-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathnewhtml.html
2730 lines (2711 loc) · 434 KB
/
newhtml.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<!-- saved from url=(0104)https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html?language=es -->
<html lang="en" class="js">
<head profile="http://www.w3.org/1999/xhtml/vocab">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<script src="./Audit Protocol _ HHS.gov_files/quant.js.download" async="" type="text/javascript"></script>
<script type="text/javascript" async="" src="./Audit Protocol _ HHS.gov_files/analytics.js.download"></script>
<script type="text/javascript" id="www-widgetapi-script" src="./Audit Protocol _ HHS.gov_files/www-widgetapi.js.download" async=""></script>
<script type="text/javascript" async="" src="./Audit Protocol _ HHS.gov_files/linkid.js.download"></script>
<script async="" src="./Audit Protocol _ HHS.gov_files/analytics.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/iframe_api"></script>
<script async="" src="./Audit Protocol _ HHS.gov_files/analytics.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/7360.js.download" async="" type="text/javascript"></script>
<script type="text/javascript" src="./Audit Protocol _ HHS.gov_files/300lo.json"></script>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<link rel="shortcut icon" href="https://www.hhs.gov/sites/all/themes/iia/favicon.ico" type="image/vnd.microsoft.icon">
<meta name="description" content="The OCR HIPAA Audit program">
<meta name="generator" content="Drupal 7 (http://drupal.org)">
<link rel="canonical" href="https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html?language=es">
<link rel="shortlink" href="https://www.hhs.gov/node/3778?language=es">
<link rel="publisher" href="https://plus.google.com/+HHS">
<meta property="og:type" content="article">
<meta property="og:site_name" content="HHS.gov">
<meta property="og:url" content="https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html?language=es">
<meta property="og:title" content="Audit Protocol">
<meta property="og:description" content="The OCR HIPAA Audit program">
<meta property="og:updated_time" content="2016-04-01 00:00:00">
<meta name="twitter:card" content="summary">
<meta name="twitter:site" content="@HHSgov">
<meta name="twitter:url" content="https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html?language=es">
<meta name="twitter:title" content="Audit Protocol">
<meta name="twitter:description" content="The OCR HIPAA Audit program">
<meta property="article:published_time" content="2015-11-08 00:00:00">
<meta property="article:modified_time" content="2016-04-01 00:00:00">
<meta itemprop="description" content="The OCR HIPAA Audit program">
<meta itemprop="name" content="Audit Protocol">
<meta name="dcterms.creator" content="Office for Civil Rights (OCR)">
<meta name="dcterms.title" content="Audit Protocol">
<meta name="dcterms.description" content="The OCR HIPAA Audit program">
<meta name="dcterms.date" content="2015-11-08 00:00:00">
<meta name="dcterms.modified" content="2016-04-01 00:00:00">
<meta name="dcterms.type" content="Text">
<meta name="dcterms.format" content="text/html">
<meta name="dcterms.identifier" content="https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/audit/protocol/index.html?language=es">
<title>Audit Protocol from HHS.gov</title>
<style> @import url("https://www.hhs.gov/modules/system/system.base.css?ok543r");</style>
<style>
@import url("https://www.hhs.gov/sites/all/modules/date/date_api/date.css?ok543r");
@import url("https://www.hhs.gov/sites/all/modules/date/date_popup/themes/datepicker.1.7.css?ok543r");
@import url("https://www.hhs.gov/modules/field/theme/field.css?ok543r");
@import url("https://www.hhs.gov/sites/all/modules/freepager/freepager.css?ok543r");
@import url("https://www.hhs.gov/sites/all/modules/views/css/views.css?ok543r");
</style>
<style>
@import url("https://www.hhs.gov/sites/all/modules/ctools/css/ctools.css?ok543r");
@import url("https://www.hhs.gov/sites/all/modules/panels/css/panels.css?ok543r");
@import url("https://www.hhs.gov/modules/locale/locale.css?ok543r");
</style>
<link type="text/css" rel="stylesheet" href="./Audit Protocol _ HHS.gov_files/bootstrap.min.css" media="all">
<style>
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/bootstrap.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/overrides.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/style.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/orgchart.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/blog.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/secretary.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/voc.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/faq.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/timeline.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/suggestion.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/iia/css/iia.css?ok543r");
@import url("https://www.hhs.gov/sites/all/themes/iia/css/flip.css?ok543r");
</style>
<style media="print">
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/print.css?ok543r");
</style>
<style media="screen and (max-width: 767px)">
@import url("https://www.hhs.gov/sites/all/themes/project_h/css/mobile.css?ok543r");
</style>
<style>
@import url("https://www.hhs.gov/sites/all/themes/iia/css/ocr.css?ok543r");
</style>
<style media="screen">
@import url("https://www.hhs.gov/sites/default/files/css_injector/css_injector_1.css?ok543r");
</style>
<script async="" src="./Audit Protocol _ HHS.gov_files/gtm.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/jquery.min.js.download"></script>
<script>window.jQuery || document.write("<script src='/sites/all/modules/jquery_update/replace/jquery/1.10/jquery.min.js'>\x3C/script>")</script>
<script src="./Audit Protocol _ HHS.gov_files/jquery.once.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/drupal.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/bootstrap.min.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/affix.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/alert.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/button.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/carousel.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/dropdown.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/modal.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/tooltip.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/popover.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/scrollspy.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/tab.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/transition.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/hhsmain.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/jquery.slicknav.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/jquery.cookie.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/jquery.jfontsize-1.0.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/jquery-migrate-1.2.1.min.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/suggestion.js.download"></script>
<script src="./Audit Protocol _ HHS.gov_files/jquery.mobile.custom.min.js.download"></script>
