HIPAA Privacy

Question 1

3 classes for BA interaction, and standard for HIPAA privacy

Answer 1

1. clients BA contracts
2. partners BA contracts
3. staff Administrative Safeguards

Question 2

BA contract

Answer 2

<ul>
<li>required between entities which share PHI</li>
<li>written assurance that a BA will safeguard PHI</li>
<li>defines BA obligations</li>
<li>defines purpose &amp; uses for PHI</li>
<li>either separate contract or addendum to an existing service agreement</li>
</ul>

Question 3

BA contract provisions

Answer 3

<ul>
<li>intended purpose</li>
<li>not to violate BA contract</li>
<li>safeguard PHI</li>
<li>report unauthorized disclosures to attestee</li>
<li>ensure subcontractors &amp; agents safeguard</li>
<li>if maintainer of original PHI, to support individuals to access, amend, receive accounting of disclosures</li>
<li>internal records available to Department of Health and Human Services</li>
<li>return or destroy PHI upon termination of contract, if feasible</li>
</ul>

Question 4

HIPAA privacy

Answer 4

<ul>
<li>Compliance officer responsible for implementing+overseeing organizational compliance</li>
<li>for those with access to PHI, Employee training every 2 years or when regulations change</li>
<li>Formal Documents and Controls to protect PHI</li>
</ul>