AMENDED (CLEAN) A2233 HIPAA COMPLIANCE (WORD).DOCX

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY
Current Adoption Date: MM-DD-YYYY
AND ACCOUNTABILITY ACT (HIPAA)
COMPLIANCE Current Implementation Date: MM-DD-YYYY
Approved by: Board Agenda Number: C-49-13-077-6-01
BOARD OF SUPERVISORS
Original Adoption Date: 6-5-2013
I. PURPOSE
To provide for County-wide implementation of the Health Insurance Portability and Accountability Act
(HIPAA) and related regulations, to identify the County as a hybrid entity with designated Covered
Components, and to provide for the Covered Components within the County to adopt and implement policies
and procedures specific to their work sites.
II. APPLICATION
This Policy applies to all Maricopa County appointed departments as well as the Flood Control District of
Maricopa County, the Maricopa County Library District, and the Maricopa County Stadium District (Special
Districts). The Board of Supervisors is authorized to jointly adopt policies applying to the Special Districts
under the Intergovernmental Agreement, C-06-18-393-6-00, approved on April 11, 2018.
This policy also applies to employees of County elected offices unless the elected official has implemented
a similar policy specific to his or her office.
III. DEFINITIONS
A. Appointing Authority: An elected official, the single administrative or executive head of a
Department/Special District, or the designated representative authorized to act in this capacity.
B. Authorized Users: All workforce members (employees or any other individual performing work on behalf
of, or with approval of the County) authorized to access County technology resources (CTRs). This
includes County employees, temporary employees and non-employees providing products or services
to the County and/or who are given access to County Data such as suppliers on contract or outside
organizations with Intergovernmental Agreements (IGA)s.
C. Chief Privacy Officer: The individual appointed by the County Manager or their designee to ensure
compliance with the HIPAA Privacy Rule, to act as the County’s official liaison with the U.S. Department
of Health and Human Services (HHS) and its Office for Civil Rights (OCR), to direct the Privacy Team,
and to coordinate with the County HIPAA Security Official on matters relating to HIPAA security and
privacy safeguards.
D. Component Privacy Official: An individual designated by a Covered Component’s Appointing Authority,
responsible for adopting, implementing and maintaining HIPAA compliant policies and procedures
germane to the Covered Component; working under the guidance of the Chief Privacy Officer as a
member of the Privacy Team; ensuring the training of employees of the Covered Component to
understand and implement HIPAA Privacy Rule practices; and under the direction of the Chief Privacy
Officer, receiving, investigating, reporting and mitigating all privacy complaints and breaches related to
the Covered Component’s activities.

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY
AND ACCOUNTABILITY ACT (HIPAA)
Current Adoption Date: MM-DD-YYYY
COMPLIANCE
E. Covered Components (Component): Designated healthcare components of the County (including,
departments, districts, elected offices, or divisions thereof) that include: (1) any component that would
meet HIPAA’s definition of “covered entity” if it were a separate legal entity (e.g., a health plan, a health
care provider, or healthcare clearinghouse); (2) any component to the extent it performs HIPAA-covered
functions (e.g., pays for medical care or furnishes, bills, or receives payment for healthcare) and
electronically receives or transmits individually identifiable health information; and (3) any component
that provides business associate services to a component or components falling under (1) or (2) of this
section (also referred to as “Business Associate Components”). For purposes of this Policy, a Business
Associate Component is a component of the County that performs certain functions or activities that
involve the use or disclosure of Protected Health Information (PHI) on behalf of, or provides services to,
a covered component or component performing covered functions.
F. Hybrid Entity: A single legal entity that performs both HIPAA-covered and non-HIPAA-covered functions
and has chosen to be a Hybrid Entity by defining and designating its health care components in
accordance with 45 C.F.R. §164.105 (a) (2) (iii) (C).
G. Individually Identifiable Health Information (IIHI): Any information, whether oral or recorded in any
form or medium, that is created or received by a health care provider, health plan, public health authority,
employer, life insurer, school or university, or health care clearinghouse, which identifies an individual or
with respect to which there is a reasonable basis to believe the information can be used to identify the
individual, and that: 1) relates to the past, present, or future physical or mental health or condition of an
individual; 2) the provision of health care to an individual; or 3) the past, present, or future payment for
the provision of health care to an individual.
H. Notice of Privacy Practices: A notice that must be provided by a health care provider or health plan
that explains how the provider or plan may use and share Protected Health Information (PHI) and how a
recipient may exercise rights with respect to that information.
