Virginia Community College
Statement of Policy. Reason for Policy
Table of Contents Statement of Policy 2 Reason for Policy 2 HIPAA Liaison 2 Individuals and Entities Affected by Policy 2 Who Should Know Policy 3 Exclusions 3 Website Address for Policy 3 Definitions
Get rid of it Securely to keep it Private
Get rid of it Securely to keep it Private Best Practices for the Secure Destruction of Personal Health Information Information and Privacy Commissioner, National Association for Information Destruction,
8.03 Health Insurance Portability and Accountability Act (HIPAA)
Human Resource/Miscellaneous Page 1 of 5 8.03 Health Insurance Portability and Accountability Act (HIPAA) Policy: It is the policy of Licking/Knox Goodwill Industries, Inc., to maintain the privacy of
Montclair State University. HIPAA Security Policy
Montclair State University HIPAA Security Policy Effective: June 25, 2015 HIPAA Security Policy and Procedures Montclair State University is a hybrid entity and has designated Healthcare Components that
How To Write A Health Care Security Rule For A University
INTRODUCTION HIPAA Security Rule Safeguards Recommended Standards Developed by: USF HIPAA Security Team May 12, 2005 The Health Insurance Portability and Accountability Act (HIPAA) Security Rule, as a
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement ("BA AGREEMENT") supplements and is made a part of any and all agreements entered into by and between The Regents of the University
Information Technology Services Guidelines
Page 1 of 10 Table of Contents 1 Purpose... 2 2 Entities Affected by These Guidelines... 2 3 Definitions... 3 4 Guidelines... 5 4.1 Electronic Sanitization and Destruction... 5 4.2 When is Sanitization
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( BAA ) is effective ( Effective Date ) by and between ( Covered Entity ) and Egnyte, Inc. ( Egnyte or Business Associate ). RECITALS
PHI- Protected Health Information
HIPAA Policy 2014 The Health Insurance Portability and Accountability Act is a federal law that protects the privacy and security of patients health information and grants certain rights to patients. Clarkson
Valdosta Technical College. Information Security Plan
Valdosta Technical College Information Security 4.4.2 VTC Information Security Description: The Gramm-Leach-Bliley Act requires financial institutions as defined by the Federal Trade Commision to protect
MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10)
MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) TERMS AND CONDITIONS FOR BUSINESS ASSOCIATES
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) TERMS AND CONDITIONS FOR BUSINESS ASSOCIATES I. Overview / Definitions The Health Insurance Portability and Accountability Act is a federal law
Technical Safeguards is the third area of safeguard defined by the HIPAA Security Rule. The technical safeguards are intended to create policies and
Technical Safeguards is the third area of safeguard defined by the HIPAA Security Rule. The technical safeguards are intended to create policies and procedures to govern who has access to electronic protected
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy Amended as of February 12, 2010 on the authority of the HIPAA Privacy Officer for Creative Solutions in Healthcare, Inc. TABLE OF CONTENTS ARTICLE
Client Advisory October 2009. Data Security Law MGL Chapter 93H and 201 CMR 17.00
Client Advisory October 2009 Data Security Law MGL Chapter 93H and 201 CMR 17.00 For a discussion of these and other issues, please visit the update on our website at /law. To receive mailings via email,
Moving Information: Privacy & Security Guidelines
Information and Privacy Commissioner/ Ontario Moving Information: Privacy & Security Guidelines Ann Cavoukian, Ph.D. Commissioner July 1997 Information and Privacy Commissioner/Ontario 2 Bloor Street East
HIPAA Security Alert
Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information
HIPAA Business Associate Agreement
HIPAA Business Associate Agreement User of any Nemaris Inc. (Nemaris) products or services including but not limited to Surgimap Spine, Surgimap ISSG, Surgimap SRS, Surgimap Office, Surgimap Ortho, Surgimap
Gramm Leach Bliley Act. GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007
Gramm Leach Bliley Act 15 U.S.C. 6801-6809 6809 GLBA/HIPAA Information Security Program Committee GLBA, Safeguards Rule Training, Rev. 7/1/2007 1 Objectives for GLBA Training GLBA Overview Safeguards Rule
HIPAA Security. assistance with implementation of the. security standards. This series aims to
HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 2. Security Standards - Administrative Safeguards 3. Security Standards - Physical Safeguards 4. Security Standards - Technical
That s why outsourcing using a Qualified Contractor is the best solution to the problem of assuring a compliant hard drive destruction audit trail.
