AMENDED (MARK UPS) A2233 2021.DOCX

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT (HIPAA)
Date:
COMPLIANCE 12-10-2014
Board Agenda
C-49-13-077-6-01
Approved by: Number:
BOARD OF SUPERVISORS Original Adoption
6-5-2013
Date:
I. PURPOSE
To provide for County-wide implementation of the Health Insurance Portability and Accountability Act
(HIPAA) and related regulations, to identify the County as a hybrid entity with designated Covered
Components, and to provide for the Covered Components within the County to adopt and implement
policies and procedures specific to their work sites.
II. APPLICATION
This Policy applies to County Covered Components as defined below.
This policy applies to all employees of Maricopa County appointed departments as well as the Flood Control
District of Maricopa County, the Maricopa County Library District, and the Maricopa County Stadium District
(Special Districts) (collectively, Maricopa County or the County). The Board of Supervisors is authorized to jointly
adopt policies applying to the Special Districts under the Intergovernmental Agreement (IGA), C-06-18-393-6-00,
approved on April 11, 2018.
This policy also applies to employees of County elected offices unless the elected official has implemented a
similar specific policy specific to his or her office.
III. DEFINITIONS
A. Appointing Authority: An elected official, the single administrative or executive head of a
Department/Special District, or the designated representative authorized to act in this capacity.
B. Authorized Users: All workforce members (employees or any other individual performing work on
behalf of, or with approval of the County) authorized to access County technology resources (CTRs).
This includes County employees, temporary employees and non-employees providing products or
services to the County and/or who are given access to County Data such as suppliers on contract or
outside organizations with Intergovernmental Agreements (IGA)s. County employees (including
temporary employees), non-employees providing services or products to the County (e.g., suppliers on
contract) and/or non-employees who are given access to County data (e.g., suppliers on contract or
outside organizations with Intergovernmental Agreements (IGAs)).
C. Chief Privacy Officer: The individual appointed by the County Manager or their designee to ensure Commented [M(1]: Can we eliminate "County" and the
compliance with the HIPAA Privacy Rule, to act as the County’s official liaison with the U.S. Department parenthetical duplicate phrase?
of Health and Human Services (HHS) and its Office for Civil Rights (OCR), to direct the Privacy Team,
and to coordinate with the County HIPAA Security Official on matters relating to HIPAA security and
privacy safeguards.
B.D. Component Privacy Official: An individual designated by a Covered Component’s Appointing
Authority, who is responsible for adopting, implementing, and maintaining HIPAA compliant policies
and procedures germane to the Covered Component; who workings under the guidance of the County
Chief Privacy Officer as a member of the Privacy Team; who trains, or is responsible for ensuring the
training of, employees of the Covered Component to understand and implement HIPAA Privacy Rule
Page 1 of 7

