Privacy & Security

• Disclosures for TPO & Imminent Threat
• HIPAA COW Telemedicine Policy

• Patient Right to Access, Inspect and Copy Protected Health Information
• Minors Privacy Right Access
• Provider Model Privacy Notice
• Provider Notice of Privacy Practice
• Charging for copies of PHI

Amendment 164.526

• Amendment Policy
• Amendment Form
• Sample Letters for Amendment Policy

• Consent for Disclosure of Patient PHI
• Validity of Patient Authorization
• Authorization Elements Grid
• WI Authorization Form
• Audio, Video and Photo Consent 10.1.17
• Issue of Requiring Authorization Forms to include Copy or Fax – Position Statement

• Sanction Policy 164.308(a)(1)(ii)(C)

• 2013 Omnibus Rule Version Breach Notification Policy – Compliance Date 9/23/13
• Privacy Officer Breach Notification Checklist

• 164.308(b)
• 164.314
• 164.504(e)
• HITECH Sections 13401(a), 13404, 13408

• BA Agreement Omnibus Rule
• Business Associate Agreement Policy/Procedure
• BA Training PPT

Contingency Plan 164.308(a)(7)

• Contingency Operations 164.310(a)(2)(i)
• Emergency Access Procedure 164.312(a)(2)(ii)

Contingency Planning Whitepaper 

• Accountability 164.310(d)(2)(iii)
• Data Backup and Storage 164.310(d)(2)(iv)
• Data Backup Plan 164.308(a)(7)(ii)(A)
• Device and Media Controls 164.310(d)
• Data Management
• Accountability 164.310(d)(2)(iii)
• Data Backup and Storage 164.310(d)(2)(iv)
• Data Backup Plan 164.308(a)(7)(ii)(A)
• Device and Media Controls 164.310(d)

Data Management & Backup

• Disposal 164.310(d)(2)(i)
• Media Re-use 164.310(d)(2)(ii)
• Portable Handheld Devices
• Removable Media

• Media Sanitization for Disposal or Reuse
• Portable Handheld Device Policy
• Removable Media Policy

• Access Control & Validation Procedures 164.310(a)(2)(iii)
• Facility Security Plan 164.310(a)(2)(ii)

Facility Access Policy

Facility Repairs and Maintenance

Fundraising Policy Doc

• 164.314(b)
• 164.504(f)

Plan Documents Policy

• Access Control 164.312(a)(1)
• Access Establishment and Modification 164.308(a)(4)(ii)(C)
• Authorization and/or Supervision 164.308(a)(3)(ii)(A)
• Automatic Logoff 164.312(a)(2)(iii)
• Isolating Healthcare Clearinghouse Function 164.308(a)(4)(ii)(A)
• Password Management 164.308(a)(5)(ii)(D)
• Person or Entity Authentication 164.312(d)
• Termination Procedures 164.308(a)(3)(ii)(C)
• Unique User Identification 164.312(a)(2)(i)
• Workforce Clearance Procedure 164.308(a)(3)(ii)(B)
• Workforce Security 164.308(a)(3)(i)
• Workstation Use 164.310(b)

• System Access Policy
• Remote Access Policy
• Information Blocking Roadmap/Decision Tracker Template

• HIPAA & Wisconsin Law Enforcement
• Drug Seeking Behavior Whitepaper
• 2016 Privacy Rule Modification—Firearms Safety
• Use of Body Cameras by Law Enforcement

• Minimum Necessary Training PPT
• Minimum Necessary Doc

• Notice of Privacy Acknowledgement
• Privacy Notice Policy – Payer
• Model Privacy Notice – Payer
• Patient Privacy Rights – Policy
• Patient Privacy Rights – PowerPoint

Occupational Health Whitepaper 4-15-13

Policies & Procedures

• Privacy 164.530(i)
• Security 164.316

• Example Policy & Procedure Template
• HIPAA Security Policy and Procedure Checklist
• Security Standards and Associated P&Ps

• Part 160 Subpart B

• Preemption Analysis Supplement Definitions
• Preemption – WI 146 Pdf
• Preemption – WI 51.30 Pdf
• Preemption – WI 252 Pdf
• Preemption – 256.15(12): Ambulance Records Preemption Analysis
• Preemption Matrix (Payer) Doc
• HIPAA Harmonization Guidance WHIMA

HIPAA Implementation & Oversight

Remote Access Policy Document

• 164.308 (a)(1)(ii)(A) and (B)
• Evaluation 164.308(a)(8)
• Meaningful Use – CMS EHR Incentive program
• Protect Electronic Health Information Requirements
• Safeguards – Administrative 164.306
• Safeguards – Physical 164.310

• Risk Management Policy Doc
• Risk Toolkit Guide
• Risk Assessment Template
• Privacy, Security, & Meaningful Use Questions to Ask Vendors Doc

Security Incident Procedures 164.308(a)(6)

• Security Management Process 164.308(a)(1)(i)

Security Incident Response

Also Refer to Breach Notification Section

• General Rules 164.306
• Policies & Procedures & Documentation Requirements 164.316
• Security Awareness and Training 164.308(a)(5)(i)
• Security Reminders 164.308(a)5)(ii)(A)
• Sanction Policy 164.308(a)(1)(ii)(C)

• HIPAA Security Oversight Policy
• Security Benchmarking Whitepaper
• Cyber Hygiene Guidelines

Technical Access Control:

• Encryption 164.312(e)(2)(ii)
• Encryption and Decryption 164.312(a)(2)(iv)
• Integrity 164.312(c)
• Integrity Controls 164.312(e)(2)(i)
• Transmission Security 164.312(e)(1)

Encryption Whitepaper

Training

• 164.530(b)(1)
• 164.308(a)(5)

Treatment Uses and Disclosures 164.506

Position Statement: Disclosing of PHI for Treatment Purposes

Verification of Identity 164.514(h)

Identity Verification

Workers Compensation 164.512(l)

Workers Compensation