HIPAA Privacy Policy

1. PURPOSE

[List the objectives for this privacy policy.]

1. SCOPE
2. This policy applies to all organization’s employees, management, contractors, student interns, and volunteers.
3. This policy describes the organization’s objectives and policies regarding maintaining the privacy of patient information.
4. [If your organization is exempt, discuss your organization’s desire to become compliant as a “trusted partner” of HIPAA-covered entities.]
5. REFERENCES [Below, list your organization’s policies, procedures, and statements that affect the privacy and confidentiality of client health information. To delete this text, click it and then press Delete.]
6. [Policy, procedure, or statement]
7. [Policy, procedure, or statement]
8. [Policy, procedure, or statement]
9. [Policy, procedure, or statement]
10. [Policy, procedure, or statement]
11. [Policy, procedure, or statement]
12. [List other organization policies or procedures that address the management of client health information.]
13. DEFINITIONS [Below, list terms and definitions relevant to HIPAA privacy policy for your organization. To delete this text, click it and then press Delete.]

Term:  [Term #1]

Definition:  [Definition #1]

Term:  [Term #2]

Definition:  [Definition #2]

Term:  [Term #3]

Definition:  [Definition #3]

Term:  [Term #4]

Definition:  [Definition #4]

1. RESPONSIBILITIES
2. Executives/Management

1)       Establish program objectives

2)       Approve privacy policy

3)       Provide training for work force

4)       Enforce sanctions

5)       Designate Privacy Official

1. Privacy Official

1)       Develops privacy policies and procedures

2)       Coordinates and implements policy through organization’s departments

3)       Oversees training

4)       Receives and processes privacy complaints

5)       Processes individual rights requests

a)       Right to access/copy protected health information (PHI)

b)       Right to amend PHI

c)       Right to restrict use/disclosure

d)       Right to confidential communications

e)       Right to an accounting of disclosures

f)        Right to file a complaint

6)       Ensures retention of HIPAA policies and procedures, complaints, and investigative materials to meet compliance requirements.

1. Legal Counsel (or Privacy Official)

1)       Processes Business Associate Agreements (BAA)

a)       Conducts business associate inventory

b)       Develops and coordinates BAA template

c)       Conducts annual review/update

1. Corporate Compliance Officer

1)       Assists in development and execution of the HIPAA Privacy Policy and promulgation of operating procedures

2)       Assists and supports the Privacy Official

3)       Provides support for HIPAA compliance activities

1. Medical Records Director

1)       Implements organization’s privacy policy for medical records

2)       Provides administrative and physical safeguards for the protection of client health information

1. Director, Training

1)       Develops and implements privacy training program as described in Section 11 of this policy

2)       Documents the delivery of privacy training to all work force members

1. Employee responsibilities

1)       Understand and comply with organization’s policies regarding patient confidentiality and privacy

1. DESIGNATED RECORD SET [Below, define the PHI repositories in your organization. To delete this text, click it and then press Delete.]
2. [Repository]
3. [Repository]
4. [Repository]
5. NOTICE OF PRIVACY PRACTICES (NPP) [Below, list your organization’s policy and approach to developing and issuing an NPP to patients. To delete this text, click it and then press Delete.]
6. [Policy and approach]
7. [Policy and approach]
8. The organization will make a “best effort” attempt to receive acknowledgment of receipt of NPP from each patient and document such in the patient’s medical record.
9. MINIMUM NECESSARY POLICY [Below, list your organization’s policy for limiting access and distribution of PHI based on the minimum necessary to permit essential business functions to operate. To delete this text, click it and then press Delete.]
10. [Policy]
11. [Policy]
12. [Policy]
13. USE AND/OR DISCLOSURE OF PROTECTED HEALTH INFORMATION
14. Routine uses:  [Describe organization’s routine uses of PHI. This should correspond to the uses cited in NPP.]

1)       Treatment, Payment and Operations:  [Describe organization’s functions for which authorization is not required.]

1. Process for disclosing client information:  [Describe organization’s process for allowing external disclosure of client information.]
2. Personal representatives

1)       [Describe how organization determines or identifies a Personal Representative.]

2)       Minors’ rights:  [Reference the specific state law that grants to minors their rights to access their PHI.]

1. INDIVIDUAL RIGHTS [Below, list your organization’s procedures for handling individual HIPAA rights requests. To delete this text, click it and then press Delete.]
2. Right to access/copy PHI:  [Procedure]
3. Right to amend PHI:  [Procedure]
4. Right to restrict use or disclosure:  [Procedure]
5. Right to confidential communications:  [Procedure]
6. Right to an accounting of disclosures:  [Procedure]
7. Right to file a complaint:  [Procedure]
8. SAFEGUARDS FOR THE PROTECTION OF PHI [Below, list the safeguards your organization has put in place for the protection of PHI. To delete this text, click it and then press Delete.]
9. Administrative safeguards:  [Safeguard]
10. Physical safeguards:  [Safeguard]
11. Technical safeguards:  [Safeguard]
12. WORK FORCE TRAINING
13. [Describe your organization’s privacy training program.]

1)       New staff member training:  [Describe the training program]

2)       Recurrent training:  [Describe the training program]

3)       Special function training:  [Describe the training program]

1. [Identify privacy training program content.]
2. BUSINESS ASSOCIATE AGREEMENTS
3. [Describe your organization’s process for developing and executing Business Associate Agreements (BAA).]
4. EMPLOYEE COMPLAINTS
5. [Describe the process for employee-generated privacy complaints regarding your organization’s policies and processes for managing PHI]
6. SANCTIONS
7. [State your organization’s policy for addressing employee violations of its privacy policy.]