Why Zak Enterprises? Information contained on the hard drives of retired computers must be destroyed properly. Failure to do so can result in criminal penalties including fines and prison terms up to 20
This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in
This presentation focuses on the Healthcare Breach Notification Rule. First published in 2009, the final breach notification rule was finalized in the HIPAA Omnibus Rule of 2013. As part of the American
Blocal government bulletin b
Electronic Records Standards and Procedures Blocal government bulletin b july 1998 Comments or complaints regarding the programs and services of the Texas State Library and Archives Commission may be addressed
BUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement (the "Agreement") is made and entered into this day of,, by and between Quicktate and idictate ("Business Associate") and ("Covered Entity").
HIPAA Policy, Protection, and Pitfalls ARTHUR J. GALLAGHER & CO. BUSINESS WITHOUT BARRIERS
HIPAA Policy, Protection, and Pitfalls Overview HIPAA Privacy Basics What s covered by HIPAA privacy rules, and what isn t? Interlude on the Hands-Off Group Health Plan When does this exception apply,
Subject: U.S. Department of Housing and Urban Development (HUD) Privacy Protection Guidance for Third Parties
U.S. Department of Housing and Urban Development Office of Public and Indian Housing SPECIAL ATTENTION OF: NOTICE PIH-2014-10 Directors of HUD Regional and Field Offices of Public Housing; Issued: April
C.T. Hellmuth & Associates, Inc.
Technical Monograph C.T. Hellmuth & Associates, Inc. Technical Monographs usually are limited to only one subject which is treated in considerably more depth than is possible in our Executive Newsletter.
Guidance on Personal Data Erasure and Anonymisation 1
Guidance on Personal Data Erasure and Anonymisation Introduction Data users engaged in the collection, holding, processing or use of personal data must carefully consider how to erase such personal data
The guidance applies to all records, regardless of the medium in which they are held, including e-mail, spreadsheets, databases and paper files.
Best Practice in Disposing of Records For whom is this guidance intended? This guidance is intended for all University staff that need to dispose of records, on an occasional or regular basis. It is likely
Developing a Records Retention Program
Developing a Records Retention Program This site is intended to help you design and implement a records retention program for your organization. Here you will find a basic explanation of a records retention
SAMPLE TEMPLATE. Massachusetts Written Information Security Plan
SAMPLE TEMPLATE Massachusetts Written Information Security Plan Developed by: Jamy B. Madeja, Esq. Erik Rexford 617-227-8410 [email protected] Each business is required by Massachusetts law
Best Practices for Responsible Disposal of Tape Media
Best Practices for Responsible Disposal of Tape Media The Environmental and Economic Benefits of Recycling vs. Destruction White Paper The Data Media Source San Jose, CA Data Media Source 2006 For use
Appendix 4-2: Sample HIPAA Security Risk Assessment For a Small Physician Practice
Appendix 4-2: Administrative, Physical, and Technical Safeguards Breach Notification Rule How Use this Assessment The following sample risk assessment provides you with a series of sample questions help
M E M O R A N D U M. Revised Information Technology Security Procedures INFORMATION TECHNOLOGY SECURITY PROCEDURES. I. General
M E M O R A N D U M To: From: IT Steering Committee Brian Cohen Date: March 26, 2009 Subject: Revised Information Technology Security Procedures The following is a revised version of the Information Technology
BUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT (this Agreement ), effective as of May 1, 2014 (the Effective Date ), by and between ( Covered Entity ) and Orchard Software Corporation,
Model Business Associate Agreement