I. Privacy Team: A group composed of the Chief Privacy Officer, the Component Privacy Officials, and a
designated member of: the County Risk Management Department, County Internal Audit, County
Administration Office, and any other persons designated by the County Manager or Chief Privacy Officer
to guide the implementation and enforcement of HIPAA compliance policies, procedures, and practices
both County-wide and at the Covered Component level, including training on the HIPAA Privacy and
Security Rules.
J. Protected Health Information (PHI): Individually identifiable health information (IIHI) that is transmitted
by electronic media, maintained in electronic media or transmitted or maintained in any other form or
medium. However, PHI excludes education records covered by the Family Educational Rights and
Privacy Act, records described in 20 U.S.C. §1232g(a)(4)(B)(iv), as well as employment records held by
a covered entity in its role as employer.
K. Security Official: The individual appointed by the County Manager or their designee to ensure
compliance with the HIPAA Security Rule. The Security Official will be a member of the Privacy Team.
IV. POLICY
A. Compliance
1. The County is a Hybrid Entity that will comply with the HIPAA requirements applicable to Hybrid
Entities, including retaining certain oversight, compliance, and enforcement obligations with respect
to the County’s Covered Components.
Page 2 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY
AND ACCOUNTABILITY ACT (HIPAA)
Current Adoption Date: MM-DD-YYYY
COMPLIANCE
2. Covered Components are subject to HIPAA Privacy and Security Rule requirements and therefore
must limit Protected Health Information (PHI) shared with the rest of the County the same way that
they limit disclosures to other entities. The County designates the following as the County’s Covered
Components: Public Health Services, Correctional Health Services, and Employee Benefits &
Health.
3. The County Manager or designee will appoint a Chief Privacy Officer who will serve as the County’s
contact point for the U.S. Department of Health and Human Services’ (HHS) Office for Civil Rights
(OCR) in matters relating to HIPAA compliance.
4. The Appointing Authority of a Covered Component will designate a Component Privacy Official who
will be the contact for all HIPAA matters arising out of that Covered Component, including complaints
from individuals.
5. In coordination with the Chief Privacy Officer, Covered Components must securely segregate PHI
from access by or disclosure to non-covered components and have policies and procedures in place
to adhere to HIPAA’s administrative, technical, and physical safeguard requirements.
6. Covered Components within the County will collaborate with their IT services provider and Maricopa
County Information Security to identify and implement technological controls required under the
HIPAA Security Rule.
B. Role of Chief Privacy Officer, Component Privacy Officials, and Privacy Team
1. Chief Privacy Officer
The Chief Privacy Officer is responsible for assuring that each Covered Component develops and
implements policies and procedures consistent with HIPAA and related regulations and the County’s
HIPAA policy. The Chief Privacy Officer is authorized to have direct access and communication with
the County Manager and Appointing Authorities. The Chief Privacy Officer will coordinate their efforts
with the Security Official who is responsible for ensuring secure electronic transmission of PHI.
The Chief Privacy Officer will coordinate and collaborate with Component Privacy Officials to ensure
that:
a. Covered components have policies and procedures that meet the requirements set forth under
the HIPAA Privacy and Security rules
b. Breaches are reported to the OCR and covered individuals in a timely manner as required under
HIPAA Privacy and Security rules and adequate measures are taken to address breach
concerns
c. Routine compliance and risk assessments are conducted as required under the HIPAA Privacy
and Security rules
2. Component Privacy Officials
Each Component Privacy Official will:
a. Develop policies and procedures for their respective Covered Component with guidance and
support from the Chief Privacy Officer and Privacy Team when necessary
b. Be the initial contact when a breach occurs within the Covered Component
Page 3 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY
AND ACCOUNTABILITY ACT (HIPAA)
Current Adoption Date: MM-DD-YYYY
COMPLIANCE
c. Participate as a member of the County HIPAA Privacy Team
d. Ensure appropriate sanctions are levied against Authorized Users who violate HIPAA or
otherwise violate any County or Department policy or agreement pertaining to HIPAA Privacy or
Security rules in coordination with Maricopa County Human Resources and legal counsel
3. Privacy Team
The Chief Privacy Officer will work closely with Component Privacy Officials by facilitating a Privacy
Team meeting at least annually, or more frequently as deemed necessary or desirable by the Privacy
Team members, to address HIPAA incidents or substantive changes to the HHS HIPAA Privacy or
Security rules.
