Transcription
ENTRSAFE LLCHIPAA PRIVACY ANDSECURITY POLICIES ANDPROCEDURESIntroductionThis HIPAA Privacy and Security Manual (“Manual”) sets out the policies and procedures whichhave been put in place by ENTRSAFE LLC (the “Company”) to comply with applicable privacy,security, breach notification, standards for electronic transactions, and enforcement rules underTitle II of the Health Insurance Portability and Accountability Act of 1996, as amended(“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECHAct”), enacted as part of the American Recovery and Reinvestment Act of 2009, and the HIPAAOmnibus Rule, (collectively, the “HIPAA Rules”). Capitalized terms used throughout this Manualare defined in HIPAA Privacy Policy No. 164.501 or HIPAA Security Policy No. 164.304. To theextent HIPAA requires policies and procedures not contained in this Manual, such policies andprocedures shall be deemed adopted by the Company as necessary to maintain HIPAA compliance.The HIPAA policies and procedures shall be effective on January 1, 2020 (the “Effective Date”).Questions about these policies and procedures should be addressed to the Company’s HIPAAPrivacy Official and/or Security Official, who may be contacted at the following address andphone number:Privacy Official & Security OfficialChristine NievesSenior ConsultantHIPAA Privacy & Security OfficerENTRSAFE LLC3150 SW 38th AvenueSuite 902Coral Gables, FL 33146Subject to HIPAA requirements, these rules may be amended or terminated in writing at anytime by a properly designated officer of the Company acting on its behalf.Page 1 of 80ENTRSAFE LLC
HIPAA Privacy Policy No.100ConfidentialityGeneral Statement of Policy: This Policy contains basic rules about the confidentiality ofhealth information which pertains to ENTRSAFE LLC’s employees, customers, clients andapplicants for employment.POLICYA. Health information is confidential.1. ENTRSAFE LLC (“Company”) as contractually obligated to its Covered Entity clientsand predominately hereafter, (“Business Associate”) believes that it is important tomaintain the confidentiality of personal health information about its employees, clients andapplicants for employment. This is true whether the information is protected under therequirements of HIPAA, or whether the information is not formally protected by this law.For example, medical, dental or vision information which comes from a Covered Entityand which relates to a particular person is covered by HIPAA and subject to all of therequirements of the HIPAA Privacy Rules and this Manual. This includes information fromCovered Entities about enrollment or disenrollment.Similar or identical information may be found in employment records, which are notcovered by HIPAA or the other policies and procedures contained in this Manual. Forexample, payroll records may show a person’s deductions for insurance coverages, butbecause these are employer records, they are generally not covered by HIPAA. In addition,health, dental or vision information disclosed directly by employees for employmentpurposes normally is not covered by HIPAA or the other parts of this Manual. Nevertheless,Business Associate considers all of this information private and believes that it should betreated confidentially.2. By way of example, HIPAA and the other policies and procedures in this Manualnormally do not govern a person’s health information which relates to his or her applicationor claims for group or supplemental life insurance, short or long term disability, leave underthe Family and Medical Leave Act, workers’ compensation claims, OSHA reports, returnto work or fitness for duty examinations, or the results of any drug or alcohol tests or postemployment physicals. As noted above, employer records which may contain individualhealth information, are generally not covered by HIPAA.There are many other instances of private health information which may be found in theworkplace and which are not controlled by state or federal privacy laws, but which shouldbe protected. Employees should even be careful about discussions concerning a person’shealth status. All of these matters are covered by this Policy.Page 2 of 80ENTRSAFE LLC
3. Common sense is an important part of the protection of private health information.Business Associate cannot anticipate every situation and develop a policy to deal with it,nor does it want to do this. Rather, employees should simply stop and think before actingin connection with someone’s health issues. For example, in some cases it may be fine totalk about a person’s health situation so that a group of employees can send flowers to ahospital or send meals home to someone who is recuperating (at least where the informationabout the condition was not received from a Covered Entity). In other cases, however,discussions about a Plan participants’ health condition or that of a fellow employee’sfamily member may be inappropriate and unwanted.B. Health information should be protected.1. Employees should take steps to protect the privacy of