SAMPLE HIPAA POLICIES, FORMS AND CONTRACTS FOR DD …

1 Franklin J. Hickman Janet L. Lowder David A. Myers Elena A. Lidrbauch Judith C. Saltzman Mary B. McKee Lisa Montoni Garvin Andrea Aycinena Penton Building 1300 East Ninth Street Suite 1020 Cleveland, OH 44114 Telephone (216) 861-0360 Fax (216) 861-3113 5062 Waterford Dr. Sheffield Village, OH 44035 Telephone (440) 323-1111 Fax (440)323-4284 Ohio Association of County Boards Serving People with DD, 2013. No copying or use without express permission from OACB. SAMPLE HIPAA policies , FORMS AND CONTRACTS FOR DD BOARDS AND COGS Franklin J. Hickman Elena A. Lidrbauch Andrea Aycinena August, 2013 SAMPLE HIPAA Privacy policies for DD Boards August, 2013 Ohio Association of County Boards Serving People with DD, 2013.

2 No copying or use without express permission from OACB. IMPORTANT NOTES: These SAMPLE policies , procedures , notices and CONTRACTS are intended as general guides. It is essential that each board review the SAMPLE carefully and adapt the document to meet the particular needs of the DD Board. This process should not occur without consulting with legal counsel for the DD Board. Note that this summary is focused on HIPAA and the relationship between HIPAA and applicable Ohio law. The summary is not intended to be a comprehensive set of confidentiality policies ; there is no discussion, for example, of the Federal Regulations on records of drug/alcohol diagnoses or treatment or disclosure of HIV. HIPAA requirements related to Research or marketing activities are not included in these materials. If you have general questions about these materials, call Hickman & Lowder at (216)861-0360.

3 For legal advice, consult counsel authorized to represent the DD Board. SAMPLE HIPAA Privacy policies for DD Boards August, 2013 Page i Ohio Association of County Boards Serving People with DD, 2013. No copying or use without express permission from OACB. TABLE OF CONTENTS TABLE OF CONTENTS .. i Module 1: DEFINITIONS USED IN policies .. 1 Applicable Requirements .. 1 Breach .. 1 Business Associate (BA) .. 1 Covered Entity .. 2 Council of Government (COG) .. 2 Designated Record Set .. 2 Disclosure .. 2 HCBS .. 2 Health Care Clearinghouse .. 3 Health Oversight Agency .. 3 Health Plan .. 3 HIPAA .. 3 ICF/IID .. 4 ISP .. 4 Minimum Necessary .. 4 MOU .. 4 Personal Representative .. 4 PHI .. 4 Provider .. 5 Public Health Authority .. 5 TCM .. 5 TPO .. 5 Unsecured PHI.

4 5 Use .. 6 Workforce Member .. 6 Module 2: GENERAL POLICY ON PRIVACY AND CONFIDENTIALITY .. 7 7 GENERAL POLICY .. 7 General Principles .. 7 Treatment, payment and health care operations .. 7 Scope of Disclosure: Minimum Necessary Standard .. 8 Incidental Uses and Disclosures .. 8 Changes in policies and procedures .. 8 Mitigation .. 9 Prohibition against Retaliation or Intimidation .. 9 Prohibition against Waiver of Rights .. 10 ADMINISTRATION .. 10 PERMISSIBLE USES AND DISCLOSURES .. 10 NOTICE .. 10 SAMPLE HIPAA policies , FORMS and CONTRACTS for DD Boards August, 2013 Page ii Ohio Association of County Boards of DD 2013. No copying or use without express permission from OACBDD. INDIVIDUAL RIGHTS .. 10 SAFEGUARDS FOR PHI .. 10 COMPLAINTS AND GRIEVANCES .. 10 SANCTIONS.

5 11 BUSINESS ASSOCIATES .. 11 DOCUMENT MANAGEMENT .. 11 Module 3: ADMINISTRATION .. 12 12 PRE-EMPTION ANALYSIS .. 12 POLICY ON PRIVACY OFFICER AND CONTACT PERSON FOR COMPLAINTS .. 12 Privacy Officer .. 12 HIPAA 12 Contact Person or Office .. 13 SAMPLE JOB DESCRIPTION FOR PRIVACY OFFICER .. 13 TRAINING OF WORKFORCE .. 15 Module 4: AUTHORIZATION .. 16 16 PRE-EMPTION ANALYSIS .. 16 POLICY ON AUTHORIZATIONS .. 17 procedures FOR AUTHORIZATIONS .. 17 General .. 17 Elements for Authorization .. 18 Conditioning services on authorization .. 19 Combining Authorizations .. 20 Right to revoke .. 20 Invalid authorizations .. 21 Verification .. 21 Document Management .. 21 SAMPLE AUTHORIZATION 22 Module 5: USES AND DISCLOSURES FOR WHICH NO RELEASE OR AUTHORIZATION IS REQUIRED.

