A2242 PATIENTS RIGHTS POLICY 9-4-18 (REDLINED).DOCX

MARICOPA COUNTY INTERNAL POLICY
Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption 12-10-2014 10-10-
Date: 2018
Board Agenda
Approved by: Number: C-49-15-032-6-010
BOARD OF SUPERVISORS Original Adoption
12-10-2014
Date:
I. PURPOSE
To ensure patients are afforded their rights under HIPAA.To ensure customers of
a Maricopa County HIPAA Covered Component are aware of, and afforded, their
rights under the Health Information Portability and Accountability Act as required
under 45 CFR §164.520.
II. APPLICATION
This Policy applies to County Covered Components as defined in Policy A2233 .
all Maricopa County HIPAA covered appointed departments as well as the Flood
Control District of Maricopa County, the Maricopa County Library District, and the
Maricopa County Stadium District. This policy also applies to employees of
County elected offices unless the elected official has implemented a similar
policy specific to his or her office.
III. DEFINITIONS
A. Appointing Authority: An elected official, the single administrative or
executive head of a Department/Special District, or the designated
representative authorized to act in this capacity.
B.A. Covered Component: A County Department or division of a County
Department that is (1) a health plan or (2) a health care provider who
electronically transmits any PHI. (defined below).
C.B. Health Insurance Portability and Accountability Act (HIPAA): Federal
legislation first passed in 1996. It includes the HIPAA Privacy Rule which
protects the privacy of individually identifiable health information; the HIPAA
Security Rule, which sets national standards for the security of electronic
protected health information; the HIPAA Breach Notification Rule, which
requires covered entities and business associates to provide notification
following a breach of unsecured protected health information; and the

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
confidentiality provisions of the Patient Safety Rule, which protect identifiable
information being used to analyze patient safety events and improve patient
safety.
C. Designated Record Set: A group of records maintained by or for a covered
entity that is: (i) the medical records and billing records about individuals
maintained by or for a covered healthcare provider; (ii) the enrollment,
payment, claims adjudication, and case or medical management record
systems maintained by or for a health plan; or (iii) used, in whole or in part, by
or for the covered entity to make decisions about the individual.
D. Individually Identifiable Health Information (IIHI): Any information,
whether oral or recorded in any form or medium, that is created or received
by a health care provider, health plan, public health authority, employer, life
insurer, school or university, or health care clearinghouse, which identifies an
individual or with respect to which there is a reasonable basis to believe the
information can be used to identify the individual, and that: 1) relates to the
past, present, or future physical or mental health or condition of an individual;
2) the provision of health care to an individual; or 3) the past, present, or
future payment for the provision of health care to an individual.
E. Notice of Privacy Practices: A notice that must be provided by a health
care provider or health plan that explains how the provider or plan may use
and share PHI and how a recipient may exercise rights with respect to that
PHI.
D.
F. Personal Representative: Any person who is legally authorized to act on
behalf an individual in making decisions related to health care.
E. Any person who qualifies as a “personal representative” of an individual in
accordance with 45 C.F.R. § 164.502(g).
F.G. Protected Health Information (PHI): IIHI that is transmitted by electronic
media, maintained in electronic media or transmitted or maintained in any
other form or medium. PHI excludes education records covered by the
Family Educational Rights and Privacy Act, records described in 20 U.S.C.
§1232g(a)(4)(B)(iv), IIHI regarding a person who has been deceased more
than 50 years, and employment records held by a covered entity in its role as
employer.Individually Identifiable Health Information (IIHI) is any information,
whether oral or recorded in any form or medium, that is created or received
by a health care provider, health plan, public health authority, employer, life
insurer, school or university, or health care clearinghouse, which identifies an
individual or with respect to which there is a reasonable basis to believe the
information can be used to identify the individual, and that: 1) relates to the
past, present, or future physical or mental health or condition of an individual;
Page 2 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
2) the provision of health care to an individual; or 3) the past, present, or
future payment for the provision of health care to an individual. Protected
Health Information refers to IIHI that is transmitted by electronic media,
maintained in electronic media or transmitted or maintained in any other form
or medium. However, PHI excludes education records covered by the Family
Educational Rights and Privacy Act, records described in 20 U.S.C.
