Woods and Water Medical

Center

19
1919001900 College Drive Rice Lake, WI 54868  715—234-7082 
meltonlj@my.witc.edu
.

HIPPA Privacy Policy

PURPOSE

 Ensure confidentiality, integrity, and availability of all EPHI that a CE or BA creates.

 Protect against any reasonable anticipated threats or hazards to the security or integrity of such EPHI.

SCOPE

 This policy applies to all organizations, employees, management, contractors, student interns, and
volunteers.
 This policy describes the organization’s objectives and policies regarding maintaining the privacy of
patient information

RESPONSIBILITIES

Executives/ Management
 Establish program objectives
 Approve privacy policy
 Provide training for work force
 Enforce sanctions
 Designate Privacy Official

Privacy Official

 Develop privacy policies and procedures

 Coordinates and implements policy through organization’s departments.
 Oversees training
 Receives and processes privacy complaints
 Processes individual rights requests
a) Right to access/copy protected health information (PHI)
b) Right to amend PHI
c) Right to restrict use/disclosure
d) Right to confidential communications
e) Right to file a complaint
 Ensures retention of HIPPA policies, procedures, complaints and investigative materials to meet
compliance requirements.

Legal Counsel or Privacy Official)

 Processes Business Associate Agreements (BAA)

 a) Conducts business associate inventory
b) Develops and coordinates BAA template
c) Conducts annual review/update

Corporate Compliance Officer

 Assists in development and executive of the HIPPA Private Policy and promulgation of operating
procedures.
 Assists and supports the Privacy official
 Provide support for HIPPA compliance activities

Medical Records Director

 Implements organization’s privacy policy for medical records

 Provides administrative and physical safeguards for the protection of client health information.

Director, Training

 Develops and implements privacy training program as described in Section 11 of this policy
 Documents the delivery of privacy training to all work force members

Employee Responsibility

 Understand and comply with Organization’s policies regarding patient Confidentiality and privacy

NOTICE OF PRIVACY PRACTICES (NPP)

 The organization will make a “best effort” attempt to receive acknowledgement of receipt from each
patient and document such in patients medical record medical record.

USE AND/OR DISCLOSURE OF PROTECTED HEALTH INFORMATION

 Routine uses
 Process for disclosing patient information
 Personal representatives

IINDIVIDUAL RIGHTS

 Right to access/copy PHI

 Right to amend PHI
 Right to restrict use or disclosure
 Right to an accounting of disclosures
 Right to file a complaint

SAFEGUARDS FOR THE PROTECTION OF PHI

 Administrative safeguards
 Physical safeguards
 Technical safeguards

WORK FORCE TRAINING

 T New staff member training

 Recurrent training
 Special function training