<script>jQuery.extend(Drupal.settings, {"basePath":"\/","pathPrefix":"","ajaxPageState":{"theme":"iia","theme_token":"r_K4eGs_1Ptn6DH8Uig8CSN8C3qyPnNQMGkjxC3BoTE","js":{"sites\/all\/themes\/bootstrap\/js\/bootstrap.js":1,"\/\/ajax.googleapis.com\/ajax\/libs\/jquery\/1.10.2\/jquery.min.js":1,"0":1,"misc\/jquery.once.js":1,"misc\/drupal.js":1,"\/\/netdna.bootstrapcdn.com\/bootstrap\/3.0.2\/js\/bootstrap.min.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/affix.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/alert.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/button.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/carousel.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/dropdown.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/modal.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/tooltip.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/popover.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/scrollspy.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/tab.js":1,"sites\/all\/themes\/project_h\/bootstrap\/js\/transition.js":1,"sites\/all\/themes\/project_h\/js\/hhsmain.js":1,"sites\/all\/themes\/project_h\/js\/jquery.slicknav.js":1,"sites\/all\/themes\/project_h\/js\/jquery.cookie.js":1,"sites\/all\/themes\/project_h\/js\/jquery.jfontsize-1.0.js":1,"sites\/all\/themes\/project_h\/js\/jquery-migrate-1.2.1.min.js":1,"sites\/all\/themes\/project_h\/js\/suggestion.js":1,"sites\/all\/themes\/project_h\/js\/jquery.mobile.custom.min.js":1},"css":{"modules\/system\/system.base.css":1,"sites\/all\/modules\/date\/date_api\/date.css":1,"sites\/all\/modules\/date\/date_popup\/themes\/datepicker.1.7.css":1,"modules\/field\/theme\/field.css":1,"sites\/all\/modules\/freepager\/freepager.css":1,"sites\/all\/modules\/views\/css\/views.css":1,"sites\/all\/modules\/ctools\/css\/ctools.css":1,"sites\/all\/modules\/panels\/css\/panels.css":1,"modules\/locale\/locale.css":1,"\/\/netdna.bootstrapcdn.com\/bootstrap\/3.0.2\/css\/bootstrap.min.css":1,"sites\/all\/themes\/bootstrap\/css\/overrides.css":1,"sites\/all\/themes\/project_h\/css\/bootstrap.css":1,"sites\/all\/themes\/project_h\/css\/overrides.css":1,"sites\/all\/themes\/project_h\/css\/style.css":1,"sites\/all\/themes\/project_h\/css\/orgchart.css":1,"sites\/all\/themes\/project_h\/css\/blog.css":1,"sites\/all\/themes\/project_h\/css\/secretary.css":1,"sites\/all\/themes\/project_h\/css\/voc.css":1,"sites\/all\/themes\/project_h\/css\/faq.css":1,"sites\/all\/themes\/project_h\/css\/timeline.css":1,"sites\/all\/themes\/project_h\/css\/suggestion.css":1,"sites\/all\/themes\/iia\/css\/iia.css":1,"sites\/all\/themes\/iia\/css\/flip.css":1,"sites\/all\/themes\/project_h\/css\/print.css":1,"sites\/all\/themes\/project_h\/css\/mobile.css":1,"sites\/all\/themes\/iia\/css\/ocr.css":1,"public:\/\/css_injector\/css_injector_1.css":1}},"bootstrap":{"anchorsFix":0,"anchorsSmoothScrolling":1,"popoverEnabled":0,"popoverOptions":{"animation":1,"html":0,"placement":"right","selector":"","trigger":"click","title":"","content":"","delay":0,"container":"body"},"tooltipEnabled":0,"tooltipOptions":{"animation":1,"html":0,"placement":"auto left","selector":"","trigger":"hover focus","delay":0,"container":"body"}}});
</script>
<script>window.jQuery.fn.modal || document.write("<script src='/sites/all/themes/project_h/js/bootstrap.min.js'>\x3C/script>")</script>
<script type="text/javascript" src="./Audit Protocol _ HHS.gov_files/addthis_widget.js.download"></script>
<div id="_atssh" style="visibility: hidden; height: 1px; width: 1px; position: absolute; top: -9999px; z-index: 100000;">
<iframe id="_atssh420" title="AddThis utility frame" src="./Audit Protocol _ HHS.gov_files/sh.92bb263c60d77a822f41d4b0.html" style="height: 1px; width: 1px; position: absolute; top: 0px; z-index: 100000; border: 0px; left: 0px;">
</iframe>
</div>
<style type="text/css">.at-icon{fill:#fff;border:0}.at-icon-wrapper{display:inline-block;overflow:hidden}a .at-icon-wrapper{cursor:pointer}.at-rounded,.at-rounded-element .at-icon-wrapper{border-radius:12%}.at-circular,.at-circular-element .at-icon-wrapper{border-radius:50%}.addthis_32x32_style .at-icon{width:2pc;height:2pc}.addthis_24x24_style .at-icon{width:24px;height:24px}.addthis_20x20_style .at-icon{width:20px;height:20px}.addthis_16x16_style .at-icon{width:1pc;height:1pc}#at16lb{display:none;position:absolute;top:0;left:0;width:100%;height:100%;z-index:1001;background-color:#000;opacity:.001}#at_complete,#at_error,#at_share,#at_success{position:static!important}.at15dn{display:none}#at15s,#at16p,#at16p form input,#at16p label,#at16p textarea,#at_share .at_item{font-family:arial,helvetica,tahoma,verdana,sans-serif!important;font-size:9pt!important;outline-style:none;outline-width:0;line-height:1em}* html #at15s.mmborder{position:absolute!important}#at15s.mmborder{position:fixed!important;width:250px!important}#at15s{background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAABtJREFUeNpiZGBgaGAgAjAxEAlGFVJHIUCAAQDcngCUgqGMqwAAAABJRU5ErkJggg==);float:none;line-height:1em;margin:0;overflow:visible;padding:5px;text-align:left;position:absolute}#at15s a,#at15s span{outline:0;direction:ltr;text-transform:none}#at15s .at-label{margin-left:5px}#at15s .at-icon-wrapper{width:1pc;height:1pc;vertical-align:middle}#at15s .at-icon{width:1pc;height:1pc}.at4-icon{display:inline-block;background-repeat:no-repeat;background-position:top left;margin:0;overflow:hidden;cursor:pointer}.addthis_16x16_style .at4-icon,.addthis_default_style .at4-icon,.at4-icon,.at-16x16{width:1pc;height:1pc;line-height:1pc;background-size:1pc!important}.addthis_32x32_style .at4-icon,.at-32x32{width:2pc;height:2pc;line-height:2pc;background-size:2pc!important}.addthis_24x24_style .at4-icon,.at-24x24{width:24px;height:24px;line-height:24px;background-size:24px!important}.addthis_20x20_style .at4-icon,.at-20x20{width:20px;height:20px;line-height:20px;background-size:20px!important}.at4-icon.circular,.circular .at4-icon,.circular.aticon{border-radius:50%}.at4-icon.rounded,.rounded .at4-icon{border-radius:4px}.at4-icon-left{float:left}#at15s .at4-icon{text-indent:20px;padding:0;overflow:visible;white-space:nowrap;background-size:1pc;width:1pc;height:1pc;background-position:top left;display:inline-block;line-height:1pc}.addthis_vertical_style .at4-icon,.at4-follow-container .at4-icon{margin-right:5px}html>body #at15s{width:250px!important}#at15s.atm{background:none!important;padding:0!important;width:10pc!important}#at15s_inner{background:#fff;border:1px solid #fff;margin:0}#at15s_head{position:relative;background:#f2f2f2;padding:4px;cursor:default;border-bottom:1px solid #e5e5e5}.at15s_head_success{background:#cafd99!important;border-bottom:1px solid #a9d582!important}.at15s_head_success a,.at15s_head_success span{color:#000!important;text-decoration:none}#at15s_brand,#at15sptx,#at16_brand{position:absolute}#at15s_brand{top:4px;right:4px}.at15s_brandx{right:20px!important}a#at15sptx{top:4px;right:4px;text-decoration:none;color:#4c4c4c;font-weight:700}#at15sptx:hover{text-decoration:underline}#at16_brand{top:5px;right:30px;cursor:default}#at_hover{padding:4px}#at_hover .at_item,#at_share .at_item{background:#fff!important;float:left!important;color:#4c4c4c!important}#at_share .at_item .at-icon-wrapper{margin-right:5px}#at_hover .at_bold{font-weight:700;color:#000!important}#at_hover .at_item{width:7pc!important;padding:2px 3px!important;margin:1px;text-decoration:none!important}#at_hover .at_item.athov,#at_hover .at_item:focus,#at_hover .at_item:hover{margin:0!important}#at_hover .at_item.athov,#at_hover .at_item:focus,#at_hover .at_item:hover,#at_share .at_item.athov,#at_share .at_item:hover{background:#f2f2f2!important;border:1px solid #e5e5e5;color:#000!important;text-decoration:none}.ipad #at_hover .at_item:focus{background:#fff!important;border:1px solid #fff}.at15t{display:block!important;height:1pc!important;line-height:1pc!important;padding-left:20px!important;background-position:0 0;text-align:left}.addthis_button,.at15t{cursor:pointer}.addthis_toolbox a.at300b,.addthis_toolbox a.at300m{width:auto}.addthis_toolbox a{margin-bottom:5px;line-height:initial}.addthis_toolbox.addthis_vertical_style{width:200px}.addthis_button_facebook_like .fb_iframe_widget{line-height:100%}.addthis_button_facebook_like iframe.fb_iframe_widget_lift{max-width:none}.addthis_toolbox a.addthis_button_counter,.addthis_toolbox a.addthis_button_facebook_like,.addthis_toolbox a.addthis_button_facebook_send,.addthis_toolbox a.addthis_button_facebook_share,.addthis_toolbox a.addthis_button_foursquare,.addthis_toolbox a.addthis_button_google_plusone,.addthis_toolbox a.addthis_button_linkedin_counter,.addthis_toolbox a.addthis_button_pinterest_pinit,.addthis_toolbox a.addthis_button_stumbleupon_badge,.addthis_toolbox a.addthis_button_tweet{display:inline-block}.at-share-tbx-element .google_plusone_iframe_widget>span>div{vertical-align:top!important}.addthis_toolbox span.addthis_follow_label{display:none}.addthis_toolbox.addthis_vertical_style span.addthis_follow_label{display:block;white-space:nowrap}.addthis_toolbox.addthis_vertical_style a{display:block}.addthis_toolbox.addthis_vertical_style.addthis_32x32_style a{line-height:2pc;height:2pc}.addthis_toolbox.addthis_vertical_style .at300bs{margin-right:4px;float:left}.addthis_toolbox.addthis_20x20_style span{line-height:20px}.addthis_toolbox.addthis_32x32_style span{line-height:2pc}.addthis_toolbox.addthis_pill_combo_style .addthis_button_compact .at15t_compact,.addthis_toolbox.addthis_pill_combo_style a{float:left}.addthis_toolbox.addthis_pill_combo_style a.addthis_button_tweet{margin-top:-2px}.addthis_toolbox.addthis_pill_combo_style .addthis_button_compact .at15t_compact{margin-right:4px}.addthis_default_style .addthis_separator{margin:0 5px;display:inline}div.atclear{clear:both}.addthis_default_style .addthis_separator,.addthis_default_style .at4-icon,.addthis_default_style .at300b,.addthis_default_style .at300bo,.addthis_default_style .at300bs,.addthis_default_style .at300m{float:left}.at300b img,.at300bo img{border:0}a.at300b .at4-icon,a.at300m .at4-icon{display:block}.addthis_default_style .at300b,.addthis_default_style .at300bo,.addthis_default_style .at300m{padding:0 2px}.at300b,.at300bo,.at300bs,.at300m{cursor:pointer}.addthis_button_facebook_like.at300b:hover,.addthis_button_facebook_like.at300bs:hover,.addthis_button_facebook_send.at300b:hover,.addthis_button_facebook_send.at300bs:hover{opacity:1}.addthis_20x20_style .at15t,.addthis_20x20_style .at300bs{overflow:hidden;display:block;height:20px!important;width:20px!important;line-height:20px!important}.addthis_32x32_style .at15t,.addthis_32x32_style .at300bs{overflow:hidden;display:block;height:2pc!important;width:2pc!important;line-height:2pc!important}.at300bs{overflow:hidden;display:block;background-position:0 0;height:1pc;width:1pc;line-height:1pc!important}.addthis_default_style .at15t_compact,.addthis_default_style .at15t_expanded{margin-right:4px}#at_share .at_item{width:123px!important;padding:4px;margin-right:2px;border:1px solid #fff}#at16p{background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAABtJREFUeNpiZGBgaGAgAjAxEAlGFVJHIUCAAQDcngCUgqGMqwAAAABJRU5ErkJggg==);z-index:10000001;position:absolute;top:50%;left:50%;width:300px;padding:10px;margin:0 auto;margin-top:-185px;margin-left:-155px;font-family:arial,helvetica,tahoma,verdana,sans-serif;font-size:9pt;color:#5e5e5e}#at_share{margin:0;padding:0}#at16pt{position:relative;background:#f2f2f2;height:13px;padding:5px 10px}#at16pt a,#at16pt h4{font-weight:700}#at16pt h4{display:inline;margin:0;padding:0;font-size:9pt;color:#4c4c4c;cursor:default}#at16pt a{position:absolute;top:5px;right:10px;color:#4c4c4c;text-decoration:none;padding:2px}#at15sptx:focus,#at16pt a:focus{outline:thin dotted}#at15s #at16pf a{top:1px}#_atssh{width:1px!important;height:1px!important;border:0!important}.atm{width:10pc!important;padding:0;margin:0;line-height:9pt;letter-spacing:normal;font-family:arial,helvetica,tahoma,verdana,sans-serif;font-size:9pt;color:#444;background:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAABtJREFUeNpiZGBgaGAgAjAxEAlGFVJHIUCAAQDcngCUgqGMqwAAAABJRU5ErkJggg==);padding:4px}.atm-f{text-align:right;border-top:1px solid #ddd;padding:5px 8px}.atm-i{background:#fff;border:1px solid #d5d6d6;padding:0;margin:0;box-shadow:1px 1px 5px rgba(0,0,0,.15)}.atm-s{margin:0!important;padding:0!important}.atm-s a:focus{border:transparent;outline:0;-webkit-transition:none;transition:none}#at_hover.atm-s a,.atm-s a{display:block;text-decoration:none;padding:4px 10px;color:#235dab!important;font-weight:400;font-style:normal;-webkit-transition:none;transition:none}#at_hover.atm-s .at_bold{color:#235dab!important}#at_hover.atm-s a:hover,.atm-s a:hover{background:#2095f0;text-decoration:none;color:#fff!important}#at_hover.atm-s .at_bold{font-weight:700}#at_hover.atm-s a:hover .at_bold{color:#fff!important}.atm-s a .at-label{vertical-align:middle;margin-left:5px;direction:ltr}.at_PinItButton{display:block;width:40px;height:20px;padding:0;margin:0;background-image:url(//s7.addthis.com/static/t00/pinit00.png);background-repeat:no-repeat}.at_PinItButton:hover{background-position:0 -20px}.addthis_toolbox .addthis_button_pinterest_pinit{position:relative}.at-share-tbx-element .fb_iframe_widget span{vertical-align:baseline!important}#at16pf{height:auto;text-align:right;padding:4px 8px}.at-privacy-info{position:absolute;left:7px;bottom:7px;cursor:pointer;text-decoration:none;font-family:helvetica,arial,sans-serif;font-size:10px;line-height:9pt;letter-spacing:.2px;color:#666}.at-privacy-info:hover{color:#000}.body .wsb-social-share .wsb-social-share-button-vert{padding-top:0;padding-bottom:0}.body .wsb-social-share.addthis_counter_style .addthis_button_tweet.wsb-social-share-button{padding-top:44px}.body .wsb-social-share.addthis_counter_style .addthis_button_google_plusone.wsb-social-share-button{padding-top:4px}@media print{#at4-follow,#at4-share,#at4-thankyou,#at4-whatsnext,#at4m-mobile,#at15s,.at4,.at4-recommended{display:none!important}}@media screen and (max-width:400px){.at4win{width:100%}}@media screen and (max-height:700px) and (max-width:400px){.at4-thankyou-inner .at4-recommended-container{height:122px;overflow:hidden}.at4-thankyou-inner .at4-recommended .at4-recommended-item:first-child{border-bottom:1px solid #c5c5c5}}</style><style type="text/css">.at-branding-logo{font-family:helvetica,arial,sans-serif;text-decoration:none;font-size:10px;display:inline-block;margin:2px 0;letter-spacing:.2px}.at-branding-logo .at-branding-icon{background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAMAAAC67D+PAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAAZQTFRF////+GlNUkcc1QAAAB1JREFUeNpiYIQDBjQmAwMmkwEM0JnY1WIxFyDAABGeAFEudiZsAAAAAElFTkSuQmCC")}.at-branding-logo .at-branding-icon,.at-branding-logo .at-privacy-icon{display:inline-block;height:10px;width:10px;margin-left:4px;margin-right:3px;margin-bottom:-1px;background-repeat:no-repeat}.at-branding-logo .at-privacy-icon{background-image:url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAkAAAAKCAMAAABR24SMAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAABhQTFRF8fr9ot/xXcfn2/P5AKva////////AKTWodjhjAAAAAd0Uk5T////////ABpLA0YAAAA6SURBVHjaJMzBDQAwCAJAQaj7b9xifV0kUKJ9ciWxlzWEWI5gMF65KUTv0VKkjVeTerqE/x7+9BVgAEXbAWI8QDcfAAAAAElFTkSuQmCC")}.at-branding-logo span{text-decoration:none}.at-branding-logo .at-branding-addthis,.at-branding-logo .at-branding-powered-by{color:#666}.at-branding-logo .at-branding-addthis:hover{color:#333}.at-cv-with-image .at-branding-addthis,.at-cv-with-image .at-branding-addthis:hover{color:#fff}a.at-branding-logo:visited{color:initial}.at-branding-info{display:inline-block;padding:0 5px;color:#666;border:1px solid #666;border-radius:50%;font-size:10px;line-height:9pt;opacity:.7;transition:all .3s ease;text-decoration:none}.at-branding-info span{border:0;clip:rect(0 0 0 0);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px}.at-branding-info:before{content:'i';font-family:Times New Roman}.at-branding-info:hover{color:#0780df;border-color:#0780df}