§1232g(a)(4)(B)(iv), as well as employment records held by a covered entity
in its role as employer.
G.H. Psychotherapy Notes: Notes recorded in any media by a health care
provider who is a mental health professional documenting or analyzing the
contents of conversation during a private counseling session or a group joint
or family counseling session and that are separated from the rest of the
individual’s medical record. Psychotherapy notes excludes medication
prescription and monitoring, counseling session start and stop times, the
modalities and frequencies of treatment furnished, results of clinical tests,
and any summary of the following items: diagnosis, functional status, the
treatment plan, symptoms, prognosis, and progress to date.
IV. POLICY
The following Policy applies to any individuals who are patients of a Covered
Component or for which the Covered Component possess an individual’s PHI
and the designee or Personal Representative of the individual (collectively, the
“Patient”).All Covered Components must provide information to each individual
receiving services regarding their rights as a patient as outlined below and as
further clarified within this policy:
A. Patient Rights
1. HIPAA provides rights for patients with regards to their PHI. Under HIPAA,
patients have a right to the following:
a. Receive a Notice of Privacy Practices (45 CFR §164.520)
b. Access to their medical records to inspect and copy (45 CFR
§164.524)
c. Request an amendment or correction to their medical records (45 CFR
§ 164.526)
d. Authorize non-treatment uses via valid authorization (45 CFR
§164.508, 45 CFR §164.532)
Page 3 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
e. Receive an accounting of certain disclosures of their PHI (45 CFR
§164.528)
f. Request restrictions on use of PHI (45 CFR §164.522)
g. Request alternative channels of communication (45 CFR §164.527)
h. Submit a complaint about alleged violations of HIPAA regulations
and/or the County’s HIPAA policies and practices to the Covered
Component, County or U.S. Department of Health and Human
Services (HHS) (45 CFR §164.530(d))
B. Notice of Privacy Practices
1. Each Covered Component must have a Notice of Privacy Practices and
have it posted in a clear and easy to find location. Additionally, it must
ensure that this is made available to each patient and have documentation
that each patient has received it.
1. Each Covered Component must have a current Notice of Privacy
Practices (NOPP), which
a. Includes an effective date; and
b. Is promptly revised and distributed whenever a material change has
been made to any of its privacy practices; and
c. Is clearly and prominently posted in the facility; and
d. Is made available to any individual who asks for it; and
e. Is available on any website that provides information about its
customer services or benefits; and
f. Is provided to the customer/patient no later than the date of first
service delivery, or if the first service was provided during an
emergency or through electronic means (internet/email), as soon after
the first service as possible; and
g. Is provided to the patient in the means requested (i.e. in person, mail,
or email).
2. If the Covered Component is acting as a health care provider, the facility
must make a good faith effort to obtain the individual’s written
acknowledgment of receipt of the notice. If acknowledgment cannot be
Page 4 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
obtained, the facility must document the efforts to obtain the
acknowledgment and the reason why it was not obtained.
3. If the Covered Component is acting as a health plan, the covered
component must give a notice to the coverage subscriber at the time of
enrollment and must also send a reminder at least once every three years
that the patient can ask for the notice at any time.
4. The Notice of Privacy Practices must contain at minimum the following
information:
a. How the covered entity may use and disclose protected health
information about an individual; and
b. The individual’s rights with respect to the information and how the
individual may exercise these rights, including how the individual may
complain to the covered entity; and
c. The covered entity’s legal duties with respect to the information,
including a statement that the covered entity is required by law to
maintain the privacy of the protected health information; and
d. Whom the individuals can contact for further information about the
covered entity’s protected health information.
5. Covered components that are not required to develop a notice of privacy
practices (NOPP) include:
a. Healthcare clearinghouses, if the only PHI created or received is as a
business associate of another covered entity; or
b. Correctional institutions that have a covered healthcare provider
component; or
c. A group health plan that provides benefits only through one or more
contracts of insurance with health insurance issuers or HMOs, and that
does not create or receive PHI other than the summary health
information or enrollment/disenrollment information.
