Woods & Waters Medical Center

HIPPA Privacy Policy

1. PURPOSE
Ensure confidentiality, integrity, and availability of all EPHI that a CE or BA creates,
receives, maintains, or transmits.

Protect against any reasonably anticipated threats or hazards to the security or

integrity of such EPHI

2. SCOPE
a. This policy applies to all organizations employees, management, contractors,
student interns, and volunteers.
b. This policy describes the organizations objectives and policies regarding maintaining
the privacy of patient information.

3. DEFINITIONS [List the terms and definitions that are relevant to organizations HIPAA
privacy policy.]

4. RESPONSIBILITIES
a. Executives/Management
(1) Establish program objectives
(2) Approve privacy policy
(3) Provide training for work force
(4) Enforce sanctions
(5) Designate Privacy Official
b. Privacy Official
(1) Develops privacy policies and procedures
(2) Coordinates and implements policy through organizations departments
(3) Oversees training
(4) Receives and processes privacy complaints
(5) Processes individual rights requests
1. Right to access/copy protected health information (PHI)
2. Right to amend PHI
3. Right to restrict use/disclosure
4. Right to confidential communications
5. Right to an accounting of disclosures
6. Right to file a complaint
(6) Ensures retention of HIPAA policies and procedures, complaints, and
investigative materials to meet compliance requirements.
c. Legal Counsel (or Privacy Official)
(1) Processes Business Associate Agreements (BAA)
1. Conducts business associate inventory
2. Develops and coordinates BAA template
3. Conducts annual review/update
d. Corporate Compliance Officer

HIPAA Privacy Policy 1 of 2

 (1) Assists in development and execution of the HIPAA Privacy Policy and
promulgation of operating procedures
(2) Assists and supports the Privacy Official
(3) Provide support for HIPAA compliance activities
e. Medical Records Director
(1) Implements organizations privacy policy for medical records
(2) Provides administrative and physical safeguards for the protection of client health
information
f. Director, Training
(1) Develops and implements privacy training program as described in Section 11 of
this policy
(2) Documents the delivery of privacy training to all work force members
g. Employee responsibilities
(1) Understand and comply with organizations policies regarding patient
confidentiality and privacy

5. NOTICE OF PRIVACY PRACTICES (NPP)

a. The organization will make a best effort attempt to receive acknowledgment of
receipt of NPP from each patient and document such in the patients medical record.

6. USE AND/OR DISCLOSURE OF PROTECTED HEALTH INFORMATION

a. Routine uses
(1) Treatment, Payment and Operations

b. Process for disclosing client information

c. Personal representatives
(1) Minors rights.

INDIVIDUAL RIGHTS

a. Right to access/copy PHI

b. Right to amend PHI
c. Right to restrict use or disclosure
d. Right to confidential communications
e. Right to an accounting of disclosures
f. Right to file a complaint

7. SAFEGUARDS FOR THE PROTECTION OF PHI

a. Administrative safeguards
b. Physical safeguards
c. Technical safeguards

8. WORK FORCE TRAINING

a.
(1) New staff member training
(2) Recurrent training
(3) Special function training

HIPAA Privacy Policy 2 of 2