Model Business Associate Agreement Instructions: The Texas Health Services Authority (THSA) has developed a model BAA for use between providers (Covered Entities) and HIEs (Business Associates). The model
How To Manage Records And Information Management In Alberta
8. RECORDS AND INFORMATION MANAGEMENT Overview This chapter is intended to help public bodies understand how good records and information management practices assist in the effective administration of
Business Associate Agreement
Business Associate Agreement This BUSINESS ASSOCIATE AGREEMENT (the "Agreement") is entered into by and between the Board of Regents of the University of Wisconsin System on behalf of the [insert name
ACCESS, PRODUCTION AND RETENTION OF CITY RECORDS
1.05-3 1 of 6 I. PURPOSE This directive prescribes the rules regarding access, production, and retention of City records. II. POLICY A. All records and other matters in City offices are presumed to be
United Cerebral Palsy of Greater Chicago Records and Information Management Policy and Procedures Manual, December 12, 2008
United Cerebral Palsy of Greater Chicago Records and Information Management Policy and Procedures Manual, December 12, 2008 I. Introduction United Cerebral Palsy of Greater Chicago ( UCP ) recognizes that
How To Destroy Data From A Hard Drive
Safe, Secure and Certified Data Destruction Solutions to meet your individual needs Whether you require data destruction supplementary or exclusively to our IT disposal solution, our fully security screened
Information and Privacy Commissioner of Ontario. Guidelines for the Use of Video Surveillance Cameras in Public Places
Information and Privacy Commissioner of Ontario Guidelines for the Use of Video Surveillance Cameras in Public Places Ann Cavoukian, Ph.D. Commissioner September 2007 Acknowledgements This publication
Records & Information Management Policy
2014 Records & Information Management Policy VerQu CONTENTS Document Control... 2 Purpose... 3 Scope... 3 Organizational Placement... 3 Roles and Responsibilities... 3 Corporate Records Manager... 3 Record
HIPAA Compliance: Are you prepared for the new regulatory changes?
HIPAA Compliance: Are you prepared for the new regulatory changes? Baker Tilly CARIS Innovation, Inc. April 30, 2013 Baker Tilly refers to Baker Tilly Virchow Krause, LLP, an independently owned and managed
Administrators Guide Multi User Systems. Calendar Year
Calendar Year 2012 Enter Facility Name Here HIPAA Security Compliance Workbook For Core Measure 15 of Meaningful Use Requirements Annual Risk Analysis Administrators Guide Multi User Systems 1 HIPPA Compliance
BUSINESS ASSOCIATE AGREEMENT
BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT ( Agreement ) by and between OUR LADY OF LOURDES HEALTH CARE SERVICES, INC., hereinafter referred to as Covered Entity, and hereinafter referred
HIPAA Compliance Evaluation Report
Jun29,2016 HIPAA Compliance Evaluation Report Custom HIPAA Risk Evaluation provided for: OF Date of Report 10/13/2014 Findings Each section of the pie chart represents the HIPAA compliance risk determinations
BAC to the Basics: Business Associate Contracts Made Easy
BAC to the Basics: Business Associate Contracts Made Easy Prepared by Jen C. Salyers BAC to the Basics: Business Associate Contracts Made Easy Table of Contents Page I. Approaches to Creating a Business
BUSINESS ASSOCIATE AGREEMENT HIPAA Protected Health Information
BUSINESS ASSOCIATE AGREEMENT HIPAA Protected Health Information I. PREAMBLE ( Covered Entity ) and ( Business Associate ) (jointly the Parties ) wish to enter into an Agreement to comply with the requirements
E-mail Management: A Guide For Harvard Administrators
E-mail Management: A Guide For Harvard Administrators E-mail is information transmitted or exchanged between a sender and a recipient by way of a system of connected computers. Although e-mail is considered
NC DPH: Computer Security Basic Awareness Training
NC DPH: Computer Security Basic Awareness Training Introduction and Training Objective Our roles in the Division of Public Health (DPH) require us to utilize our computer resources in a manner that protects