C. Accessing Medical Records to Inspect and Copy
1. Each Covered Component must create and implement procedures
providing means for patients to inspect their records, to obtain a copy of
their records, and to direct the covered entity to transmit a copy of their
records to a designated person or entity of the individual’s choice. a
procedure providing means for patients to access their medical records for
Page 5 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
purposes of inspecting and copying them. The procedure must include the
following:
2.1.
2. Procedures must include the designated record set(s) that are subject to
access by individuals and the titles of the persons or offices responsible
for receiving and possessing requests for access by individuals.
a. Provide means by which the request can be made. The Covered
Component can require the request to be made in writing.
3. Each Covered Component must allow individuals access to their PHI for
as long as the information is maintained by the covered entity, or the
Business Associate who is acting on behalf of the covered entity,
regardless of the format of the information, the location of the information,
and the date of the creation of the record.
b. Provide that the request will be acted upon within 30 days of receipt
unless the requested information is stored off-site in which case it will
be acted upon within 60 days. One 30 day extension is allowed in
cases where this is not possible but written notice must be provided to
the patient stating the reason for delay as well as the expected
completion date for response.
4. Covered Components may charge a reasonable, cost-based fee if the
individual requests a copy of the PHI and the charge is not otherwise
prohibited by State or local law. The estimated fee must be disclosed to
the requestor in advance of the charge. The fee may only include the
costs associated with the labor for copying the PHI, the supplies for
creating the copy (paper or electronic mobile media), postage, and the
preparation of a summary or explanation of the PHI, if agreed to by the
individual. The fee may not include any other costs regardless of if State
law authorizes such costs.
c. Provide means by which the patient will be notified of the steps
necessary to fulfill the request.
5. The Covered Component must:
a. Take reasonable steps to verify the identity of the individual making a
request for access. Verification may be done orally or in writing and
may be obtained in any means determined by the entity (i.e. by mail,
phone, fax, email, secure portal, etc.).
b. Provide means by which the request can be made. The Covered
Component can require the request to be made in writing, including
email or secure web portal provided that the covered component
informs the individual of this requirement.
Page 6 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
c. Provide access to the designated record set(s) within no more than 30
days of receipt of the request unless the facility is unable to
accommodate the request within that time. If the entity requires
additional time to accommodate the request, the entity must, within the
initial 30 days, inform the individual in writing of the reasons for the
delay and the date by which the covered entity will provide access.
The request must then be completed in no more than 60 days from the
date of the original request and no further extensions are permitted.
d. Not impose unreasonable measures on an individual requesting
access that serve as barriers to, or unreasonable delays in, the
individual’s access of the information.
e. Provide the medical records in the requested form or format if possible
(i.e. on paper or in electronic format)
f. Arrange a convenient time and place to pick up a copy of the PHI or to
inspect the PHI on-site should that be the request of the individual.
g. Provide a denial in writing to the requesting individual no later than 30
calendar days from the original request, or no later than 60 calendar
days if an extension was requested. The denial must: (i) be in plain
language, (ii) describe the basis for the denial, (iii) inform the requestor
of their right to have the decision reviewed (if applicable) and how to
request a review, and (iv) how the individual may submit a complaint to
the covered entity or HHS Office of Civil Rights.
h. Allow for an individual to have a denial for access reviewed by a
license healthcare professional designated by the covered entity who
did not participate in the original decision to deny unless the denial is
for one of the reasons set forth in C.5.a-i of this policy. If a review is
requested, the entity must determine whether to affirm or overturn the
denial and promptly provide written notice to the request of the
determination.
i. Inform the requestor of the location, if known, of the records if the
entity or a business associate does not maintain the PHI requested.
d. Require the medical records to be in the requested form or format if
possible.
e. Facilitate the inspection and copying.
f. Charge a reasonable fee for copying, mailing, and/or providing on
electronic media.
