HIPAA Policy
HIPAA Policy
Purpose
Caring Hands Medical Clinic, LLC (“Caring Hands,” “Clinic,” or “Organization”) is committed to protecting the privacy, confidentiality, integrity, and security of patients’ protected health information (“PHI”).
This HIPAA Compliance Policy establishes the requirements and procedures Caring Hands Medical Clinic, LLC will follow to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, including the HIPAA Privacy, Security, and Breach Notification Rules.
The purpose of this policy is to:
- Protect the privacy and confidentiality of patient information.
- Establish safeguards for electronic, paper, and verbal PHI.
- Limit the use and disclosure of PHI to permitted or required circumstances.
- Provide patients with appropriate rights concerning their PHI.
- Protect electronic protected health information (“ePHI”) from unauthorized access, alteration, destruction, or disclosure.
- Establish procedures for identifying, responding to, documenting, and reporting privacy and security incidents.
- Establish workforce responsibilities for HIPAA compliance.
- Ensure appropriate oversight of Business Associates and their handling of PHI.
- Promote a culture of privacy, security, accountability, and continuous compliance.
SCOPE
This policy applies to:
- All employees of Caring Hands Medical Clinic, LLC.
- Physicians, advanced practice providers, nurses, medical assistants, and clinical personnel.
- Administrative, billing, scheduling, and support personnel.
- Temporary employees, interns, students, volunteers, and contractors.
- Medical staff and other individuals granted access to Clinic systems or PHI.
- Business Associates and, where applicable, Business Associate subcontractors.
This policy applies to PHI in all forms, including:
- Electronic PHI.
- Paper records.
- Printed documents.
- Verbal communications.
- Photographs and images.
- Electronic communications.
- Information contained in medical records, billing records, appointment systems, laboratory systems, and other Clinic systems.
Definitions
Protected Health Information (PHI)
PHI means individually identifiable health information created, received, maintained, or transmitted by the Clinic that relates to an individual’s health condition, healthcare services, or payment for healthcare services.
Electronic Protected Health Information (ePHI)
ePHI is PHI that is created, received, maintained, or transmitted electronically.
Workforce
Workforce includes employees, volunteers, trainees, and other persons whose conduct is under the direct control of Caring Hands Medical Clinic, LLC, whether or not they are paid by the Clinic.
Business Associate
A Business Associate is a person or organization that performs certain functions or services for or on behalf of the Clinic that involve the use or disclosure of PHI.
Breach
A breach generally means an impermissible acquisition, access, use, or disclosure of PHI that compromises the security or privacy of the PHI, subject to applicable regulatory exceptions and required risk assessment.
Minimum Necessary
The Clinic will make reasonable efforts to limit uses, disclosures, and requests for PHI to the minimum necessary to accomplish the intended purpose, when the HIPAA minimum-necessary standard applies.
HIPAA Privacy Responsibilities
Caring Hands Medical Clinic, LLC will establish and maintain reasonable administrative, technical, and physical safeguards to protect PHI.
The Clinic will not use or disclose PHI except as permitted or required by law and applicable Clinic policies.
PHI may be used or disclosed without patient authorization when permitted or required by HIPAA, including, as applicable, for:
- Treatment.
- Payment.
- Healthcare operations.
- Public health activities.
- Certain judicial and administrative proceedings.
- Law enforcement purposes permitted by law.
- Serious threats to health or safety.
- Workers’ compensation purposes.
- Other circumstances specifically permitted or required by law.
Uses or disclosures not otherwise permitted by HIPAA generally require a valid patient authorization.
Minimum Necessary Standards
Caring Hands Medical Clinic, LLC will limit access to PHI based on workforce members’ job responsibilities.
Workforce members shall only access, use, or disclose the PHI necessary to perform their assigned duties.
Examples include:
- Front-desk personnel should have access only to information necessary to schedule, register, and communicate with patients.
- Billing personnel should have access to information necessary to perform billing and payment functions.
- Clinical personnel may access PHI necessary to provide patient care.
- Administrative personnel may access PHI necessary for their assigned responsibilities.
The minimum-necessary standard does not apply to certain HIPAA-permitted disclosures, including disclosures for treatment purposes where applicable.
Patient Rights
Caring Hands Medical Clinic, LLC will provide patients with the rights afforded under HIPAA and applicable law.
Subject to applicable requirements and limitations, patients may have the right to:
- Receive a Notice of Privacy Practices.