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE 12-10-2014
Date:
practices; and who will, under the direction of the Chief Privacy Officer, receivinge, investigatinge,
reporting, and mitigatinge all privacy complaints and breaches related to the Covered Component’s
activities.
C. County Chief Privacy Officer (Chief Privacy Officer): The individual appointed by the County Commented [M(2]: Can we eliminate "County" and the
Manager or their designee to ensure compliance with the HIPAA Privacy Rule, to act as the County’s parenthetical duplicate phrase?
official liaison with the U.S. Department of Health and Human Services (HHS) and its Office for Civil
Rights (OCR), to direct the Privacy Team, and to coordinate with the County HIPAA Security Official
on matters relating to HIPAA security and privacy safeguards.
D.E. Covered Components (Component): Designated healthcare components of the County
(including, A Ddepartments, districts, elected offices, or divisions thereof) that include: or a division of
a Department, that is (1) any component that would meet HIPAA’s definition of “covered entity” if it
were a separate legal entity (e.g., a health plan, or (2) a health care provider, or healthcare
clearinghouse); (2) any component to the extent it performs HIPAA-covered functions (e.g., pays for
medical care or furnishes, bills, or receives payment for healthcare) and electronically receives or
transmits individually identifiable health information; and (3) and who electronically transmits any
Protected Health Information any component that provides business associate services to a component
or components falling under (1) or (2) of this section (also referred to as “Business Associate
Components”). For purposes of this Policy, a Business Associate Component is a component of the
County that performs certain functions or activities that involve the use or disclosure of Protected Health
Information (PHI) on behalf of, or provides services to, a covered component or component performing
covered functions.
E. Department/Special District (Department): A division of the County including Special Districts.
Special Districts are the Flood Control District of Maricopa County, Maricopa County Library District
and the Maricopa County Stadium District.
F. Hybrid Covered Entity: A single legal entity that is a covered entity with business activities that include
performs both HIPAA-covered and non-HIPAA-covered functions, and that has chosen to be a Hybrid
Entity by defining and designatinges its health care components in accordance with 45 C.F.R. §164.105
(a) (2) (iii) (C).
G. Individually Identifiable Health Information (IIHI): Any information, whether oral or recorded in any
form or medium, that is created or received by a health care provider, health plan, public health
authority, employer, life insurer, school or university, or health care clearinghouse, which identifies an
individual or with respect to which there is a reasonable basis to believe the information can be used
to identify the individual, and that: 1) relates to the past, present, or future physical or mental health or
condition of an individual; 2) the provision of health care to an individual; or 3) the past, present, or
future payment for the provision of health care to an individual.
H. Notice of Privacy Practices (NPP): A notice that must be provided by a health care provider or health
plan that explains how the provider or plan may use and share Protected Health Information (PHI) and
how a recipient may exercise rights with respect to that information.
I. Privacy Team: A group composed of the County Chief Privacy Officer, the Component Privacy
Officials, and a designated member of: the County Attorney’s Office Civil Division; the County Risk
Management Department;, County Internal Audit,; County Administration Office,; and any other
persons designated by the County Manager or County Chief Privacy Officer to guide the implementation
and enforcementsupervis ofe HIPAA compliancet policies, procedures, and practicpracticeess both
County-wide and at the Covered Component level, including training on the HIPAA Privacy Ruleand
Security Rules.
J. Protected Health Information (PHI): Individually identifiable health information (IIHI) that is
transmitted by electronic media, maintained in electronic media, or transmitted or maintained in any
Page 2 of 7

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE 12-10-2014
Date:
other form or medium. However, PHI excludes education records covered by the Family Educational
Rights and Privacy Act, records described in 20 U.S.C. §1232g(a)(4)(B)(iv), as well as employment
records held by a covered entity in its role as employer.
K. Security Official: The individual appointed by the County Manager, or their designee, to ensure
compliance with the HIPAA Security Rule. The Security Official will be a member of the Privacy Team.
IV. POLICY
A. Compliance
1. TheMaricopa County (County)is a Hybrid Entity that will comply with the HIPAA requirements
applicable to Hybrid Entities,of the federal Health Insurance Portability and Accountability Act
(HIPAA) and related regulations including retaining certain oversight, compliance, and enforcement
obligations with respect to the County’s Covered Components.
2. Covered Components are subject to HIPAA Privacy and Security Rule requirements and therefore
must limit Protected Health Information (PHI) shared with the rest of the County the same way that
they limit disclosures to other entities. The County designates the followingis a Hybrid Covered
Entity under HIPAA with several as the County’s Covered Components: Public Health Services,
Correctional Health Services, and Employee Benefits & Health__.
3. The County Manager, or designee, will appoint a County Chief Privacy Officer who will serve as
the County’s contact point for the U.S. Department of Health and Human Services HHS and HHS’
Office for Civil Rights (OCR) in matters relating to HIPAA compliance.
4. The Appointing Authority of a Covered Component will designate a Component Privacy Official
who will be the contact for all HIPAA matters arising out of that Covered Component, including
complaints from individuals.
5. In coordination with the Chief Privacy Officer, Covered Components within the County must
securely segregate PHI from access by or disclosure to non-covered components, and have
policies and procedures in place to adhere to HIPAA’s administrative, technical, and physical
safeguards requirementswill develop policies and procedures specific to their Department’s
requirements under HIPAA work sites in coordination with the Chief Privacy Officer. implementing
this County HIPAA Policy and will submit all policies and procedures, including revisions, to the
County Chief Privacy Officer for action.
5.6.Covered Components within the County will collaborate with their IT services provider and
Maricopa County Information Security to identify and implement technological controls required
under the HIPAA Security Rule.
B. Role of Chief Privacy Officer, Component Privacy Officials, and Privacy Team
1. Chief Privacy Officer
The Chief Privacy Officer is responsible for assuring that each Covered Component develops and
implements policies and procedures consistent with HIPAA and related regulations and the
County’s HIPAA policy. The Chief Privacy Officer is authorized to have direct access and
communication with the County Manager and Appointing Authorities. The Chief Privacy Officer will
coordinate their efforts with the Security Official who is responsible for ensuring secure electronic
transmission of PHI.
Page 3 of 7