Page 7 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
3. Patients do not have a right of access to the following:
a. Psychotherapy notes.
b. Medical records compiled in reasonable anticipation of, or for use in, a
civil, criminal or administrative action or proceeding.
c. Information prohibited to be disclosed by other federal law (e.g., mental
health records under 42 USC § 290).
4.6. The Covered Component can deny a request for access made by
an individual where:
a. It would create an unacceptable level of risk to the security of the PHI
on its systems; or
b. The request is for psychotherapy notes; or
c. The request is for information that has been compiled in reasonable
anticipation of, or for use in, a legal proceeding; or
a. An exemption applies such as stated above or otherwise under state or
federal law.
d. The patient is a correctional inmate in certain circumstances.
Circumstances when denying access is appropriate include when
access would jeopardize the health, safety, security, custody or
rehabilitation of a patient or other inmate or the safety of any officer,
employee, person at the correctional institution or person responsible
for the transporting of the inmate. When an inmate’s request to obtain
a copy of their PHI is denied, the reason for denial must be
documented.An inmate requests a copy of their PHI held by a covered
entity that is a correctional institution, or by a healthcare provided
acting under the direction of a correctional institution AND providing
the copy would jeopardize the health, safety, security, custody, or
rehabilitation of the inmate or other inmates or the safety of
correctional officers, employees, or other persons at the institution or
who are responsible for the transporting of the inmate. However, in
these cases, an inmate retains the right to inspect their PHI; or
b. I
c.e. Information was created in the course of research that included
treatment and is still in progress, and the patient agreed to the
Page 8 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
temporary suspension denial of access when consenting to participate
in the research. In such cases the individual’s right to access is
reinstated upon completion of the research; or
d.f.Information was obtained from someone other than a health care
provider (i.e. a friend or family member) under a promise of
confidentiality and access will reveal the source.
g. The information is part of a set of records covered under the Privacy
Act, provided that the denial is consistent with the Act
e. Other circumstances in order to protect the rights of third parties (45
CFR §164.524(a) (2) and (3)).
h. The release of the record would be a clear and present danger to the
patient, the health care professional, or a third party (45 CFR
§164.524(a) (2) and (3)).The requested access is reasonably likely to
(i) endanger the life of physical safety of the individual or another
person; (ii) case substantial harm to a person other than a healthcare
provider referenced in the PHI; (iii) cause substantial harm to the
individual or another person if the access is provided to a personal
representative of the individual.
f.
D. Amending and Correcting Medical Records
A patient has the right to request an amendment of incorrect PHI.Each
Covered Component must have a process in place for patients to request
an amendment or correction to their medical record including written
documentation of the titles of the persons or offices responsible for
receiving and processing requests for amendments.
1.
1.2. The Covered Component will consider the patient’s request in
accordance with federal and state law for amendment of PHI.The Covered
Component must respond to a request no later than 60 days from the date
of the request unless the Components submits a written notification to the
requestor noting an additional 30 days extension for the request.
3. The Covered Component must inform the patient of the outcome of the
request and, if the request was denied, the reason for the denial, a notice
to the patient of their right to file a statement of disagreement that must
stay with the patient’s health record, and a description of how the patient
may submit a complaint. Reasons for denial may include:
Page 9 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
a. The information was not created by the covered entity; or
b. The information is not part of the patient’s designated record set; or
c. The information is not available for inspection as defined by CFR
§165.524; or
d. The information is deemed by the covered entity to be accurate and
complete.
4. If the requestor submits a statement of disagreement, the Covered
Component may choose to prepare a written rebuttal to the disagreement
and must provide a copy of the rebuttal to the requestor.
5. If the Covered Component accepts the request for amendment, the
component must:
a. Make the appropriate amendment to the PHI or record by identifying
the records in the designated record set(s) that are affected and
appending the information or providing a link to the location of the
amendment; and
b. Inform the requestor that the request was accepted and to obtain the
requestor’s approval to send the amended information to other relevant
persons or BAA’s that have obtained, currently hold, or have used the
impacted information; and
c. Make reasonable efforts to inform and provide the amendment to those
individuals listed in 6.b and any other individual or BAA known by the
component to have relied, or who could foreseeably rely, on the
information.
