CURRENT A2233 HIPAA COMPLIANCE (PDF).PDF

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT (HIPAA)
Date:
COMPLIANCE 12-10-2014
Board Agenda
Approved by: Number: C-49-13-077-6-01
BOARD OF SUPERVISORS Original Adoption
6-5-2013
Date:
I. PURPOSE
To provide for County-wide implementation of the Health Insurance Portability and
Accountability Act (HIPAA) and related regulations, to identify the County as a hybrid
entity with designated Covered Components, and to provide for the Covered
Components within the County to adopt and implement policies and procedures specific
to their work sites.
II. APPLICATION
This Policy applies to County Covered Components as defined below.
III. DEFINITIONS
A. Appointing Authority: An elected official, the single administrative or executive
head of a Department/Special District, or the designated representative authorized
to act in this capacity.
B. Component Privacy Official: An individual designated by a Covered Component’s
Appointing Authority, who is responsible for adopting, implementing and maintaining
HIPAA compliant policies and procedures germane to the Covered Component; who
works under the guidance of the County Chief Privacy Officer as a member of the
Privacy Team; who trains, or is responsible for ensuring the training of, employees of
the Covered Component to understand and implement HIPAA Privacy Rule
practices; and who will, under the direction of the Chief Privacy Officer, receive,
investigate, report and mitigate all privacy complaints and breaches related to the
Covered Component’s activities.
C. County Chief Privacy Officer (Chief Privacy Officer): The individual appointed by
the County Manager or their designee to ensure compliance with the HIPAA Privacy
Rule, to act as the County’s official liaison with the U.S. Department of Health and
Human Services (HHS) and its Office for Civil Rights (OCR), to direct the Privacy
Team, and to coordinate with the County HIPAA Security Official on matters relating
to HIPAA security and privacy safeguards.
Page 1 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE Date: 12-10-2014
D. Covered Components (Component): A Department or a division of a Department
that is (1) a health plan or (2) a health care provider who electronically transmits any
Protected Health Information.
E. Department/Special District (Department): A division of the County including
Special Districts. Special Districts are the Flood Control District of Maricopa County,
Maricopa County Library District and the Maricopa County Stadium District.
F. Hybrid Covered Entity: A single legal entity that is a covered entity with business
activities that include both covered and non-covered functions, and that designates
health care components in accordance with 45 C.F.R. §164.105 (a) (2) (iii) (C).
G. Individually Identifiable Health Information (IIHI): Any information, whether oral or
recorded in any form or medium, that is created or received by a health care
provider, health plan, public health authority, employer, life insurer, school or
university, or health care clearinghouse, which identifies an individual or with respect
to which there is a reasonable basis to believe the information can be used to
identify the individual, and that: 1) relates to the past, present, or future physical or
mental health or condition of an individual; 2) the provision of health care to an
individual; or 3) the past, present, or future payment for the provision of health care
to an individual.
H. Notice of Privacy Practices (NPP): A notice that must be provided by a health care
provider or health plan that explains how the provider or plan may use and share
Protected Health Information and how a recipient may exercise rights with respect to
that information.
I. Privacy Team: A group composed of the County Chief Privacy Officer, the
Component Privacy Officials and any other persons designated by the County
Manager to implement and supervise HIPAA compliant policies, procedures, and
practices both County-wide and at the Covered Component level, including training
on the HIPAA Privacy Rule.
J. Protected Health Information (PHI): Individually identifiable health information
(IIHI) that is transmitted by electronic media, maintained in electronic media or
transmitted or maintained in any other form or medium. However, PHI excludes
education records covered by the Family Educational Rights and Privacy Act,
records described in 20 U.S.C. §1232g(a)(4)(B)(iv), as well as employment records
held by a covered entity in its role as employer.
K. Security Official: The individual appointed by the County Manager or their designee
to ensure compliance with the HIPAA Security Rule.
IV. POLICY
A. Compliance
Page 2 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE Date: 12-10-2014
1. Maricopa County (County) will comply with the requirements of the federal Health
Insurance Portability and Accountability Act (HIPAA) and related regulations.
2. The County is a Hybrid Covered Entity under HIPAA with several Covered
Components.
3. The County Manager, or designee, will appoint a County Chief Privacy Officer
who will serve as the County’s contact point for HHS and HHS’ Office for Civil
Rights (OCR).
4. The Appointing Authority of a Covered Component will designate a Component
Privacy Official who will be the contact for all HIPAA matters arising out of that
Covered Component, including complaints from individuals.
5. Covered Components within the County will develop policies and procedures
specific to their work sites implementing this County HIPAA Policy and will submit
all policies and procedures, including revisions, to the County Chief Privacy
Officer for action.
B. Role of Chief Privacy Officer, Component Privacy Officials, and Privacy Team
1. Chief Privacy Officer
The Chief Privacy Officer is responsible for assuring that each Covered
Component develops and implements policies and procedures consistent with
HIPAA and related regulations and the County’s HIPAA policy. The Chief Privacy
Officer is authorized to have direct access and communication with the County
Manager and Appointing Authorities. The Chief Privacy Officer will coordinate
their efforts with the Security Official who is responsible for ensuring secure
electronic transmission of PHI.
The Chief Privacy Officer will ensure that:
a. County employees working in Covered Components receive adequate HIPAA
training applicable to their role in dealing with Protected Health Information.
b. PHI is physically safeguarded throughout the County.
c. Patients and customers are notified of their rights to have their health
information protected.
d. Breaches are reported to the OCR and patients in a timely manner and
adequate measures are taken to address breach concerns.