all types of health information,whether it consists of written documents, pictures, or other tangible objects, whether it isin electronic form, or even if it is simply part of a casual or business-related conversation.a. Documents or tangible objects which relate to a person’s health should behandled carefully with concern about the privacy of the information which theycontain. They should not be left lying open on desks or in workrooms where anyonepassing by might be able to see them. In some cases, it may be appropriate to limitaccess to office areas where health information is being used, and to maintain signin and out procedures so it can be demonstrated who did or did not have a documentor record. Once an employee is finished working with such a document, it shouldbe put away in a secure place and treated confidentially. That means it should bekept under lock and key when not being used. In addition, only those employeeswho have a need to review health information should have access to it or to theplaces where it may be stored or found. Mail rooms should not open letters whichappear to contain confidential health information, but rather should deliver themfor opening to the person to whom they are being sent. Unnecessary copies shouldnot be made, and controls should be placed on originals and copies so they do notbecome lost.Once there is no longer a need for a document or tangible object (and taking intoaccount any recordkeeping requirements which may be imposed by law or commonsense), the document should be destroyed by shredding or other means so that it isnot placed in the trash or where unauthorized persons may view it. Similarly, if adocument or tangible object is sent to storage or off- premises, it should be securedin such a way that outsiders will not have access to it. And, if an employee comesacross private health information inadvertently, he or she should not read thedocument, but should place it in a confidential envelope and send it to theappropriate person.b. Electronic health information should also be protected. This means that access tothe information should be limited to those who have a need for it, throughpasswords or other means. Confidentiality concerns should be taken into accountwhen systems are being developed, or reports designed, so that private healthPage 3 of 80ENTRSAFE LLC
information which is not needed cannot be viewed. Electronic firewalls should beestablished to protect private health information. Workstations should be placed sothat passersby cannot view computer screens which may contain private healthinformation. Employees who access electronic health information should make surethey do not leave their computers unattended with the information on the screen orlogged in so that unauthorized persons could access the information. Screensaversshould be used so that displays of private health information automatically turn off,with further access limited by passwords.In addition, care should be taken so that private health information is not forwardedelectronically to unauthorized persons through emails or attachments. Wheninformation is deleted, systems should be designed so that this information cannotlater be re-accessed. Hard-drives which may contain private health informationshould be destroyed or cleared before a computer which was used to access personalhealth information is discarded or assigned to use by others who are unauthorizedto view this information.c. Employees with access to private health information should not discuss it with,or in the presence of, other employees, customers, clients, plan sponsors or thirdparties who do not have a need to know about the information. Even employeeswho do not have access to private health information should be careful aboutdiscussing an individual’s health status with others. Moreover, all employeesshould take care not to spread rumors about a person’s private health informationor health status.Finally, employees who are working with private health information should makesure when passing the information on to others, whether inside or outside BusinessAssociate’s organization, that they know who they are talking to or who will receivethe information they are sending. Where appropriate, they should advise others ofthe confidentiality of this information and ensure that they will also treat theinformation confidentially. Faxes containing health information should not be sentto unsecure fax machines, or to fax machines if you do not know who will retrievethe information. Any fax which is sent should contain a cover sheet warning therecipient that the fax is confidential and only to be viewed by the person or personsto whom the fax is addressed. The cover sheet should also direct the recipient torespond to the sender immediately if the fax is received by the wrong party.C. This is a general policy.1. Employees should be informed of this confidentiality Policy when they are told aboutother confidentiality policies and important work-rules. While this Policy is part of theHIPAA Privacy Manual, it is also part of the Company’s general employment policies andtherefore also applies to Business Associate in its capacity as employer, and should beplaced with these policies so employees have access to it and may review it. Employeeswho have questions about this Policy or its application, should contact human resources atPage 4 of 80ENTRSAFE LLC