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE 12-10-2014
Date:
The Chief Privacy Officer will ensure thcCoordinate and collaborate with Component Privacy
Officials to ensure that at:
a. County employees working in Covered Components receive adequate HIPAA training applicable to their
role in dealing with Protected Health Information.
b. PHI is physically safeguarded throughout the County.
Patients and customers are notified of their rights to have their health information protected.
c.Covered components have policies and procedures that meet the requirements set forth under
the HIPAA Privacy and Security rules; .
a. Breaches are reported to the OCR and covered individualspatients in a timely manner as
required under HIPAA Privacy and Security rules and adequate measures are taken to address
breach concerns;.
d.b.Routine compliance and risk assessments are conducted as required under the HIPAA Privacy
and Security rules.
2. Component Privacy Officials
Each Component Privacy Official will:
develop policies and procedures for their respective Covered Component with direction
guidance and support from the Chief Privacy Officer and Privacy Team when necessary;.
The Component Privacy Official will also
i.
ii. Bbe the initial contact when a breach occurs within the Covered Component;. All
Component Privacy Officials are members of
iii. Pparticipate as a member of the County HIPAA the Privacy Team;.
iv. Eensure appropriate sanctions are levied against Aauthorized Uusers who violate HIPAA
or otherwise violate any County or Department policy or agreement pertaining to HIPAA
Privacy or Security rules, in coordination with Maricopa County Human Resources and
legal counsel.
3. Privacy Team
The Chief Privacy Officer will work closely with Component Privacy Officials by facilitating a regular
Privacy Team meeting at least annually, or more frequently as deemed necessary or desirable by
the Privacy Team members, to address HIPAA incidents or substantive changes to the HHS HIPAA
Privacy or Security rules. The Privacy Team will also coordinate their efforts with the County
Security Official.
4. Required Procedures
Each Covered Component will develop, with consultation from the Privacy Team, the procedures
that will be submitted to the Chief Privacy Officer for action. At a minimum, this will include:
a. The method and manner of distribution of the Notice of Privacy Practices to patients and
customers;
b. The process by which individuals make privacy complaints concerning the County’s
compliance with HIPAA, and the manner for documenting and addressing resolution of such
complaints;
c. The process for requesting disclosure of PHI and the necessary authorization to do so.;
d. Appropriate sanctions for any Employee who fails to comply with the privacy policies and
procedures of the County or the Covered Component.
Page 4 of 7

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE 12-10-2014
Date:
C. Privacy and Security Awareness and Training
1. The Chief Privacy Officer will work with the Privacy Team to ensure that employees dealing with
HIPAA will be appropriately trained.
a.1. All employees of aAuthorized uUsers of a Covered Components or County Contractors Commented [M(3]: Singular or Plural? Either remove the "a"
who use, access, create, distribute, or who may have access to PHI areshall be required tomust before Covered Components or remove "s" in "Components.
take annual HIPAA privacy and security training. Authorized Users who are outside parties Commented [SE(4R4]: @Natalie Beever (OET) can you
under contract or Intergovernmental Agreement (IGA) with the County shall be responsible for review this and revise per Michele’s recommendation. Thanks!
their own training. Commented [SE(5R4]:
Commented [N(6R4]: fixed
b. 2. Training will include procedures related to the following security measures:
a)protection against malicious software
b)monitoring of log-in attempts and reporting discrepancies
c)managing passwords and creation of strong passwords
3. Completion of training must be documented.
c.
d. 4. Confidential Systems that contain PHI will must be configured to record successful and
unsuccessful log-in and to automatically lock out and report users after three unsuccessful attempts
to log-on.
2. Security Reminders
a. At least quarterly, training reminders and updates related to the HIPAA Privacy and Security
Rules will be created by the Chief Privacy Officer and distributed to all employees who have
received annual HIPAA training. The Privacy Team and the Information Security group will
identify relevant topics to be addressed in the Security Reminders. Reminders will also be
distributed to announce changes in policies or procedures, new or updated software, new
security technology or changes to the Privacy and Security Rules and related regulations.
b. System Owners of PHI/Confidential Systems are surveyed annually on HIPAA security-related
practices and procedures to ensure that appropriate safeguards for PHI/Confidential
Information are included in Reminders.
D. Documentation
1. 1. Policies and procedures and other documentation required by the HIPAA Security Rule to
maintain compliance with HIPAA and its Privacy and Security subparts will be created and
maintained by the County.
2.2. Security related policies, procedures and related documentation will be retained for six ((6) years
from the date of their creation or the date when they were last in effect, whichever is later.
Page 5 of 7