</style>
<style id="service-icons-0"></style>
<script type="text/javascript">
(function ($) {
$(window).load(function() {
<!-- Font sizer -->
$('#site-content').jfontsize({
btnMinusClasseId: '#jfontsize-m',
btnDefaultClasseId: '#jfontsize-d',
btnPlusClasseId: '#jfontsize-p',
btnMinusMaxHits: 3,
btnPlusMaxHits: 3,
sizeChange: 1
});
<!-- End Font sizer -->
$(".mobilesearch").click(function(){
$('.top-container').addClass('search-mode');
$('.slicknav_btn.slicknav_open').click();
$('.hhs-global-search .close-button').attr('tabindex', 0);
$('.hhs-global-search .close-button a').attr('tabindex', 0);
});
$(".hhs-global-search .close-button").click(function(){
$('.top-container').removeClass('search-mode');
$('.hhs-global-search .close-button').attr('tabindex', -1);
$('.hhs-global-search .close-button a').attr('tabindex', -1);
});
$(".hhs-global-search .global-search").focus(function(){
if ($(window).width() < 768)
{
$('.top-container').addClass('search-mode');
$('.hhs-global-search .close-button a').attr('tabindex', 0);
}
});
});
$(function(){
$('#main-menu').slicknav({
prependTo:'#mobilemenu',
label:'Menu',
});
});
})(jQuery);
</script>
<!--[if lt IE 9]>
<script src="/sites/all/themes/project_h/js/hhsie8.js"></script>
<![endif]-->
<script async="" src="./Audit Protocol _ HHS.gov_files/aksb.min.js.download"></script>
<script type="text/javascript">
var w=window;
if(w.performance||w.mozPerformance||w.msPerformance||w.webkitPerformance){var d=document,AKSB=AKSB||{};AKSB.q=[];AKSB.mark=function(a,b){AKSB.q.push(["mark",a,b||(new Date).getTime()])};AKSB.measure=function(a,b,c){AKSB.q.push(["measure",a,b,c||(new Date).getTime()])};AKSB.done=function(a){AKSB.q.push(["done",a])};AKSB.mark("firstbyte",(new Date).getTime());AKSB.prof={custid:"19734",ustr:"ECDHE-RSA-AES256-GCM-SHA384",originlat:0,clientrtt:40,ghostip:"66.61.168.214",
ipv6:false,pct:10,clientip:"73.154.178.9",requestid:"719e6166",protocol:"",blver:10,akM:"dscx",akN:"ae",akTT:"O",akTX:"1",akTI:"719e6166",ai:"219660",ra:"",pmgn:"",pmgi:"",pmp:""};(function(a){var b=
d.createElement("script");b.async="async";b.src=a;a=d.getElementsByTagName("script");a=a[a.length-1];a.parentNode.insertBefore(b,a)})(("https:"===d.location.protocol?"https:":"http:")+"//ds-aksb-a.akamaihd.net/aksb.min.js")};
</script>
<script type="text/javascript" src="./Audit Protocol _ HHS.gov_files/voc.fn.js.download"></script>
<script type="text/javascript" src="./Audit Protocol _ HHS.gov_files/foresee-surveydef.js.download"></script>
</head>
<body class="html not-front not-logged-in one-sidebar sidebar-first page-node page-node- page-node-3778 node-type-article hipaa-page hipaa-for-professionals-menu-trail">
<!-- Google Tag Manager -->
<noscript><iframe src="//www.googletagmanager.com/ns.html?id=GTM-JLFR"
height="0" width="0" style="display:none;visibility:hidden" title="googletagmanager"></iframe></noscript>
<script>(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
'//www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
})(window,document,'script','dataLayer','GTM-JLFR');
</script>
<!-- End Google Tag Manager -->
<!--googleoff: all-->
<!--googleon: all-->
<div id="site-wrapper"><!-- begin site-wrapper -->
<!--googleoff: all-->
<a id="top" class="element-invisible"> </a><!-- back to top anchor -->
<h1 class="field field-name-field-full-title field-type-text field-label-hidden">
Audit Protocol - Updated April 2016 [From HHS.gov]
</h1>
<div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even" property="schema:articleBody content:encoded"><div class="syndicate"><p style="background: white; margin: 0in 0in 7.5pt;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">
<span style="color: black;">
The Phase 2 HIPAA Audit Program reviews the policies and procedures adopted and employed by covered entities and business associates to meet selected standards and implementation specifications of the Privacy, Security, and Breach Notification Rules. These analyses are conducted using a comprehensive audit protocol that has been updated to reflect the Omnibus Final Rule. The audit protocol is organized by Rule and regulatory provision and addresses separately the elements of privacy, security, and breach notification. The audits performed assess entity compliance with selected requirements and may vary based on the type of covered entity or business associate selected for review.
</span>
</span>
</span>
<span style="font-size: 10.5pt;">
<span style="font-family: helvetica,sans-serif;">
</span>
</span>
</a>
<b>
<span style="font-size: 10.5pt;">
<span style="font-family: helvetica,sans-serif;">
<span style="color: black;">.</span>
</span>
</span>
</b>
</p>
<p style="background: white; margin: 0in 0in 7.5pt;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;"><span style="color: black;">
The protocol is available for public review.</span></span></span></p>
<p style="background: white; margin: 0in 0in 7.5pt;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;"><span style="color: black;">
General Instructions:</span>
</span></span></p>
<ol>
<li style="background: white; font-weight: normal;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">
Where the document says "entity," it means both covered entities and business associates unless identified as one or the other;
</span></span>
</li>
<li style="background: white; font-weight: normal;"><i><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">Management</span></span></i><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;"> refers to the appropriate privacy, security, and breach notification official(s) or person(s) designated by the covered entity or business associate for the implementation of policies and procedures and other standards;</span></span></li>
<li style="background: white; font-weight: normal;">
<span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">
Entities must provide only the specified documents, not compendiums of all entity policies of procedures. The auditor will not search for relevant documentation that may be contained within such compilations;</span></span></li>
<li style="background: white; font-weight: normal;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">
Unless otherwise specified, all document requests are for versions in use as of the date of the audit notification and document request;</span></span></li>
<li style="background: white; font-weight: normal;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">
Unless otherwise specified, selected entities should submit documents via OCR's secure online web portal in PDF, MS Word or MS Excel formats;</span></span></li>
<li style="background: white; font-weight: normal;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">
If the requested number of documentations of implementation is not available, the entity must provide instances from equivalent previous time periods to complete the sample. If no documentation is available, the entity must provide a statement to that effect.</span></span></li>
<li style="background: white; font-weight: normal;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">
Workforce members include entity employees, on-site contractors, students, and volunteers; and,</span></span></li>
<li style="background: white; font-weight: normal;"><span style="font-size: 10.5pt;"><span style="font-family: helvetica,sans-serif;">
Information systems include hardware, software, information, data, applications, communications, and people.</span></span></li>
</ol>