their location. Clients who have questions about this Policy or its application, shouldcontact the Company’s HIPAA Privacy Official.D. Sanctions.1. Business Associate expects its employees to take this Policy seriously. Violations of thisPolicy or of the other HIPAA privacy policies contained in this Manual will result insanctions, up to and including termination of employment.E. No rights created.1. This Policy and the other privacy policies contained in this Manual are not intended tocreate any rights in employees or third parties (other than those rights expressly stated inthis Manual), and shall not be construed to do so. These policies do not create a contract ofemployment or otherwise between Business Associate and any individual or group ofindividuals.Page 5 of 80ENTRSAFE LLC
HIPAA Privacy Policy No. 160.306General Statement of Policy: This Policy contains rules and procedures which govern anIndividual’s right to complain about HIPAA violations to the Secretary of Health andHuman Services.POLICYA. Right to file a complaint.An Individual who believes that Business Associate is not complying with the applicableportions of HIPAA’s Privacy Rules, may file a complaint with the Secretary of Health andHuman Services (“HHS”).B. Requirements for filing complaints.1. Complaints to the Secretary of HHS must meet the following requirements:a. The complaint must be in writing either on paper or electronically;b. the complaint must name the entity that is the subject of the complaint anddescribe the acts or omissions which the complaining Individual believes violateHIPAA;c. the complaint must be filed within 180 days of the date the complainingIndividual knew or should have known that the alleged improper act or omissionoccurred, unless this time limit is waived by the Secretary for good cause; andd. any other requirements which the Secretary has properly imposed.C. Investigation.The Secretary has the right to investigate complaints filed under the privacy provisions ofHIPAA. This investigation can include a review of pertinent policies, procedures or privacypractices of Business Associate, and of any circumstances regarding alleged acts oromissions relating to compliance.Page 6 of 80ENTRSAFE LLC
HIPAA Privacy Policy No. 160.310General Statement of Policy: This Policy contains rules and procedures which govern theresponsibilities of Business Associate in respect to the Secretary of Health and HumanServices.POLICYA. Providing records and compliance reports.Business Associate must keep records and submit compliance reports in the time andmanner, and containing such information, as the Secretary determines is necessary toenable him or her to determine if Business Associate has complied or is complying withthe applicable privacy requirements of HIPAA.B. Cooperation with complaint investigation and compliance reviews.Business Associate must cooperate with the Secretary if the Secretary undertakes aninvestigation or compliance review of its policies, procedures or practices to determine ifit is complying with the applicable privacy requirements of HIPAA.C. Permitting access to information.1. Business Associate must permit access by the Secretary during normal business hours toits facilities, books, records, accounts, and other sources of information, including PHI,that may be pertinent to determining Business Associate’s compliance with applicableprivacy requirements of HIPAA. If the Secretary determines that appropriate circumstancesexist (such as hidden or destroyed documents), Business Associate must permit access bythe Secretary at any time and without notice.2. If any information required from Business Associate in connection with an investigationby the Secretary is in the exclusive possession of another agency, institution or person, andthe other agency, institution or person fails or refuses to furnish the information, BusinessAssociate must certify this fact and describe the efforts it has made to obtain thisinformation.Page 7 of 80ENTRSAFE LLC