2. Component Privacy Officials
Page 3 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE Date: 12-10-2014
Each Component Privacy Official will develop policies and procedures for their
respective Covered Component with direction from the Chief Privacy Officer and
Privacy Team when necessary. The Component Privacy Official will also be the
initial contact when a breach occurs within the Covered Component. All
Component Privacy Officials are members of the Privacy Team.
3. Privacy Team
The Chief Privacy Officer will work closely with Component Privacy Officials by
facilitating a regular Privacy Team meeting. The Privacy Team will also
coordinate their efforts with the County Security Official.
4. Required Procedures
Each Covered Component will develop with consultation from the Privacy Team
the procedures that will be submitted to the Chief Privacy Officer for action. At a
minimum, this will include:
a. The method and manner of distribution of the Notice of Privacy Practices to
patients and customers;
b. The process by which individuals make privacy complaints concerning the
County’s compliance with HIPAA and the manner for documenting and
addressing resolution of such complaints;
c. The process for requesting disclosure of PHI and the necessary authorization
to do so;
d. Appropriate sanctions for any Employee who fails to comply with the privacy
policies and procedures of the County or the Covered Component.
C. Privacy and Security Awareness and Training
1. The Chief Privacy Officer will work with the Privacy Team to ensure that
employees dealing with HIPAA will be appropriately trained.
a. All employees of Covered Components or County Contractors who use,
access, create, distribute or who may have access to PHI are required to take
annual HIPAA privacy and security training.
b. Training will include procedures related to the following security measures:
i. protection against malicious software
ii. monitoring of log-in attempts and reporting discrepancies
iii. managing passwords and creation of strong passwords
c. Completion of training must be documented.
Page 4 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE Date: 12-10-2014
d. Confidential Systems that contain PHI will be configured to record successful
and unsuccessful log-in and to automatically lock out and report users after
three unsuccessful attempts to log-on.
2. Security Reminders
a. At least quarterly, training reminders and updates related to the HIPAA
Privacy and Security Rules will be created by the Chief Privacy Officer and
distributed to all employees who have received annual HIPAA training. The
Privacy Team and the Information Security group will identify relevant topics
to be addressed in the Security Reminders. Reminders will also be distributed
to announce changes in policies or procedures, new or updated software,
new security technology or changes to the Privacy and Security Rules and
related regulations.
b. System Owners of PHI/Confidential Systems are surveyed annually on
HIPAA security-related practices and procedures to ensure that appropriate
safeguards for PHI/Confidential Information are included in Reminders.
D. Documentation
1. Policies and procedures and other documentation required by the HIPAA
Security Rule to maintain compliance with HIPAA and its Privacy and Security
subparts will be created and maintained by the County.
2. Security related policies, procedures and related documentation will be retained
for six (6) years from the date of their creation or the date when they were last in
effect, whichever is later.
3. Policies and procedures related to HIPAA will be maintained on the County
Intranet EBC at http://ebcportal.maricopa.gov/hipaa/Pages/Home.aspx.
4. HIPAA policies, procedures and related documentation will be reviewed annually,
or in response to changes in regulation or in response to environmental or
operational changes affecting the security or privacy of the PHI.
Version Revision Date Description of Revision
1 5 June 2013 Initial version. C-49-13-077-6-00
Added §IV.C. and §IV.D. on Privacy and Security
2 10 Dec 2014 Awareness and Training as well as Documentation in
order to keep the County in compliance with federal
HIPAA regulations.
Page 5 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE Date: 12-10-2014
APPENDIX
HIPAA regulations are located at 45 C.F.R. Parts 160, 162 and 164. For more details on
HIPAA regulations, see the references below:
A. Notice of Privacy Practices 45 CFR 164.520
B. Review and Resolution of Privacy Complaints 45 CFR 164.530(d)
C. Individual’s Right to Access Protected Health Information 45 CFR 164.524
D. Individual’s Right to Request Amendment of Protected Health Information 45 CFR
164.526
E. Individual’s Right to Request Alternative Communications 45 CFR 164.522(b)
F. Individual’s Right to Request Restrictions on Uses and Disclosures 45 CFR
164.522(a)
G. Disclosing Information to Person’s Involved in Individual’s Care and Individual’s
Right to Restrict Disclosures 45 CFR 164.510(b)
H. Individual’s Right to an Accounting of Disclosures of Protected Health Information
45 CFR 164.528
I. Confidentiality/Privacy of Protected Health Information 45 CFR 164.502
J. Uses and Disclosures of Protected Health Information Not Requiring the
Individual’s Authorization 45 CFR 164.512
K. Authorization for Uses and Disclosures of Protected Health Information 45 CFR
164.508
L. Minimum Necessary 45 CFR 164.502 and 164.514(d)
M. Safeguarding of Protected Health Information 45 CFR 164.530(c)
N. Training of Workforce with Respect to Protected Health Information 45 CFR
164.530(b)
O. Mitigation of Improper Disclosures 45 CFR 164.530(f)
P. Disclosures of De-Identified Health Information 45 CFR 164.514
Q. Retention of Protected Health Information 45 CFR 164.530(j)
R. Chief Privacy Officer and Privacy Official 45 CFR 164.530(a)
S. Business Associate Agreements 45 CFR 164.504(e)
T. Policies and Procedures Requirements 45 CFR 164.530(i)
Page 6 of 6