4. Required Procedures
Each Covered Component will develop with consultation from the Privacy Team the procedures that
will be submitted to the Chief Privacy Officer for action. At a minimum, this will include:
a. The method and manner of distribution of the Notice of Privacy Practices to patients and
customers
b. The process by which individuals make privacy complaints concerning the County’s compliance
with HIPAA and the manner for documenting and addressing resolution of such complaints
c. The process for requesting disclosure of PHI and the necessary authorization to do so
C. Privacy and Security Awareness and Training
1. All Authorized Users of a Covered Components who use, access, create, distribute or who may have
access to PHI shall be required to take annual HIPAA privacy and security training. Authorized
Users who are outside parties under contract or Intergovernmental Agreement (IGA) with the County
shall be responsible for their own training.
2. Training will include procedures related to the following security measures:
a. protection against malicious software
b. monitoring of log-in attempts and reporting discrepancies
c. managing passwords and creation of strong passwords
3. Completion of training must be documented.
4. Confidential Systems that contain PHI will be configured to record successful and unsuccessful log-in
and to automatically lock out and report users after three unsuccessful attempts to log-on.
D. Documentation
1. Policies and procedures and other documentation required by the HIPAA Security Rule to maintain
compliance with HIPAA and its Privacy and Security subparts will be created and maintained by the
County.
2. Security related policies, procedures and related documentation will be retained for six (6) years from
the date of their creation or the date when they were last in effect, whichever is later. Originals of the
Page 4 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY
AND ACCOUNTABILITY ACT (HIPAA)
Current Adoption Date: MM-DD-YYYY
COMPLIANCE
County’s Policies related to HIPAA will be maintained by the County Clerk of the Board of
Supervisors. Electronic versions will be made available on the County’s Intranet site.
3. HIPAA policies, procedures and related documentation will be reviewed annually, or in response to
changes in regulation or in response to environmental or operational changes affecting the security
or privacy of the PHI.
APPENDIX
HIPAA regulations are located at 45 C.F.R. Parts 160, 162 and 164. For more details on HIPAA regulations,
see the references below:
A. Notice of Privacy Practices 45 CFR 164.520
B. Review and Resolution of Privacy Complaints 45 CFR 164.530(d)
C. Individual’s Right to Access Protected Health Information 45 CFR 164.524
D. Individual’s Right to Request Amendment of Protected Health Information 45 CFR 164.526
E. Individual’s Right to Request Alternative Communications 45 CFR 164.522(b)
F. Individual’s Right to Request Restrictions on Uses and Disclosures 45 CFR 164.522(a)
G. Disclosing Information to Person’s Involved in Individual’s Care and Individual’s Right to Restrict
Disclosures 45 CFR 164.510(b)
H. Individual’s Right to an Accounting of Disclosures of Protected Health Information 45 CFR
164.528
I. Confidentiality/Privacy of Protected Health Information 45 CFR 164.502
J. Uses and Disclosures of Protected Health Information Not Requiring the Individual’s
Authorization 45 CFR 164.512
K. Authorization for Uses and Disclosures of Protected Health Information 45 CFR 164.508
L. Minimum Necessary 45 CFR 164.502 and 164.514(d)
M. Safeguarding of Protected Health Information 45 CFR 164.530(c)
N. Training of Workforce with Respect to Protected Health Information 45 CFR 164.530(b)
O. Mitigation of Improper Disclosures 45 CFR 164.530(f)
P. Disclosures of De-Identified Health Information 45 CFR 164.514
Q. Retention of Protected Health Information 45 CFR 164.530(j)
R. Chief Privacy Officer and Privacy Official 45 CFR 164.530(a)
S. Business Associate Agreements 45 CFR 164.504(e)
T. Policies and Procedures Requirements 45 CFR 164.530(i)
Page 5 of 6

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY
AND ACCOUNTABILITY ACT (HIPAA)
Current Adoption Date: MM-DD-YYYY
COMPLIANCE
Revision History
Version Revision Date Description of Revision
1 06-05-2013 Initial version. (C-49-13-077-6-00)
Added §IV.C. and §IV.D. on Privacy and Security Awareness and Training
2 12-10-2014 as well as Documentation in order to keep the County in compliance with
federal HIPAA regulations. (C-49-13-077-6-01)
Updated Applicability section to reflect IGA C-06-18-393-6-00l; Updated
definition of Authorized Users to same as other more recent technology use
policies; Updated definitions to reflect current requirements under HIPAA;
3 MM-DD-2021
Updated compliance section to reflect minimum necessary requirements
under HIPAA law and rule; Updated role of Privacy Officer and Privacy
Officials to reflect requirements under HIPAA. (C-49-13-077-6-02)
Page 6 of 6