6. The Covered Component must link the identification of the designated
record set(s) subjected to the request, the request for amendment, the
written response to the request, the statement of disagreement, and the
rebuttal to the designated record set.
2. The Covered Components will each maintain a log of these requests and
the response sent to the patient.
Authorize non-treatment uses via valid authorization Provide authorization for
certain uses and disclosures of PHI
E.
1. The Covered Component may not use or disclose PHI without a valid
authorization from the patient or legal representative, except in certain
Page 10 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
circumstances as described in CFR §164.502, CFR §164.510 and CFR
§164.512.
1. The Covered Component may not use or disclose PHI without a valid
authorization except in cases where consent to treat has been given
(written, implied, verbal). When the Covered Component obtains or
receives a valid authorization, use or disclosure must be consistent with
the authorization.
2. When the Covered Component obtains or receives a valid authorization,
use or disclosure must be consistent with the authorization.
2.3. Valid Authorizations must contain the following elements:
a. A description of the information to be used or disclosed that identifies
the information in a specific and meaningful fashion.
b. The name or other specific identification of the person(s), or class of
persons, authorized to make the requested use or disclosure.
c. The name or other specific identification of the person(s), or class of
persons, to whom the Covered Component may make the requested
use or disclosure.
d. A description of each purpose of the requested use or disclosure. The
statement “at the request of the individual” is a sufficient description of
the purpose when a patient initiates the authorization and does not, or
elects not to, provide a statement of the purpose.
e. An expiration date or an expiration event that relates to the patient or
the purpose of the use or disclosure. The statement “end of the
research study,” “none” or similar language is sufficient if the
authorization is for a use or disclosure of PHI for research, including for
the creation and maintenance of a research database or research
repository.
f. Signature of the patient and date. If the authorization is signed by a
personal representative of the patient, a description of such
representative’s authority to act for the patient must also be provided.
g. Authorization forms must include statements of notice to the patient
that:
1. The requestor has the right to revoke the authorization in writing
and either,
Page 11 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
i. The exceptions to the right to revoke and a description of how
the individual may revoke the authorization; or
ii. To the extent that the information is included in the covered
component’s notice.
f.2. The covered component may not condition treatment, payment,
enrollment or eligibility for benefits on whether the individual signs
the authorization except as allowed under CFR §164.502 (b)(4).
3.4. An authorization is not valid if the document has any of the
following defects:
a. The expiration date has passed or the expiration is known by the
Covered Component to have occurred.
b. The authorization has not been filled out completely, with respect to
any element described in §IV.E.2, if applicable.
c. The authorization is known by the Covered Component to have been
revoked.
d. Any material information in the authorization is known by the Covered
Component to be false.
B.F. Minimum Necessary Disclosure
1. Even if a Covered Component is authorized to use or disclose PHI, it must
take reasonable efforts to limit the information to the minimum necessary
to accomplish the intended purpose of the use or disclosure. The
“minimum necessary” standard does not apply to the following:
a. Disclosure to a health care provider for treatment
b. Disclosure to the patient of his or her own information
c. Disclosure pursuant to an authorization requested by the patient
d. Disclosure to the Secretary of HHS to investigate compliance
e. Disclosure as required by law
f. Disclosure as required for compliance with the Privacy Standards
C.G. Receipt of an Accounting of Disclosures
Page 12 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
1. Each Covered Component must have a process in place for patients to
request an accounting of non-incidental disclosures of PHI including the
information required to be included in the accounting, the written
accounting that is provided to the individual, and the titles of the persons
or offices who are responsible for receiving and processing requests for
an accounting by individuals.
1. Patients can request a list of who has accessed their PHI maintained with
the Covered Component for the three years prior to the request.
2. Covered Components must maintain sufficient documentation of non-
incidental disclosures of each patient’s records and make this
documentation available to patients upon request.
2. Following the request for an accounting of disclosures, the Covered
Component will authenticate the patient’s identity using official
identification and will provide the accounting of disclosures within 30 days
of the request.
3. The Covered Components will each maintain audit logs of access to or
disclosure of PHI so that an accounting of disclosures can be provided.