HIPAA Privacy Policy No. 164.404General Statement of Policy: This Policy describes notification procedures in the event thatthere is a breach of unsecure PHI under Section 13402 of Title XIII (Health InformationTechnology for Economic and Clinical Health Act of the American Recovery andReinvestment Act of 2009).POLICYA. PolicyIt is the policy of Business Associate to notify Covered Entity clients and affectedIndividuals if there is a breach of unsecured PHI. Notification of a breach of unsecure PHIshall be carried out in accordance with federal and state law. Notification of a breach shallbe delayed if a law enforcement official states that a notification of the breach wouldimpede a criminal investigation or cause damage to national security.1. A breach is the unauthorized acquisition, access, use, or disclosure of PHI in a mannernot permitted by the HIPAA Rules which compromises the security or the privacy of theIndividual’s PHI.a. A breach does not include:i. unintentional access, acquisition or use by a Workforce Member actingunder authority and in good faith, so long as not further disclosed in amanner not permitted by the Privacy Rule;ii. inadvertent disclosure from a Workforce Member authorized to accessPHI to a co-employee authorized to access PHI, so long as not furtherdisclosed in a manner not permitted by the Privacy Rule; oriii. unauthorized disclosure to an unauthorized person who cannotreasonably be able to retain the information disclosed.2. PHI is unsecured if it is not rendered unusable, unreadable, or indecipherable tounauthorized individuals through the use of a technology or methodology approved byHealth and Human Services, as revised from time to time.B. ProceduresPage 8 of 80ENTRSAFE LLC
1. Determination of Breacha. The Privacy Official shall determine whether or not a breach has occurred suchthat a breach notice is required. All unauthorized acquisition, access, use, ordisclosure of PHI shall be reported to the Privacy Official immediately.b. There is a presumption that a breach has occurred and there will be a noticerequirement unless the below risk assessment demonstrates a low probability thatthe PHI has been compromised.i. The Privacy Official’s risk assessment must consider at least thefollowing four factors:(A) The nature and extent of the PHI involved, including thelikelihood of re-identification;(B) The identity of the unauthorized user or recipient, includingtheir duty to protect PHI;(C) Whether the PHI was actually acquired or viewed; and(D) The extent to which the risk to PHI has been mitigated.2. Notice to the Covered Entitya. Business Associate shall give the relevant Covered Entity notice of a breachinvolving that Covered Entity’s PHI without unreasonable delay and in no case laterthan 60 calendar days after the discovery of the breach (or the date the breach shouldhave been discovered if reasonable diligence had been exercised).b. Notice to the Covered Entity shall include all information listed in B(3)(c)below.3. Notice to the Individual, if applicable per Business Associate Agreementa. Notification of a breach shall be provided without unreasonable delay and in nocase later than 60 calendar days after the discovery of the breach (or the date thebreach should have been discovered if reasonable diligence had been exercised).b. Written notification shall be provided by first-class mail to affected Individualsat their last known address. Individuals may elect to receive notificationelectronically. Where an Individual has agreed to electronic notification, writtennotice is not required. In the event that it is known that the Individual is deceased,notification shall be provided to the next of kin or personal representative of theIndividual.Page 9 of 80ENTRSAFE LLC
c. Written notification to affected Individuals shall include, to the extent possible:i. A brief description of what happened, including the date of the breachand the date of the discovery of the breach, if known;ii. A description of the types of unsecure PHI that were involved in thebreach (such as whether full name, social security number, date of birth,home address, account number, diagnosis, disability code, or other types ofinformation were involved);iii. Any steps Individuals should take to protect themselves from potentialharm resulting from the breach;iv. A brief description of what is being done in regards to the investigationof the breach, to mitigate harm to Individuals, and to protect against anyfurther breaches; andv. Contact procedures for Individuals to ask questions or learn additionalinformation, which shall include a toll-free telephone number and an emailaddress, website, or postal address.d. If urgent, in addition to written notification, the Privacy Official shall call viatelephone the affected Individuals.e. In the event that there is insufficient or out-of-date contact information for anIndividual, substitute notice shall be provided. If there are fewer than 10 Individualsfor whom there is insufficient or out-of-date contact information, substitute noticeshall be provided by an alternative form of written notice, telephone, or othermeans. If there are 10 or more Individuals for whom there is insufficient or out-ofdate contact information, substitute notice be provided by either:i. a conspicuous posting on the Covered Entity’s or Business Associate’swebsite for a period of 90 days with a toll-free number, orii. conspicuous notices in major print or broadcast media in geographicareas where the Individuals affected by the breach likely reside whichinclude a toll-free phone number that remains active for at least 90 dayswhere an Individual can learn whether the Individual’s unsecure PHI maybe included in the breach.f. If a law enforcement official provides a written statement that a notification ofthe breach would impede a criminal investigation or cause damage to nationalsecurity, and the statement specifies the time for which a delay is required,notification shall be delayed for the time specified. If a law enforcement officialprovides an oral statement that a notification of the breach would impede a criminalinvestigation or cause damage to national security, such statement shall bePage 10 of 80ENTRSAFE LLC
