HIPAA
Health Insurance Portability & Accountability Act

How to Comply
To be disposed of electronic media that contains PHI must have the PHI destroyed in such a manner that it “can not be practicably read or reconstructed." They must implement a procedure that minimizes any risk of lost electronic PHI. Choices focus on performing the data destruction in house or utilizing a data destruction service. If they decide to perform the data destruction in house, they must have procedures in place to provide on going evaluation and maintenance of the process. If they decide to use a data destruction service, they must have a “Business Associates Contract” signed and “due diligence” documentation supporting the vendors data destruction service.

Effective compliance requires organization-wide implementation.
Compliance requirements include:
  ▪ Building initial organizational awareness of HIPAA

  ▪ Comprehensive assessment of the organization’s privacy practices, information security systems and procedures, and use of     electronic transactions

  ▪ Developing an action plan for compliance with each rule

  ▪ Developing a technical and management infrastructure to implement the plans

  ▪ Implementing a comprehensive implementation action plan, including:


- Developing new policies, processes, and procedures to ensure privacy, security and patients’ rights

- Building business associate agreements with business partners to support HIPAA objectives

- Developing a secure technical and physical information infrastructure

- Updating information systems to safeguard protected health information (PHI) and enable use of standard claims       and related transactions

- Training of all workforce members

- Developing and maintaining an internal privacy and security management and enforcement infrastructure,       including providing a Privacy Officer and a Security Officer