LII:HIPAA Compliance - LII 007 05. Administration

Previous lessons in the Laboratory Informatics Institute HIPAA Compliance series have dealt with explaining what HIPAA is, who it applies to, what data are protected and how the Protected Health Information (PHI) of individuals must be handled, according to HIPAA generally and the Privacy Rule. Implications for administration of HIPAA and how it applies to and affects healthcare organizations and administrative departments are also important to understand.

Requirements and Recommendations

Administratively, there are a few things to keep in mind when seeking to comply with HIPAA, according to the HHS:

Privacy Policies and Procedures

A covered entity must develop and implement written privacy policies and procedures that are consistent with the Privacy Rule.

Privacy Personnel

A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or contact office responsible for receiving complaints and providing individuals with information on the covered entity’s privacy practices.

Workforce Training and Management

Workforce members include employees, volunteers, trainees, and may also include other persons whose conduct is under the direct control of the entity (whether or not they are paid by the entity).66 A covered entity must train all workforce members on its privacy policies and procedures, as necessary and appropriate for them to carry out their functions.67 A covered entity must have and apply appropriate sanctions against workforce members who violate its privacy policies and procedures or the Privacy Rule.

Mitigation

A covered entity must mitigate, to the extent practicable, any harmful effect it learns was caused by use or disclosure of protected health information by its workforce or its business associates in violation of its privacy policies and procedures or the Privacy Rule.

Data Safeguards

A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure. For example, such safeguards might include shredding documents containing protected health information before discarding them, securing medical records with lock and key or pass code, and limiting access to keys or pass codes. See OCR “Incidental Uses and Disclosures” Guidance.

Complaints

A covered entity must have procedures for individuals to complain about its compliance with its privacy policies and procedures and the Privacy Rule.71 The covered entity must explain those procedures in its privacy practices notice.72 Among other things, the covered entity must identify to whom individuals can submit complaints to at the covered entity and advise that complaints also can be submitted to the Secretary of HHS.

Retaliation and Waiver

A covered entity may not retaliate against a person for exercising rights provided by the Privacy Rule, for assisting in an investigation by HHS or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates the Privacy Rule. A covered entity may not require an individual to waive any right under the Privacy Rule as a condition for obtaining treatment, payment, and enrollment or benefits eligibility.

Documentation and Record Retention

A covered entity must maintain, until six years after the later of the date of their creation or last effective date, its privacy policies and procedures, its privacy practices notices, disposition of complaints, and other actions, activities, and designations that the Privacy Rule requires to be documented.

Fully-Insured Group Health Plan Exception

The only administrative obligations with which a fully-insured group health plan that has no more than enrollment data and summary health information is required to comply are the (1) ban on retaliatory acts and waiver of individual rights, and (2) documentation requirements with respect to plan documents if such documents are amended to provide for the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO that services the group health plan.

• b. Organizational Options
  • i. Hybrid
  • ii. Affiliated
  • iii. Organized Healthcare Arrangement
  • iv. Covered Entities With Multiple Covered Functions
  • v. Group Health Plan disclosures to Plan Sponsors