- Inspect and obtain copies of their PHI.
- Request amendments to their PHI.
- Request restrictions on certain uses and disclosures.
- Request confidential communications.
- Receive an accounting of certain disclosures.
- File a complaint concerning privacy practices.
- Receive notification following a breach when required by law.
The Clinic will not retaliate against an individual for exercising a HIPAA right or filing a privacy complaint.
Notice of Privacy Practicies
Caring Hands Medical Clinic, LLC will maintain and provide a Notice of Privacy Practices (“NPP”) as required by HIPAA.
The NPP will describe, as applicable:
- How the Clinic may use and disclose PHI.
- Patient rights.
- The Clinic’s legal duties concerning PHI.
- How patients may submit privacy complaints.
- How patients may contact the Clinic regarding privacy practices.
The Clinic will make reasonable efforts to obtain acknowledgment of receipt of the NPP when required.
Authorizations
When a use or disclosure of PHI requires patient authorization, the Clinic will obtain a valid authorization before making the disclosure.
Authorizations must meet applicable HIPAA requirements and should clearly identify:
- The information to be disclosed.
- The person or entity authorized to make the disclosure.
- The person or entity receiving the information.
- The purpose of the disclosure, when required.
- An expiration date or event, when required.
- The patient’s signature and date.
Employees must not create or modify patient authorizations without following approved Clinic procedures.
Verbal Communications
Workforce members must take reasonable precautions when discussing PHI.
Examples include:
- Avoid discussing patient information where unauthorized persons can overhear.
- Use private areas when discussing sensitive information whenever practical.
- Verify the identity and authority of individuals requesting PHI.
- Avoid leaving patient information visible in public or shared areas.
- Use discretion when calling patients or leaving voicemail messages.
- Do not discuss patient information with family members, friends, visitors, or other unauthorized individuals without appropriate permission or legal authority.
Paper Records & Security
Paper PHI must be protected from unauthorized access, loss, theft, or disclosure.
Workforce members must:
- Secure medical records when not in use.
- Avoid leaving patient records unattended in public areas.
- Dispose of PHI using approved secure disposal methods.
- Use shredding or other appropriate destruction methods for sensitive documents.
- Keep workstations and filing areas reasonably secure.
- Immediately report lost or stolen records.
Patient records must not be removed from the Clinic unless authorized for legitimate business or clinical purposes.
Passwords & Authentication
Workforce members must:
- Maintain the confidentiality of passwords.
- Use passwords consistent with Clinic security requirements.
- Avoid writing passwords in publicly accessible locations.
- Never use another person’s credentials.
- Never allow another person to use their account.
- Report suspected credential compromise immediately.
Where implemented, the Clinic may require multi-factor authentication for systems containing sensitive information.
Telehealth
Where Caring Hands Medical Clinic, LLC provides telehealth services, the Clinic will use appropriate technology and procedures designed to protect patient privacy and security.
Workforce members must:
- Use Clinic-approved telehealth platforms.
- Conduct telehealth sessions in reasonably private locations.
- Verify patient identity when appropriate.
- Avoid unauthorized recording of telehealth visits.
- Protect login credentials.
- Follow applicable telehealth and HIPAA requirements.
Employee HIPAA Training
All workforce members will receive HIPAA privacy and security training appropriate to their duties.
Training will occur:
- Upon hire or before access to PHI, as appropriate.
- Periodically thereafter.
- When material changes to HIPAA requirements or Clinic policies occur.
- When an employee’s responsibilities require additional training.
Training may cover:
- HIPAA Privacy Rule requirements.
- HIPAA Security Rule requirements.
- Confidentiality.
- PHI handling.
- Password security.
- Social media.
- Email and electronic communications.
- Incident reporting.
- Breach response.
- Patient rights.
- Business Associate requirements.
Training completion will be documented.
Employee Responsibilities
Every workforce member is responsible for protecting PHI.
Employees must:
- Access PHI only when authorized.
- Use PHI only for legitimate work-related purposes.
- Follow the minimum-necessary principle when applicable.
- Protect passwords and credentials.
- Secure paper and electronic records.
- Follow Clinic privacy and security procedures.
- Report suspected violations immediately.
- Complete required HIPAA training.
- Cooperate with investigations.
- Maintain confidentiality after leaving the Clinic.
Business Associates
Caring Hands Medical Clinic, LLC will identify vendors and other organizations that qualify as Business Associates under HIPAA.
