Compliance

A risk analysis follows ePHI through the systems that actually hold it, and records what the organization decided to do about each risk it found.

Minimum necessary holds up when it is built into purpose, role, field, and workflow design. A policy statement alone leaves it to memory.

A business associate analysis starts with what a party does with protected health information, and on whose behalf.

Incident response and breach determination run on different evidence and different clocks. Keep them as separate records.

Audit controls earn their keep when the events can be interpreted, retained, protected, and reviewed by someone accountable.

Keep the privacy notice easy to find, and route patient questions to someone who can answer them on time and in writing.

Access requests go smoothly when the team verifies the request, identifies the record set, tracks the clock, and explains the outcome.

An amendment request asks to add or correct information through a defined review process, with the record history preserved.

An accounting request asks an organization to identify certain disclosures of protected health information, within HIPAA’s scope and exceptions.

An authorization is a specific permission. It names the information involved, who may disclose it, who may receive it, and for what purpose.

A complaint process should make raising a concern safe, preserve the facts, and produce a documented response without retaliation.

Effective privacy training helps people recognize the information they handle, the limits of their role, and where to take a question or an incident.

Policies, notices, authorizations, complaint records, and other required documentation each need an owner, a version, and a retention approach.