Security Incident Procedures

Assigned Security Responsibility

Access Control

Facility Access Controls

Security Management Process

Title IX: Employer sponsored group health plans.

Title III: Tax-related Health Provisions.

Title II: Administrative Simplification.

Title I: Health Care Insurance Access, Portability, and Renewability.

Title V: Revenue Offsets.

A covered entity must designate, and document, a privacy official, security officer and a HIPAA compliance officer

A covered entity must designate, and document, the same person to be both privacy official and as the contact person responsible for receiving complaints and providing further information about the notice required by the regulations.

A covered entity must implement and maintain written or electronic policies and procedures with respect to PHI that are designed to comply with HIPM standards, implementation specifications and other requirements.

A covered entity must train, and document the training of, at least one member of its workforce on the policies and procedures with regard to PHI as necessary and appropriate for them to carry out their function within the covered entity no later than the privacy rule compliance date

A covered entity must retain the document required by the regulations for a period often years from the time of it's creation or the time it was last in effect, which ever is later.

Risk Analysis

Risk Management

Access Establishment and Modification

Isolating Health care Clearinghouse Function

Information System Activity Review

Covered entities that violate the standards or implementation specifications will be subjected to civil penalties of up to $100 per violation except that the total amount imposed on any one person in each calendar year may not exceed $25,000 for violations of one requirement

Criminal penalties for non-compliance are fines up to $65,000 and one year in prison for each requirement or prohibition violated

Criminal penalties for willful violation are fines up to $50,000 and one year in prison for each requirement or prohibition violated.

Criminal penalties for violations committed under “false pretenses” are fines up to $100,000 and five years in prison for each requirement or prohibition violated

Criminal penalties for violations committed with the intent to sell, transfer, or use PHI for commercial advantage, personal gain or malicious harm are fines up to $250,000 and ten years in prison for each requirement or prohibition violated

Encrypted communication between patient and provider.

All patient events.

Security.

Benefits inquiry.

Emergency treatment.

All Employers.

The Washington Publishing Company

Disclosure of non-identifiable demographics.

Oral disclosure of PHI.

The prevention of use of de-identified information.

Detail specifically all activities that are considered a use or disclosure.

Describe in plain language what is meant by treatment, payment, and health care operations (TPO)

Inform the individual that protected health information (PHI) may only be used for valid medical research.

Inform the individual that this version of the Notice will always cover them, regardless of subsequent changes.

State the expiration date of the Notice.