Agenda - Council - 08/22/2006 - Laserfiche WebLink

Home

Relationship to Privacy Officer Workforce Sanctions (required) Information System Activity Review (required) References: 45 C.F.R. § 164.308(a)(2). City of Ramsey HIPAA Security Policy Assigned Security Responsibility [Administrative Safeguard] Standard A Security Officer must be identified and shall be responsible for the development and implementation of the Security Policies and Procedures. Interpretation and Implementation Specifications Security Management Process [Administrative Safeguard] Standard The Health Plan must implement policies and procedures to prevent, detect, contain, and correct security violations. Interpretation and Implementation Specifications 1. The HIPAA Security Officer can be, but is not required to be, the same individual as the HIPAA Privacy Officer. Should the HIPAA Security Officer be a different individual than the HIPAA Privacy Officer, the HIPAA Privacy Officer includes overall responsibility for protected health information (PHI), including electronic protected health information (ePHI). Risk Analysis 1. The Health Plan shall conduct an accurate and (required) thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the covered entity. For this purpose, "held by" includes ePHI that is housed other than by the Health Plan (e.g., third party administrators). Risk Management 2. The Health Plan shall implement security measures (required) sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply 3. The Health Plan shall apply appropriate sanctions against workforce members who fail to comply with the Security Policies and Procedures. 4. The Health Plan shall implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.