documented and notification shall be delayed no longer than 30 days from the dateof the oral statement.HIPAA Privacy Policy No. 164.501General Statement of Policy: This Policy contains definitions which apply to the otherpolicies and procedures contained in this HIPAA Privacy and Security Manual.DEFINITIONSA. Authorization. A document signed by an Individual authorizing disclosure of ProtectedHealth Information and complying with the requirements of Privacy Policy No. 164.508.B. Breach. The term “Breach” shall have the meaning defined in 45 CFR § 164.402.C. Breach Notification Rule or Rules. The term shall mean the Standards and ImplementationSpecifications for Notification of Breaches of Unsecured Protected Health Information under 45CFR Parts 160 and 164, subparts A and D.D. Business Associate. The term “Business Associate” means:1. ENTRSAFE LLC, when it performs work on behalf of its clients as a “businessassociate”, as that term is defined in 45 CFR § 160.103 and generally means:A person or entity who:a. On behalf of a Plan (or an Organized Health Care Arrangement in which the Planparticipates), but other than in the capacity as a Workforce Member, performs, orassists in performing:i. a function or activity involving the use or disclosure of PHI, includingclaims processing or administration, data analysis, processing oradministration, utilization review, quality assurance, billing, benefitmanagement, patient safety activities, practice management or repricing; orii. any other function or activity regulated by the Privacy Rules; orb. other than in the capacity of a Workforce Member, provides legal, actuarial,accounting, consulting, Data Aggregation, management, administrative,accreditation, or financial services for a Plan (or for an Organized Health CareArrangement in which the Plan participates), where providing these servicesinvolves the disclosure of PHI from a Plan or Arrangement, or from anotherBusiness Associate of the Plan or Arrangement, to the person; orc. other than in the capacity of a Workforce Member, creates, receives, maintainsPage 11 of 80ENTRSAFE LLC
or transmits PHI on behalf of a Covered Entity; ord. is a Health Information Organization, E-prescribing Gateway or other person orentity that provides data transmission services with respect to PHI to a CoveredEntity that requires routine access to such PHI (except courier services and internetservice providers); ore. a person who offers a personal health record to one or more Individuals onbehalf of a Covered Entity; orf. a Subcontractor that creates, receives, maintains or transmits PHI on behalf ofa Business Associate.2. A member of the Plan’s Workforce, or of the Organized Health Care Arrangement’sWorkforce, is not a Business Associate. In addition, a Covered Entity which participates inan Organized Health Care Arrangement, and that performs a function, activity or servicefor the Arrangement as described above, does not through these roles become a BusinessAssociate of the other Covered Entities participating in the Arrangement. Finally, aCovered Entity may be a Business Associate of another Covered Entity.E. Covered Entity. The term “Covered Entity” shall have the meaning defined in 45 CFR § 160.103and generally means a health plan, a health care clearing house, or a Health Care Provider whotransmits Health Information in electronic form in connection with a transaction covered byHIPAA Privacy Rules.F. Data Aggregation. The term “Data Aggregation” means the activity of Business Associate or aCovered Entity when it combines PHI to permit data analysis that relates to Health Care Operationsof a Covered Entity.G. De-Identified Information. The term “De-Identified Information” is defined at Part B ofPrivacy Policy No. 164.514.H. Designated Record Set. The term “Designated Record Set” means a group of recordsmaintained by or for a Covered Entity, consisting of:1. medical and billing records about Individuals maintained by or for a covered HealthCare Provider;2. the enrollment, payment, claims adjudication, and case or medical management recordsystems maintained by or for a health plan; or3. the group of records maintained by or for a Plan which is used in whole or part tomake decisions about Individuals.Page 12 of 80ENTRSAFE LLC
