A. 45 CFR, 160, Code of Federal Regulations, Title 45, Part 160, Subpart C, General Administrative Requirements, Compliance and Enforcement vi .
B. 45 CFR, 164.514(e), Code of Federal Regulations, Title 45, Part 164, Subpart E, Security and Privacy,
Privacy of Individually Identifiable Health Information vii .
C. 45 CFR, 164.530, Code of Federal Regulation, Security and Privacy, Administrative Requirements viii .
D. Records Management Policy ix .
E. Uses and Disclosures of Health Information With and Without an Authorization Policy x .
RowanSOM Departments and RowanSOM owned or operated facilities shall appropriately protect the privacy of health information that can identify an individual in compliance with federal and state law. RowanSOM will act responsibly in the maintenance, retention and eventual destruction and disposal of all material containing PHI, which includes PHI on fax and copier machine hard drives. The destruction and disposal of PHI will be carried out in accordance with HIPAA regulations and RowanSOM policy. All PHI will be destroyed in a manner in which it cannot be recovered or reconstructed. Medical records will be maintained and destroyed in accordance with the RowanSOM policy, Records Management.
A. Attachment 1 - Procedures for the Destruction/Disposal of All Protected Health Information (PHI)
B. Attachment 2 - Hyperlinks
By Direction of the President:
Signature on file
RowanSOM Chief Compliance & Privacy Officer
PROCEDURES FOR THE DESTRUCTION/DISPOSAL OF ALL PROTECTED HEALTH INFORMATION (PHI)
A. The destruction/disposal of all PHI will be accomplished by shredding, incineration or other comparable fashion that ensures that the PHI cannot be recovered or reconstructed. Material that has been destroyed must be stored in a secure container or receptacle, which is not in a publicly accessible location, until, such time that the material is collected by Housekeeping Services or outside agency responsible for trash collection.
B. Until such time as destruction/disposal of PHI is permissible, all PHI will be secured against unauthorized or inappropriate access.
C. If utilizing an outside agency for destruction/disposal of PHI, a contract and a business associate agreement must be executed between RowanSOM and the outside agency. The contract must provide that upon termination of same, the agency will return or destroy/dispose of all PHI, including proof of destruction/disposal and the methodology by which the material was destroyed.
ATTACHMENT 2 Health Insurance Portability and Accountability Act of 1996 (HIPAA) Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 Omnibus Privacy Final Rule of 2013 Family Educational Rights and Privacy Act, as amended, 20 U.S.C. 1232g 20 U.S.C. 1232g(a)(4)(B)(iv) 45 CFR, 160, Code of Federal Regulations, Title 45, Part 160, Subpart C, General Administrative Requirements, Compliance and Enforcement. 45 CFR, 164.514(e), Code of Federal Regulations, Title 45, Part 164, Subpart E, Security and Privacy, Privacy of Individually Identifiable Health Information. 45 CFR, 164.530, Code of Federal Regulation, Security and Privacy, Administrative Requirements. Records Management Policy Uses and Disclosures of Health Information With and Without an Authorization Policy