Organizational Policy

Sample Solution

Policy Title and Number: HIPAA Compliance Policy (POL-MM-005)

Department Responsible for the Policy: Chief Compliance Officer

Policy's Purpose:

This policy is designed to ensure that Moreno Medical Center complies with the Health Insurance Portability and Accountability Act (HIPAA). HIPAA is a federal law that protects the privacy of individuals' health information.

Full Answer Section

Pertinent Definitions:

• Covered entity: A healthcare provider, health plan, or healthcare clearinghouse that is subject to HIPAA's privacy and security rules.
• Protected health information (PHI): Individually identifiable health information that is transmitted or maintained by a covered entity in any form, including written, electronic, or oral.
• Use: The disclosure of PHI for a purpose that is consistent with the reason for which it was collected from the individual.
• Disclosure: The revelation of PHI to a person or entity that is not the individual or authorized to receive the PHI.

Policy:

All employees of Moreno Medical Center are required to comply with the HIPAA Privacy and Security Rules. The Privacy Rule protects the privacy of individuals' PHI. The Security Rule protects the confidentiality, integrity, and availability of PHI.

Specific requirements of the HIPAA Privacy and Security Rules include:

• Covered entities must provide individuals with a Notice of Privacy Practices (NPP), which explains how their PHI is used and disclosed.
• Covered entities must obtain individuals' written consent before using or disclosing their PHI for certain purposes, such as marketing or research.
• Covered entities must implement reasonable safeguards to protect the confidentiality, integrity, and availability of PHI.
• Covered entities must report any breaches of PHI to the Secretary of the Department of Health and Human Services (HHS) and to affected individuals.

Employees' Responsibilities:

All employees of Moreno Medical Center have a responsibility to protect the privacy and security of PHI. Employees must:

• Only access and use PHI that is necessary to perform their job duties.
• Keep PHI confidential and secure at all times.
• Be aware of the HIPAA Privacy and Security Rules and follow them.

Reporting HIPAA Violations:

Any employee who suspects a HIPAA violation must report it to their supervisor immediately. Supervisors must report all HIPAA violations to the Chief Compliance Officer.

Violations of this policy may result in disciplinary action, up to and including termination of employment.

Additional Information:

For more information about the HIPAA Privacy and Security Rules, please visit the website of the U.S. Department of Health and Human Services: https://www.hhs.gov/hipaa/index.html

HITECH Policy

Policy Title and Number: HITECH Compliance Policy (POL-MM-006)

Department Responsible for the Policy: Chief Compliance Officer

Policy's Purpose:

This policy is designed to ensure that Moreno Medical Center complies with the Health Information Technology for Economic and Clinical Health (HITECH) Act. The HITECH Act is a federal law that promotes the adoption and meaningful use of health information technology (HIT).

Pertinent Definitions:

• Health information technology (HIT): Any electronic system, application, or software that is used to collect, store, retrieve, or share health information.
• Meaningful use: The use of HIT in a way that improves the quality, safety, and efficiency of healthcare.

Policy:

Moreno Medical Center is committed to the adoption and meaningful use of HIT. Moreno Medical Center will:

• Implement and use HIT to improve the quality, safety, and efficiency of healthcare.
• Protect the privacy and security of PHI.
• Comply with all applicable laws and regulations, including the HITECH Act.

Specific requirements of the HITECH Act include:

• Covered entities must implement and use HIT to achieve meaningful use.
• Covered entities must protect the privacy and security of PHI.
• Covered entities must report their progress on meaningful use to the government.

Employees' Responsibilities:

All employees of Moreno Medical Center have a responsibility to support the adoption and meaningful use of HIT. Employees must:

• Use HIT to perform their job duties.
• Be aware of the HITECH Act and follow its requirements.

Reporting HITECH Violations:

Any employee who suspects a HITECH violation must report it to their supervisor immediately. Supervisors must report all HITECH violations to the Chief Compliance Officer.

Violations of this policy may result in disciplinary action, up to and including termination of employment.

Additional Information:

For more information about the HITECH Act, please visit the