<table class="allborders" width="100%"><thead><tr class="colorhead"><th scope="col" width="4%" align="center">Audit Type</th>
<th scope="col" width="5%" align="center">Section</th>
<th scope="col" width="5%" align="center">Key<br>
Activity</th>
<th scope="col" width="54%" align="center">Established Performance Criteria</th>
<th scope="col" width="28%" align="center">Audit Inquiry</th>
<th scope="col" width="4%" align="center">Req-<br>
uired/<br>
Address-<br>
able</th>
</tr></thead><tbody><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.502(a)(5)(i)</td>
<td valign="top">Prohibited uses and disclosures- Use and disclosure of genetic information for underwriting purposes</td>
<td valign="top">§ 164.502(a)(5)(i) Use and disclosure of genetic information for underwriting purposes: Notwithstanding any other provision of this subpart, a health plan, excluding an issuer of a long-term care policy falling within paragraph (1)(viii) of the definition of health plan, shall not use or disclose protected health information that is genetic information for underwriting purposes. For purposes of paragraph (a)(5)(i) of this section, underwriting purposes means, with respect to a health plan: (A) Except as provided in paragraph (a)(5)(i)(B) of this section: (1) Rules for, or determination of, eligibility (including enrollment and continued eligibility) for, or determination of, benefits under the plan, coverage, or policy (including changes in deductibles or other cost-sharing mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (2) The computation of premium or contribution amounts under the plan, coverage, or policy (including discounts, rebates, payments in kind, or other premium differential mechanisms in return for activities such as completing a health risk assessment or participating in a wellness program); (3) The application of any pre-existing condition exclusion under the plan, coverage, or policy; and (4) Other activities related to the creation, renewal, or replacement of a contract of health insurance or health benefits.<br>
(B) Underwriting purposes does not include determinations of medical appropriateness where an individual seeks a benefit under the plan, coverage, or policy.<br><br>
From § 160.103 Definitions.<br>
Genetic information means: (1) Subject to paragraphs (2) and (3) of this definition, with respect to an individual, information about: (i) The individual's genetic tests; (ii) The genetic tests of family members of the individual; (iii) The manifestation of a disease or disorder in family members of such individual; or (iv) Any request for, or receipt of, genetic services, or participation in clinical research which includes genetic services, by the individual or any family member of the individual. (2) Any reference in this subchapter to genetic information concerning an individual or family member of an individual shall include the genetic information of:<br>
(i) A fetus carried by the individual or family member who is a pregnant woman; and (ii) Any embryo legally held by an individual or family member utilizing an assisted reproductive technology. (3) Genetic information excludes information about the sex or age of any individual. (ii) Genetic services means: (1) A genetic test; (2) Genetic counseling (including obtaining, interpreting, or assessing genetic information); or (3) Genetic education. Genetic test means an analysis of human DNA, RNA, chromosomes, proteins, or metabolites, if the analysis detects genotypes, mutations, or chromosomal changes. Genetic test does not include an analysis of proteins or metabolites that is directly related to a manifested disease, disorder, or pathological condition.</td>
<td valign="top">Does the health plan use or disclose for underwriting purposes, “Genetic Information” as defined at § 160.103, including family history? Inquire of management.<br>
Obtain and review all underwriting policies and procedures (for example, published and unpublished underwriting guidelines currently used by underwriting staff, including manuals and training materials). Evaluate whether the underwriting policies are consistent with the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.502(f)</td>
<td valign="top">Deceased individuals</td>
<td valign="top">§164.502(f) Standard: Deceased individuals: A covered entity must comply with the requirements of this subpart with respect to the protected health information of a deceased individual for a period of 50 years following the death of the individual.<br><br>
From § 160.103 Definitions.<br>
Protected health information means individually identifiable health information: (1) Except as provided in paragraph (2) of this definition,[….]<br>
(2) Protected health information excludes individually identifiable health information: [….] (iv) Regarding a person who has been deceased for more than 50 years.</td>
<td valign="top">Do the covered entity’s policies and procedures protect the deceased individual's PHI consistent with the established performance criterion? Inquire of management.<br>
Obtain and review policies and procedures regarding use and disclosure of deceased individuals' PHIs. Evaluate whether the policies and procedures are consistent with the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top"><a name="anchor25"> §164.502(g)</td>
<td valign="top">Personal representatives</td>
<td valign="top">§164.502(g)(1) Standard: Personal representatives. As specified in this paragraph, a covered entity must, except as provided in paragraphs (g)(3) and (g)(5) of this section, treat a personal representative as the individual for purposes of this subchapter.<br><br>
§164.502(g)(2) Implementation specification: adults and emancipated minors: If under applicable law a person has authority to act on behalf of an individual who is an adult or an emancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.<br><br>
§164.502(g)(3)(i) Implementation specification: unemancipated minors: If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation, except that such person may not be a personal representative of an unemancipated minor, and the minor has the authority to act as an individual, with respect to protected health information pertaining to a health care service, if:<br>
(A) The minor consents to such health care service; no other consent to such health care service is required by law, regardless of whether the consent of another person has also been obtained; and the minor has not requested that such person be treated as the personal representative;<br>
(B) The minor may lawfully obtain such health care service without the consent of a parent, guardian, or other person acting in loco parentis, and the minor, a court, or another person authorized by law consents to such health care service; or<br>
(C) A parent, guardian, or other person acting in loco parentis assents to an agreement of confidentiality between a covered health care provider and the minor with respect to such health care service.<br><br>
§164.502(g)(3)(ii) - Notwithstanding the provisions of paragraph (g)(3)(i) of this section:<br>
(A) If, and to the extent permitted or required by an applicable provision of State or other law, including applicable case law, a covered entity may disclose, or in accordance with §164.524 provide access to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis;<br>
(B) If, and to the extent prohibited by an applicable provision of State or other law, including applicable case law, a covered entity may not disclose, or in accordance with §164.524 provide access to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis; and<br>
