HIPAA Privacy

HIPAA

HIPAA Privacy Compliance

Not compliant

HIPAA Overall

HIPAA Compliance

Authorization Form

An Authorization Form is created with all required elements, including a description of the protected health information to be used and disclosed, the person authorized to make the use or disclosure, the person to whom the covered entity may make the disclosure, an expiration date, and, in some cases, the purpose for which the information may be used or disclosed.

Read more: HIPAA Authorizations FAQ, What is the Difference Between Consent and Authorization?, HIPAA Forms

Written policies and procedures are in place requiring that an Authorization form is completed and signed by the patient for all marketing, research disclosures, and non-TPO (treatment, payment, health care operations) related disclosures.

Read more: What Is Required When Disposing of Protected Health Information?, HIPAA Forms, When Is Authorization Required from the Patient?

Breach Notification

Written policies and procedures are in place that establish how the practice will generate patient notification will occur if a breach occurs.

Read more: Breach Notification Rule, Breach Notification Requirements, HHS Cyber Attack FAQ

All employees are fully trained on HIPAA breach notification policies and procedures.

Read more: Breach Notification Rule, Breach Notification Requirements, OCR Cyber Attack FAQ

Written policy is in place that states the appropriate sanctions/action that will be taken against workforce members who do not comply with HIPAA breach policies and procedures.

Read more: Breach Notification Rule, Breach Notification Requirements, OCR Cyber Attack FAQ

Business Associates

Business Associate Agreements have been signed by all persons or entities that perform certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity (not including members of the practice’s workforce).

Read more: Business Associate Contracts, HIPAA Compliance, HIPAA Forms

A list of all business associates (including the Business Associate Agreement signing date) is maintained with HIPAA compliance documentation.