HIPAA Privacy Checklist The following summarizes required and recommended privacy policies and forms per the HIPAA Privacy Rule. Additional policies are required by the HIPAA Security Rule. Covered entities and business associates should ensure that they have required policies in place to minimize or avoid penalties under the HIPAA regulations. The citations are to 45 CFR Part 164. For additional resources concerning Privacy Rule requirements and compliance assistance, see the Office of Civil Rights privacy website, http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/index.html. The Privacy Rule is subject to periodic amendment. Users should review the current rule requirements to ensure continued compliance. Policies HIPAA Privacy Rule Policy Status Reference (Complete, N/A) Use and Disclosure: General Rules Consent is implied for treatment, payment and health care 164.506 operations; no written authorization is required except for psychotherapy notes. Providing notice and chance for patient to agree or object is sufficient for certain disclosures, including disclosures 164.510 to family members or others involved in the patient’s care; for facility directories; and to provide notice in emergency situations. Certain disclosures may be made per regulatory exceptions subject to specific conditions, e.g., uses or 164.512 disclosures required by law; to avert a serious and imminent health; for public health activities; in response to a court order or subpoena; to law enforcement, etc. Authorizations are generally required for all other uses or disclosures, including uses or disclosures of 164.508 psychotherapy notes; for most marketing activities; sale of protected health information; etc. Include the elements for a valid authorization. Use and Disclosure: Special Rules Fund raising uses or disclosures generally require 164.514(f) authorization except in limited circumstances. Research generally requires authorization unless certain 164.512(i) conditions are met. Privacy protection continues after death for a period of 50 164.502(f) years. Personal representatives and parents of unemancipated 164.502(g) minors are generally entitled to access information and exercise other patient rights, subject to certain exceptions. Covered entities should verify a requesting person’s 164.514(h) identity and authority before disclosing information.
HIPAA Privacy Checklist The following summarizes required and recommended privacy policies and forms per the HIPAA Privacy Rule. Additional policies are required by the HIPAA Security Rule. Covered entities and business associates should ensure that they have required policies in place to minimize or avoid penalties under the HIPAA regulations. The citations are to 45 CFR Part 164. For additional resources concerning Privacy Rule requirements and compliance assistance, see the Office of Civil Rights privacy website, http://www.hhs.gov/ocr/privacy/hipaa/administrative/privacyrule/index.html. The Privacy Rule is subject to periodic amendment. Users should review the current rule requirements to ensure continued compliance. Policies HIPAA Privacy Rule Reference Policy Status (Complete, N/A) Use and Disclosure: General Rules 164.506 Consent is implied for treatment, payment and health care operations; no written authorization is required except for psychotherapy notes. 164.510 Providing notice and chance for patient to agree or object is sufficient for certain disclosures, including disclosures to family members or others involved in the patient’s care; for facility directories; and to provide notice in emergency situations. 164.512 Certain disclosures may be made per regulatory exceptions subject to specific conditions, e.g., uses or disclosures required by law; to avert a serious and imminent health; for public health activities; in response to a court order or subpoena; to law enforcement, etc. 164.508 Authorizations are generally required for all other uses or disclosures, including uses or disclosures of psychotherapy notes; for most marketing activities; sale of protected health information; etc. Include the elements for a valid authorization. Use and Disclosure: Special Rules 164.514(f) Fund raising uses or disclosures generally require authorization except in limited circumstances. 164.512(i) Research generally requires authorization unless certain conditions are met. 164.502(f) Privacy protection continues after death for a period of 50 years. 164.502(g) Personal representatives and parents of unemancipated minors are generally entitled to access information and exercise other patient rights, subject to certain exceptions. 164.514(h) Covered entities should verify a requesting person’s identity and authority before disclosing information.
HIPAA_Privacy_Checklist_HH.docx