(C) Where the parent, guardian, or other person acting in loco parentis, is not the personal representative under paragraphs (g)(3)(i)(A), (B), or (C) of this section and where there is no applicable access provision under State or other law, including case law, a covered entity may provide or deny access under §164.524 to a parent, guardian, or other person acting in loco parentis, if such action is consistent with State or other applicable law, provided that such decision must be made by a licensed health care professional, in the exercise of professional judgment.<br><br>
§164.502(g)(4) Implementation specification: Deceased individuals. If under applicable law an executor, administrator, or other person has authority to act on behalf of a deceased individual or of the individual's estate, a covered entity must treat such person as a personal representative under this subchapter, with respect to protected health information relevant to such personal representation.<br><br>
§164.502(g) (5) Implementation specification: Abuse, neglect, endangerment situations. Notwithstanding a State law or any requirement of this paragraph to the contrary, a covered entity may elect not to treat a person as the personal representative of an individual if: (i) The covered entity has a reasonable belief that:<br>
(A) The individual has been or may be subjected to domestic violence, abuse, or neglect by such person; or (B) Treating such person as the personal representative could endanger the individual; and (ii) The covered entity, in the exercise of professional judgment, decides that it is not in the best interest of the individual to treat the person as the individual's personal representative.</td>
<td valign="top">Do the policies and procedures provide for the treatment of an authorized person as a personal representative?<br>
Inquire of management how the entity recognizes personal representatives for an individual for compliance with HIPAA Rule requirements.<br>
Obtain and review policies and procedures for the recognition and treatment of a personal representative. Evaluate whether the policies and procedures are consistent with the established performance criterion.<br>
For example, do the policies and procedures address how the covered entity determines whether a person has authority to act on behalf of the individual? How do the policies and procedures address minors? The deceased?<br>
Obtain and review a sample of personal representatives recognized by the entity. Evaluate whether the personal representative has been recognized and treated in a manner consistent with the established performance criterion and the entity established policies and procedures.<br>
Obtain and review a sample of requests for persons to be recognized as personal representatives for individuals where the entity has not recognized the person as a personal representative. Evaluate whether the decision to not recognize the person as a personal representative was consistent with the established performance criterion and entity established policies and procedures. Evaluate whether the person has been treated consistent with the established performance criterion and the entity established policies and procedures.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top"> <a name="anchor12"> §164.502(h)</td>
<td valign="top">Confidential communications</td>
<td valign="top">§164.502(h) Standard: Confidential communications: A covered health care provider or health plan must comply with the applicable requirements of §164.522(b) in communicating protected health information.<br>
§164.522(b)(1) Standard: Confidential communications requirements: (i) A covered health care provider must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the covered health care provider by alternative means or at alternative locations. (ii) A health plan must permit individuals to request and must accommodate reasonable requests by individuals to receive communications of protected health information from the health plan by alternative means or at alternative locations, if the individual clearly states that the disclosure of all or part of that information could endanger the individual.<br><br>
§164.522(b)(2) Implementation specifications: Conditions on providing confidential communications: (i) A covered entity may require the individual to make a request for a confidential communication described in paragraph (b)(1) of this section in writing. (ii) A covered entity may condition the provision of a reasonable accommodation on: (A) When appropriate, information as to how payment, if any, will be handled; and (B) Specification of an alternative address or other method of contact. (iii) A covered health care provider may not require an explanation from the individual as to the basis for the request as a condition of providing communications on a confidential basis. (iv) A health plan may require that a request contain a statement that disclosure of all or part of the information to which the request pertains could endanger the individual.</td>
<td valign="top">How does the entity provide for and accommodate requests by individuals for confidential communications? Inquire of management how the entity handles requests for confidential communications by individuals.<br><br>
Obtain and review policies and procedures regarding requests for confidential communications. Evaluate whether the policies and procedures are consistent with the established performance criterion.<br><br>
Obtain and review a sample of confidential communications requests made by individuals. Evaluate whether the requests were evaluated and accepted or denied consistent with the established performance criterion and the entity established policies and procedures.<br><br>
Obtain a review a sample of communications to individuals for which a confidential communication request was accepted. Evaluate whether the communication was conducted consistent with the established performance criterion and the entity established policies and procedures.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.502(i)</td>
<td valign="top">Uses and disclosures consistent with notice</td>
<td valign="top">§164.502(i) Standard: Uses and disclosures consistent with notice: A covered entity that is required by §164.520 to have a notice may not use or disclose protected health information in a manner inconsistent with such notice. A covered entity that is required by §164.520(b)(1)(iii) to include a specific statement in its notice if it intends to engage in an activity listed in §164.520(b)(1)(iii)(A)-(C), may not use or disclose protected health information for such activities, unless the required statement is included in the notice.</td>
<td valign="top">Are uses and disclosures made by the covered entity consistent with its notice of privacy practices?<br>
Inquire of management whether uses and disclosures of PHI are consistent with the entity’s notice of privacy practices.<br><br>
Obtain and review policies and procedures regarding uses and disclosures. Evaluate whether the uses and disclosures of PHI are consistent with the entity’s notice of privacy practices.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top"><a name="anchor11"> §164.502(j)(1)</td>
<td valign="top">Disclosures by whistleblowers</td>
<td valign="top">§164.502(j)(1) Disclosures by whistleblowers: A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce or a business associate discloses protected health information, provided that:<br>
(i) The workforce member or business associate believes in good faith that the covered entity has engaged in conduct that is unlawful or otherwise violates professional or clinical standards, or that the care, services, or conditions provided by the covered entity potentially endangers one or more patients, workers, or the public; and<br>