Where required, the Clinic will execute a written Business Associate Agreement (“BAA”) before permitting a Business Associate to create, receive, maintain, or transmit PHI on behalf of the Clinic.
BAAs will address applicable requirements, including:
- Permitted and required uses and disclosures.
- Safeguards for PHI.
- Reporting of unauthorized uses or disclosures.
- Reporting of security incidents and breaches.
- Subcontractor requirements.
- Return or destruction of PHI when appropriate.
- Compliance with applicable HIPAA requirements.
Business Associates will be monitored according to the Clinic’s risk management procedures.
Privacy & Security Incident Reporting
Workforce members must immediately report suspected or actual privacy or security incidents.
Examples include:
- Sending PHI to the wrong recipient.
- Lost or stolen medical records.
- Lost or stolen devices.
- Unauthorized access to medical records.
- Unauthorized disclosure of PHI.
- Misuse of passwords.
- Phishing or suspected malware.
- Unauthorized screenshots or photographs.
- Improper disposal of PHI.
- Accessing a patient’s record without a legitimate business or clinical reason.
Employees should not attempt to conceal an incident.
Breach Response
When a potential breach is reported, Caring Hands Medical Clinic, LLC will conduct an appropriate investigation and risk assessment consistent with HIPAA requirements.
The investigation may include:
- Identifying the information involved.
- Determining whether PHI was acquired, accessed, used, or disclosed.
- Identifying the individuals affected.
- Determining the recipient or unauthorized party, when applicable.
- Assessing the likelihood that the PHI has been compromised.
- Identifying steps to mitigate potential harm.
- Determining whether notification is required.
- Documenting the investigation and conclusions.
Where notification is required, the Clinic will provide notice to affected individuals and applicable regulatory authorities within the timeframes required by law.
The Clinic will maintain appropriate documentation of breach investigations and notifications.
Incident Mitigation
When a privacy or security incident occurs, Caring Hands Medical Clinic, LLC will take reasonable steps to mitigate harmful effects.
Depending on the circumstances, mitigation may include:
- Retrieving information that was improperly disclosed.
- Requesting deletion or destruction of improperly received PHI.
- Resetting compromised credentials.
- Disabling accounts.
- Securing affected devices.
- Correcting inaccurate information.
- Providing appropriate patient notifications.
- Implementing additional safeguards.
Risk Analysis & Management
Caring Hands Medical Clinic, LLC will conduct periodic risk assessments to identify reasonably anticipated threats and vulnerabilities to PHI and ePHI.
Risk assessments may consider:
- Physical security.
- Information systems.
- Access controls.
- Workforce practices.
- Vendors and Business Associates.
- Mobile devices.
- Remote access.
- Cybersecurity threats.
- Backup and disaster recovery.
- Incident response.
- Administrative safeguards.
- Technical safeguards.
The Clinic will implement reasonable measures to reduce identified risks to an appropriate level.
Contingency Planning
Clinic will maintain reasonable procedures to protect PHI and restore critical systems following emergencies or disruptions.
Depending on the Clinic’s operations, contingency procedures may include:
- Data backups.
- Disaster recovery procedures.
- Emergency access procedures.
- Business continuity procedures.
- Critical system recovery procedures.
- Emergency contact lists.
- Periodic testing of recovery procedures.
Backups containing PHI must be protected from unauthorized access.
Patient Complaints
Patients may submit complaints concerning the Clinic’s privacy practices.
The Clinic will investigate complaints in a timely manner and will not retaliate against individuals for exercising their rights or submitting complaints.
Individuals may also have the right to submit complaints to the U.S. Department of Health and Human Services, Office for Civil Rights.
Policy Review
This policy will be reviewed periodically and whenever significant changes occur in:
- HIPAA requirements.
- Federal or state privacy laws.
- Clinic operations.
- Information systems.
- Security risks.
- Business Associate relationships.
- Regulatory guidance.
Changes will be documented and approved by appropriate Clinic leadership.
Policy Statement
Caring Hands Medical Clinic, LLC is committed to maintaining the highest reasonable standards of patient privacy, confidentiality, and information security. Every workforce member has a responsibility to protect patient information and to promptly report concerns or suspected violations.
HIPAA compliance is an ongoing organizational responsibility and requires active participation from leadership, clinical personnel, administrative staff, contractors, and Business Associates.