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE 12-10-2014
Date:
3. Originals of the County’s Policies and procedures related to HIPAA will be maintained by the
County Clerk of the Board of Supervisors. Electronic versions will be made available on the County’s
Intranet site. Intranet EBC at http://ebcportal.maricopa.gov/hipaa/Pages/Home.aspx.
4. 3. HIPAA policies, procedures and related documentation will be reviewed annually, or in response
to changes in regulation or in response to environmental or operational changes affecting the security or
privacy of the PHI.
Version Revision Date Description of Revision
1 06-05-5 June 2013 Initial version. C-49-13-077-6-00
Added §IV.C. and §IV.D. on Privacy and Security
Awareness and Training as well as Documentation in
2 12-10-110 Dec 2014
order to keep the County in compliance with federal
HIPAA regulations. (C-49-13-077-6-01)
Updated Applicability section to reflect IGA C-06-
18-393-6-00l; Updated definition of Authorized
Users to same as other more recent technology use
policies; Updated definitions to reflect current
3 18 Mar MM-DD-2021 requirements under HIPAA; Updated compliance
section to reflect minimum necessary requirements
under HIPAA law and rule; Updated role of Privacy
Officer and Privacy Officials to reflect requirements
under HIPAA. (C-49-13-077-6-02)
Page 6 of 7

Policy Title: Policy Number: A2233
HEALTH INSURANCE PORTABILITY AND
Current Adoption
ACCOUNTABILITY ACT COMPLIANCE Date: 12-10-2014
APPENDIX
HIPAA regulations are located at 45 C.F.R. Parts 160, 162 and 164. For more details on HIPAA
regulations, see the references below:
A. Notice of Privacy Practices 45 CFR 164.520
B. Review and Resolution of Privacy Complaints 45 CFR 164.530(d)
C. Individual’s Right to Access Protected Health Information 45 CFR 164.524
D. Individual’s Right to Request Amendment of Protected Health Information 45 CFR
164.526
E. Individual’s Right to Request Alternative Communications 45 CFR 164.522(b)
F. Individual’s Right to Request Restrictions on Uses and Disclosures 45 CFR
164.522(a)
G. Disclosing Information to Person’s Involved in Individual’s Care and Individual’s
Right to Restrict Disclosures 45 CFR 164.510(b)
H. Individual’s Right to an Accounting of Disclosures of Protected Health Information
45 CFR 164.528
I. Confidentiality/Privacy of Protected Health Information 45 CFR 164.502
J. Uses and Disclosures of Protected Health Information Not Requiring the
Individual’s Authorization 45 CFR 164.512
K. Authorization for Uses and Disclosures of Protected Health Information 45 CFR
164.508
L. Minimum Necessary 45 CFR 164.502 and 164.514(d)
M. Safeguarding of Protected Health Information 45 CFR 164.530(c)
N. Training of Workforce with Respect to Protected Health Information 45 CFR
164.530(b)
O. Mitigation of Improper Disclosures 45 CFR 164.530(f)
P. Disclosures of De-Identified Health Information 45 CFR 164.514
Q. Retention of Protected Health Information 45 CFR 164.530(j)
R. Chief Privacy Officer and Privacy Official 45 CFR 164.530(a)
S. Business Associate Agreements 45 CFR 164.504(e)
T. Policies and Procedures Requirements 45 CFR 164.530(i)
Page 7 of 7