(ii) The disclosure is to:<br>
(A) A health oversight agency or public health authority authorized by law to investigate or otherwise oversee the relevant conduct or conditions of the covered entity or to an appropriate health care accreditation organization for the purpose of reporting the allegation of failure to meet professional standards or misconduct by the covered entity; or<br>
(B) An attorney retained by or on behalf of the workforce member or business associate for the purpose of determining the legal options of the workforce member or business associate with regard to the conduct described in paragraph (j)(1)(i) of this section.</td>
<td valign="top">Are whistleblower policies and procedures consistent with the requirements of this performance criterion?<br><br>
Obtain and review documentation of disclosures by a workforce member not otherwise permitted by the Privacy Rule that the entity determined to meet the requirements of this standard.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.502(j)(2)</td>
<td valign="top">Disclosures by workforce members who are victims of a crime</td>
<td valign="top">§164.502(j)(2) - Disclosures by workforce members who are victims of a crime: A covered entity is not considered to have violated the requirements of this subpart if a member of its workforce who is the victim of a criminal act discloses protected health information to a law enforcement official, provided that:<br>
(i) The protected health information disclosed is about the suspected perpetrator of the criminal act; and<br>
(ii) The protected health information disclosed is limited to the information listed in §164.512(f)(2)(i).</td>
<td valign="top">How has the covered entity ensured that disclosures by a workforce member related to his or her status as a victim of a crime are consistent with the rule?<br><br>
Inquire of management how the entity identifies and treats disclosures of PHI by workforce members who are victims of a crime.<br><br>
Obtain and review policies and procedures related to disclosures of PHI by workforce members who are victims of a crime. Evaluate whether disclosures are treated consistent with the established performance criterion and the entity established policies and procedures.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top"><a name="anchor4"> §164.504(e)</td>
<td valign="top">Business associate contracts</td>
<td valign="top">§164.504(e)(1) Standard: Business associate contracts.<br>
(i) The contract or other arrangement required by § 164.502(e)(2) must meet the requirements of paragraph (e)(2), (e)(3), or (e)(5) of this section, as applicable.<br>
(ii) A covered entity is not in compliance with the standards in § 164.502(e) and this paragraph, if the covered entity knew of a pattern of activity or practice of the business associate that constituted a material breach or violation of the business associate’s obligation under the contract or other arrangement, unless the covered entity took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.<br>
(iii) A business associate is not in compliance with the standards in § 164.502(e) and this paragraph, if the business associate knew of a pattern of activity or practice of a subcontractor that constituted a material breach or violation of the subcontractor’s obligation under the contract or other arrangement, unless the business associate took reasonable steps to cure the breach or end the violation, as applicable, and, if such steps were unsuccessful, terminated the contract or arrangement, if feasible.<br><br>
(2) Implementation specifications: Business associate contracts. A contract between the covered entity and a business associate must:<br>
(i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that:<br>
(A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and<br>
(B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity.<br>
(ii) Provide that the business associate will:<br>
(A) Not use or further disclose the information other than as permitted or required by the contract or as required by law;<br>
(B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract;<br>
(C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410;<br>
(D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;<br>
(E) Make available protected health information in accordance with § 164.524;<br>
(F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with § 164.526;<br>
(G) Make available the information required to provide an accounting of disclosures in accordance with § 164.528;<br>
(H) To the extent the business associate is to carry out a covered entity’s obligation under this subpart, comply with the requirements of this subpart that apply to the covered entity in the performance of such obligation.<br>
(I) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the business associate on behalf of, the covered entity available to the Secretary for purposes of determining the covered entity’s compliance with this subpart; and<br>
(J) At termination of the contract, if feasible, return or destroy all protected health information received from, or created or received by the business associate on behalf of, the covered entity that the business associate still maintains in any form and retain no copies of such information or, if such return or destruction is not feasible, extend the protections of the contract to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible.<br>
(iii) Authorize termination of the contract by the covered entity, if the covered entity determines that the business associate has violated a material term of the contract.<br>
(3) Implementation specifications:<br>
Other arrangements. (i) If a covered entity and its business associate are both governmental entities:<br>
(A) The covered entity may comply with this paragraph and § 164.314(a)(1), if applicable, by entering into a memorandum of understanding with the business associate that contains terms that accomplish the objectives of paragraph (e)(2) of this section and § 164.314(a)(2), if applicable.<br>
(B) The covered entity may comply with this paragraph and § 164.314(a)(1), if applicable, if other law (including regulations adopted by the covered entity or its business associate) contains requirements applicable to the business associate that accomplish the objectives of paragraph (e)(2) of this section and § 164.314(a)(2), if applicable.<br>
(ii) If a business associate is required by law to perform a function or activity on behalf of a covered entity or to provide a service described in the definition of business associate in § 160.103 of this subchapter to a covered entity, such covered entity may disclose protected health information to the business associate to the extent necessary to comply with the legal mandate without meeting the requirements of this paragraph and § 164.314(a)(1), if applicable, provided that the covered entity attempts in good faith to obtain satisfactory assurances as required by paragraph (e)(2) of this section and § 164.314(a)(1), if applicable, and, if such attempt fails, documents the attempt and the reasons that such assurances cannot be obtained.<br>
(iii) The covered entity may omit from its other arrangements the termination authorization required by paragraph (e)(2)(iii) of this section, if such authorization is inconsistent with the statutory obligations of the covered entity or its business associate.<br>
(iv) A covered entity may comply with this paragraph and § 164.314(a)(1) if the covered entity discloses only a limited data set to a business associate for the business associate to carry out a health care operations function and the covered entity has a data use agreement with the business associate that complies with § 164.514(e)(4) and § 164.314(a)(1), if applicable.<br>