For purposes of this definition, the term “record” means any item, collection or groupingof information that includes PHI, and that is maintained, collected, used or disseminatedby or for a Covered Entity.I. Effective Date. The term “Effective Date” means the date these policies and procedures are firsteffective. The Effective Date is generally defined throughout this Manual as January 1, 2020.J. Family Member. The term “Family Member” means a dependent (as defined in 45 CFR 144.103)of the Individual and any person who is a first, second, third or fourth degree relative of theIndividual or his or her dependent. First degree relatives include parents, spouses, siblings andchildren. Second degree relatives include grandparents, grandchildren, aunts, uncles, nephews andnieces. Third degree relatives include great-grandparents, great- grandchildren, great aunts, greatuncles and first cousins. Fourth degree relatives include great- great-grandparents, great-greatgrandchildren and children of first cousins.K. Genetic Information. The term “Genetic Information” means information about an Individual’sgenetic tests or genetic tests of Family Members, the manifestation of a disease or disorder inFamily Members of the Individual, any request for or receipt from genetic services (test,counseling or education) or participation in clinical genetic research by the Individual or FamilyMember. Genetic Information includes genetic information about a fetus or embryo. GeneticInformation does not include information about the sex or age of an Individual.L. Health Care. The term “Health Care” means care, services or supplies related to the health ofan individual. “Health Care” includes, but is not limited to:1. preventative, diagnostic, therapeutic, rehabilitative, maintenance, palliative care,counseling, service, assessment or procedure with respect to the physical or mentalcondition, or functional status, of an Individual, or that affects the structure or function ofthe body; and2. sale or dispensing of a drug, device, equipment, or other item in accordance with aprescription.M. Health Care Operations. The term “Health Care Operations” is defined in Privacy Policy No.164.506.N. Health Care Provider. The term “Health Care Provider” means a provider of services, includinga provider of medical or health services, as defined in the Social Security Act, and any other personor organization that furnishes, bills, or is paid for Health Care in the normal course of business.O. Health Information. The term “Health Information” means any information, whether oral orrecorded in any form or medium, that:1. is created or received by a Health Care Provider, health plan, public health authority,employer, life insurer, school, university or health care clearing house; andPage 13 of 80ENTRSAFE LLC
2. relates to the past, present or future physical or mental health or condition of anIndividual, the provision of health care to an Individual, or the past, present or futurepayment for the provision of health care to an Individual; or3. is Genetic Information.P. Health Insurance Issuer. The term “Health Insurance Issuer” means an insurance company,insurance service, or insurance organization (including an HMO) that is licensed to engage in thebusiness of insurance in a state and is subject to state law that regulates insurance. The term doesnot include a group health plan.Q. HHS. The term “HHS” means the United States Department of Health and Human Services.R. HIPAA. The term “HIPAA” refers to Title II of the Health Insurance Portability andAccountability Act of 1996.S. HIPAA Rules. The term “HIPAA Rules” shall mean the Privacy Rule, Security Rule, BreachNotification Rule, Standard Transaction rules and enforcement provisions in 45 CFR Parts 160,162 and 164.T. Individual. The term “Individual” shall mean the person who is the subject of PHI.U. Individually Identifiable Health Information. The term “Individually Identifiable HealthInformation” means Health Information, including demographic information, taken from anIndividual which either identifies the Individual or with respect to which there is a reasonable basisto believe the information can be used to identify the Individual.V. Limited Data Set. The term “Limited Data Set” is defined at Part E(2) of Privacy Policy No.164.514.W. Marketing. The term “Marketing” means to make a communication about a product or servicethat encourages recipients of the communication to purchase or use the product or service, unlessthe communication is made:1. to describe a health-related product or service (or payment for such a product or service)that is covered by a Plan, including communications about the entities participating in aHealth Care Provider network or health plan network; replacement of or enhancements toa Plan; and health-related products or services available only to Plan enrollees that addvalue to, but are not covered
extent HIPAA requires policies and procedures not contained in this Manual, such policies and procedures shall be deemed adopted by the Company as necessary to maintain HIPAA compliance. The HIPAA policies and procedures shall be effective on January 1, 2020 (the "Effective Date"). Questions about these policies and procedures should be .