Patients can request a list of who has accessed their PHI maintained with
the Covered Component for the six years prior to the date on which the
accounting is requested except for disclosures defined in CFR §164.528.
4. Upon receipt of a valid request for an accounting of disclosures, the
Covered Component will provide the accounting of disclosures within 30
days from receipt of the request unless a written notice of a 30 day
extension is provided to the requestor that includes a reason for the delay.
5. The Covered Component may not charge any fees for providing one
accounting of disclosures in any 12 month period however a reasonable
fee may be charged for subsequent accountings by that same individual
within that same 12 month period provided that the fee is disclosed to the
individual in advance and the individual is provided the opportunity to
modify or withdraw the request.
3.
H. Requests of privacy protection for PHI
1. Each Covered Component must have a process in place for patients to
restrict the uses or disclosures of PHI about the individual to carry out
treatment, payment, or healthcare operations and for disclosures
permitted under CFR §164.510(b).
Page 13 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
2. Each Covered Component must document a restriction and retain the
documentation for six (6) years as defined under CFR §164.530(j).
3. The Covered Component may refuse the request to restrict use and/or
disclosure of the PHI unless the disclosure is for the purpose of carrying
out payment or healthcare operations and is not otherwise required by law
and the PHI pertains solely to a healthcare item or service for which the
individual, or person other than the health plan on behalf of the individual,
has paid the covered entity in full.
4. The Covered Component must accommodate reasonable requests made
by an individual to receive communication of PHI from the Covered
Component by alternative means or at alternative locations provided that
specification is provided regarding how payment, if any, will be handled
and specification of an alternative address or method of contact is
provided
5. The Covered Component may not require an explanation from the
individual as to the basis for the request however if the Covered
Component is a health plan, the Component may require that the request
contain a statement that disclosure of all or part of the information to which
the request pertains could endanger the individual.
6. The Covered Component may terminate a restriction of uses or
disclosures if the individual agrees to the request in writing or orally and
the oral agreement is documented.
D. Request restrictions on use of health information
1. Patients have the right to request privacy protection for PHI by either
requesting that use or disclosure of PHI for treatment, payment, health
care operations or certain notification purposes be restricted or by
requesting that communication be kept confidential by communicating
through alternative means.
2. The Covered Component is not required to agree to any requested
restriction.
3. The Covered Component will maintain a log of these requests and the
response given to the patient making the request.
4. Under ARRA Amendment §13405(A), patients may request no disclosure
to the insurer if the patient pays for the medical treatment in full out-of-
pocket.
E. Request alternative channels of communication
Page 14 of 15

Policy Title: Policy Number: A2242
PATIENTS’ RIGHTS Current Adoption
Date: 10-10-2018
1. Patients have the right to request alternative means of communication
from the Covered Components providing service as long as the request is
reasonable.
F.I. Complain to the Covered Component or HHS
a. Each Covered Component must ensure that individuals are aware that
there shall be no retaliation against any individual for filing such a
complaint. Complaints can be filed with the Covered Component, with
the Maricopa County Privacy Office, or directly to Health and Human
Services’ Office of Civil Rights (HHS OCR).
b. Each Covered Component must provide individuals with information
regarding how to submit a HIPAA privacy complaint to the Covered
Component, to Maricopa County, or to HHS OCR.
a. Patients have the right to file a complaint if they believe their privacy
rights have been violated. There shall be no retaliation against the
patient for filing such a complaint. Complaints can be filed with the
Covered Component, County or directly to HHS.
b. Complaint forms for potential HIPAA Privacy violations at the County
are available on the County HIPAA website. Employees are
encouraged to complete these forms and submit them to
hipaa@mail.maricopa.gov if they believe they have witnessed
compromised PHI (See Policy A2237, HIPAA Security and Privacy
Incidents and Breaches).
Revision History
Version Revision Date Description of Revision
1 10 Dec 2014 Initial version (C-49-15-032-6-00)
2 10 Oct 2018 Revisions to improve readability and provide further
specificity for compliance.
c
Page 15 of 15