|
HIPAA Administrative To Do List
Our HIPAA
Administrative To Do List is designed to help you plan for and implement the practices and policies
necessary to comply with the privacy
regulations outlined in HIPAA. This is not an all
encompassing list, but some useful ideas on where and how to begin
your compliance efforts.
Perform
Gap Analysis - Practice
Walk Through
Perform
a Gap Analysis to determine what's in violation
of HIPAA regs
Implement
safeguards
Begin
or Update Data Mapping
Begin
mapping where your data resides, how and where it
moves to as well as who, in and out of your
practice, has access to it. Document it's
"path".
Prepare Practice
Privacy Policy
Prepare, post
and have available privacy policy notice in practice, on
practice web site. Notice must be in plain
language. Include effective date of notice.
Provide name
and contact information of
privacy officer on notice,
Provide
instructions how to file a complaint within
the practice and with the DHHS.
List
the practice's
responsibilities under HIPAA and explain all of
the patient's privacy rights.
Prepare
Authorization Forms
Secure
Business Associate Agreements
Develop
comprehensive list of those vendors or entities
who work with your practice and have access to
PHI. Examples are billing firms, collection
agencies, auditors, consulting, transcription
and cleaning companies.
Understand what
PHI is the minimum amount necessary for those
individuals/entities to accomplish their
intended purpose. (Note: Clarification
of "minimum necessary" to be further
clarified)
Develop
HIPAA compliant agreements for business
associates (BA) that ensure that the BA will
safeguard PHI, have assess to only what is
minimally necessary to carry out their function,
BA must destroy or return information to CE upon
contact term, and that the contract will
terminate if the BA violates the stipulations of
the contract.
Obtain signed
written agreements from BAs who have
access to personal identifiable data from your
practice.
Eliminate
all existing verbal contacts with BAs.
Develop
& Distribute Employee
Confidentiality
Agreements
Obtain signed
confidentiality statements with employees.
Retain in employee files.
Establish
employee training programs on confidentiality
and document that training.
Include
what training materials were distributed. Every
course should be documented. Keep materials as
proof.
Don't
give a new employee access to confidential health
information until s/he completes security and
privacy training and that completed training is
documented in the employee record.
Consider
Temporary
Staff
Create
and assign a generic system user name for
temporary workers for the day, week or duration
of assignment.
Keep
password unique, however, to the temporary
worker. The password should expire at the end of
the day, week or duration of assignment.
Keep
a written record of the temporary worker's user
name and password. This will allow you to
audit/monitor that staff's usage of practice
systems.
Appoint a
Practice Privacy Officer
Monitor Systems
and Document Policies
|