6 24 24 PRE-EMPTION ANALYSIS .. 24 POLICY ON USES AND DISCLOSURES FOR WHICH NO RELEASE OR AUTHORIZATION IS REQUIRED .. 25 procedures ON USES AND DISCLOSURES FOR WHICH NO RELEASE OR AUTHORIZATION IS REQUIRED .. 26 When required by law .. 26 For public health purposes .. 26 To protect victims of abuse, neglect, or domestic violence .. 26 For health oversight activities such as investigations, audits, and inspections 27 For judicial and administrative proceedings .. 28 For law enforcement purposes .. 28 Fundraising .. 29 SAMPLE HIPAA policies , FORMS and CONTRACTS for DD Boards August, 2013 Page iii Ohio Association of County Boards of DD 2013. No copying or use without express permission from OACBDD. Record of Immunization .. 30 To coroners, medical examiners, and funeral directors.

7 30 Organ, eye or tissue 30 To reduce or prevent a serious threat to public health and safety .. 30 Specialized government functions .. 31 For workers compensation or other similar programs if applicable.. 32 Module 6: NOTICE .. 33 33 PRE-EMPTION ANALYSIS .. 33 POLICY ON NOTICES .. 33 procedures ON NOTICES .. 33 General .. 33 When notice is required .. 33 Acknowledgment of Notice .. 34 Making Notice Available .. 34 Required Content of Notice .. 34 Optional Content of Notice .. 37 Notice of Revisions .. 37 Requirements for Electronic Notice .. 37 Documentation .. 38 SAMPLE form FOR NOTICE .. 39 Module 7: INDIVIDUAL RIGHTS RELATED TO PHI .. 45 45 PRE-EMPTION ANALYSIS .. 45 Individual s right to access PHI .. 45 Individual s right to request restrictions .. 45 Individual s right to request amendment.

8 45 Individual s right to an accounting of disclosures of PHI .. 46 POLICY ON INDIVIDUAL S ACCESS TO PHI .. 46 procedures ON INDIVIDUAL S ACCESS TO PHI .. 46 General .. 46 form of access .. 46 Summary .. 47 Time for response to request for access .. 47 Fees for copying .. 47 Other responsibilities .. 47 POLICY ON INDIVIDUAL S RIGHT TO REQUEST RESTRICTIONS .. 47 procedures ON INDIVIDUAL S RIGHT TO REQUEST RESTRICTIONS 48 form of request .. 48 Consideration of request .. 48 Procedure upon agreement .. 48 Limitations on restrictions .. 48 Confidential communications requests .. 49 Terminating a restriction .. 49 SAMPLE HIPAA policies , FORMS and CONTRACTS for DD Boards August, 2013 Page iv Ohio Association of County Boards of DD 2013. No copying or use without express permission from OACBDD.

9 POLICY ON INDIVIDUAL S RIGHT TO REQUEST AMENDMENT OF RECORDS OF 49 procedures ON INDIVIDUAL S RIGHT TO REQUEST AMENDMENT OF RECORDS OF 49 Request for amendment .. 49 Time for action on request for amendment .. 50 Acceptance of amendment .. 50 Refusal of amendment .. 50 Actions on notices of amendment from another DD Board .. 51 Designation and Documentation .. 51 POLICY ON ACCOUNTING OF DISCLOSURES OF PHI .. 52 procedures ON ACCOUNTING OF DISCLOSURES OF PHI .. 52 General .. 52 Request for Accounting; fees .. 52 Content of Accounting .. 52 Accounting for Multiple Disclosures to Same Recipient .. 52 Time for Action on Request for Accounting .. 53 Designation and Documentation .. 53 Exceptions for Accounting Requirement .. 53 Module 8: NOTICE IN EVENT OF BREACH OF UNSECURED PHI.

10 54 54 PRE-EMPTION ANALYSIS .. 54 POLICY ON NOTICE OF BREACH .. 54 procedures .. 54 Presumption .. 54 Definition of a Breach .. 54 Definition of Unsecured PHI .. 55 Risk Assessment .. 55 Notice of Breach to Individuals .. 55 Method of Notice .. 56 a. Written notice.. 56 b. Substitute notice.. 56 Additional notice in urgent situations .. 57 Notice to Secretary of HHS .. 57 Notice to Media .. 57 Timeliness of Notice .. 57 Determination of time of discovery of breach .. 58 Module 9: SAFEGUARDS FOR 59 59 PRE-EMPTION ANALYSIS .. 59 POLICY ON SAFEGUARDS .. 59 procedures ON 59 Administrative procedures .. 59 Physical Safeguards .. 60 Personnel Security .. 60 SAMPLE HIPAA policies , FORMS and CONTRACTS for DD Boards August, 2013 Page v Ohio Association of County Boards of DD 2013.