Notification Requirements for Breaches of Unsecured Protected Health Information 164.402 Identifying when a breach occurs. 164.402 Securing protected health information. Notice to individuals, including timing, content, and 164.404 providing substitute notice. Notice to HHS, including annual and immediate notices to HHS, timing, and content. The HHS electronic reporting 164.408 process may be accessed through the HIPAA OCR’s website, http://www.hhs.gov/ocr/privacy/. 164.406 Notice to the media, including form, timing and content. Notice by business associates, including timing and 164.410 required information. 164.412 Delay in notice at request of law enforcement. Administrative Requirements 164.530(a) Designation of privacy offer and contact person. 164.530(b) Training existing and new members of the workforce. Use of technical, administrative, and physical safeguards 164.530(c) to avoid improper or incidental disclosures. Sanctions against workforce members for violation of 164.530(e) policies and regulations. Patient complaints, including the process for complaining 164.530(d) and responding to complaints. 164.530(f) Mitigation of improper disclosures. Correction of any violations within 30 days to avoid 160.410 penalties. No retaliation or intimidation against patients or others 164.530(g) who exercise HIPAA rights. 164.530(h) No conditioning treatment on a waiver of HIPAA rights. Document retention, including identifying documents that 164.530(i) must be retained and period of retention. Forms HIPAA Privacy Form Status Rule Reference (Complete, N/A) 164.520 Notice of privacy practices. 164.520 Acknowledgment of receipt of privacy practices. 164.504(e) Business associate contract. 164.514(e) Data use agreement (if used). Use and Disclosure Forms 164.508(c) Authorization 164.510 Objection to disclosure per 164.510. 164.514(f) Opt-out of fundraising. Patient Rights Forms
Notification Requirements for Breaches of Unsecured Protected Health Information 164.402 Identifying when a breach occurs. 164.402 Securing protected health information. 164.404 Notice to individuals, including timing, content, and providing substitute notice. 164.408 Notice to HHS, including annual and immediate notices to HHS, timing, and content. The HHS electronic reporting process may be accessed through the OCR’s HIPAA website, http://www.hhs.gov/ocr/privacy/. 164.406 Notice to the media, including form, timing and content. 164.410 Notice by business associates, including timing and required information. 164.412 Delay in notice at request of law enforcement. Administrative Requirements 164.530(a) Designation of privacy offer and contact person. 164.530(b) Training existing and new members of the workforce. 164.530(c) Use of technical, administrative, and physical safeguards to avoid improper or incidental disclosures. 164.530(e) Sanctions against workforce members for violation of policies and regulations. 164.530(d) Patient complaints, including the process for complaining and responding to complaints. 164.530(f) Mitigation of improper disclosures. 160.410 Correction of any violations within 30 days to avoid penalties. 164.530(g) No retaliation or intimidation against patients or others who exercise HIPAA rights. 164.530(h) No conditioning treatment on a waiver of HIPAA rights. 164.530(i) Document retention, including identifying documents that must be retained and period of retention. Forms HIPAA Privacy Rule Reference Form Status (Complete, N/A) 164.520 Notice of privacy practices. 164.520 Acknowledgment of receipt of privacy practices. 164.504(e) Business associate contract. 164.514(e) Data use agreement (if used). Use and Disclosure Forms 164.508(c) Authorization 164.510 Objection to disclosure per 164.510. 164.514(f) Opt-out of fundraising. Patient Rights Forms
HIPAA_Privacy_Checklist_HH.docx