Agenda - Council - 08/22/2006 - Laserfiche WebLink

Home

Policy Statement The Administrative Safeguards portion of the Security Rule (collectively referred to as "Administrative Safeguards ") addresses administrative measures and the policy and procedures for their use that protect ePHI and control access to it. It includes administrative actions, and policies and procedures, to manage the selection measures to protect electronic protected health information and to manage the conduct of the covered entity's workforce in relation to the protection of that information. Policy Interpretation and Implementation Standards and Implementation Specifications Approach Coordination with Privacy Policies and Procedures Definition of Protected Health 4. Protected Health Information (PHI) means individually Information (PHI) identifiable Information relating to: a. The past, present or future physical or mental health or condition of an individual b. The provision of health care to an individual; c. The past, present or future payment for health care provided to an individual. Definition of Electronic 5. Electronic Protected Health Information (ePHI) means Protected Health Information PHI maintained or transmitted in electronic media, (ePHI) including, but not limited to, electronic storage media (i.e., hard drives, digital memory medium) and transmission media used to exchange information in electronic storage media (i.e., internet, extranet, and other networks). PHI transmitted via facsimile and telephone is not considered to be transmissions via electronic media. Record Retention 6. A copy of all HIPAA covered information and any revisions shall be maintained for a period of at least six (6) years. Such retention may be in printed or electronic • format, or both. HIPAA Security Officer 7 The HIPAA Security Officer is responsible for the development and implementation of the HIPAA policies City of Ramsey HIPAA Security Policy Administrative Safeguards - Generally 1. The Administrative Safeguards portion of the Security Rules consists of nine standards. Some of these standards in turn include implementation specifications designed to further the standard. 2. The Health Plan must consider, evaluate, and document its assessment, including recommendations for improvement. Such documentation shall be reflected in a dated memo attached to and made part of the HIPAA Security Policies and Procedures. 3. The Administrative Safeguards standards apply in addition to the HIPAA Privacy Policies and Procedures where the PHI involved is ePHI.