(4) Implementation specifications: Other requirements for contracts and other arrangements.<br>
(i) The contract or other arrangement between the covered entity and the business associate may permit the business associate to use the protected health information received by the business associate in its capacity as a business associate to the covered entity, if necessary:<br>
(A) For the proper management and administration of the business associate; or<br>
(B) To carry out the legal responsibilities of the business associate.<br>
(ii) The contract or other arrangement between the covered entity and the business associate may permit the business associate to disclose the protected health information received by the business associate in its capacity as a business associate for the purposes described in paragraph (e)(4)(i) of this section, if:<br>
(A) The disclosure is required by law; or<br>
(B)(1) The business associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person; and<br>
(2) The person notifies the business associate of any instances of which it is aware in which the confidentiality of the information has been breached.<br>
(5) Implementation specifications: Business associate contracts with subcontractors. The requirements of § 164.504(e)(2) through (e)(4) apply to the contract or other arrangement required by § 164.502(e)(1)(ii) between a business associate and a business associate that is a subcontractor in the same manner as such requirements apply to contracts or other arrangements between a covered entity and business associate.</td>
<td valign="top">Does the covered entity enter into business associate contracts as required? Do these contracts contain all required elements? Inquire of management how the entity identifies and engages business associates.<br>
Obtain and review policies and procedures related to the identification of business associates and the creation and establishment of business associate agreements. Evaluate whether the policies and procedures accurately identify business associates and establish business associate agreements consistent with the established performance criterion established performance criterion.<br>
Technical Assistance: if available, review the entity’s template business associate agreement and provide technical assistance as to its contents.<br><br>
Obtain and review a sample of business associate agreements. Evaluate whether the agreements are consistent with the established performance criterion entity-established policies and procedures.<br>
Inquire of management as to whether any business associate arrangements involved onward transfers of PHI to additional business associates and subcontractors. If yes, review a sample of business associate agreements between the covered entity and such business associates for provisions requiring subsequent BAs/subcontractors to provide adequate assurances.<br>
Has the covered entity come into the knowledge of a pattern or practice of the business associate that constituted a material breach of violation of the BA’s obligation? If so, obtain documentation of covered entity response and evaluate against the established performance criterion established performance criterion. Use of sampling procedures may be appropriate.<br>
Obtain and review documentation of reports from the business associate to the covered entity of any uses or disclosures not provided for in its contract, and the covered entity response.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.504(f)</td>
<td valign="top">Requirements for group health plans</td>
<td valign="top">§164.504(f)(1) Standard: Requirements for group health plans.<br>
(i) Except as provided under paragraph (f)(1)(ii) or (iii) of this section or as otherwise authorized under § 164.508, a group health plan, in order to disclose protected health information to the plan sponsor or to provide for or permit the disclosure of protected health information to the plan sponsor by a health insurance issuer or HMO with respect to the group health plan, must ensure that the plan documents restrict uses and disclosures of such information by the plan sponsor consistent with the requirements of this subpart. (ii) Except as prohibited by § 164.502(a)(5)(i), the group health plan, or a health insurance issuer or HMO with respect to the group health plan, may disclose summary health information to the plan sponsor, if the plan sponsor requests the summary health information for purposes of: (A) Obtaining premium bids from health plans for providing health insurance coverage under the group health plan; or (B) Modifying, amending, or terminating the group health plan. (iii) The group health plan, or a health insurance issuer or HMO with respect to the group health plan, may disclose to the plan sponsor information on whether the individual is participating in the group health plan, or is enrolled in or has disenrolled from a health insurance issuer or HMO offered by the plan. (2) Implementation specifications: Requirements for plan documents. The plan documents of the group health plan must be amended to incorporate provisions to: (i) Establish the permitted and required uses and disclosures of such information by the plan sponsor, provided that such permitted and required uses and disclosures may not be inconsistent with this subpart. (ii) Provide that the group health plan will disclose protected health information to the plan sponsor only upon receipt of a certification by the plan sponsor that the plan documents have been amended to incorporate the following provisions and that the plan sponsor agrees to: (A) Not use or further disclose the information other than as permitted or required by the plan documents or as required by law; (B) Ensure that any agents to whom it provides protected health information received from the group health plan agree to the same restrictions and conditions that apply to the plan sponsor with respect to such information; (C) Not use or disclose the information for employment-related actions and decisions or in connection with any other benefit or employee benefit plan of the plan sponsor; (D) Report to the group health plan any use or disclosure of the information that is inconsistent with the uses or disclosures provided for of which it becomes aware; (E) Make available protected health information in accordance with § 164.524; (F) Make available protected health information for amendment and incorporate any amendments to protected health information in accordance with § 164.526; (G) Make available the information required to provide an accounting of disclosures in accordance with § 164.528; (H) Make its internal practices, books, and records relating to the use and disclosure of protected health information received from the group health plan available to the Secretary for purposes of determining compliance by the group health plan with this subpart; (I) If feasible, return or destroy all protected health information received from the group health plan that the sponsor still maintains in any form and retain no copies of such information when no longer needed for the purpose for which disclosure was made, except that, if such return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible; and (J) Ensure that the adequate separation required in paragraph (f)(2)(iii) of this section is established. (iii) Provide for adequate separation between the group health plan and the plan sponsor. The plan documents must: (A) Describe those employees or classes of employees or other persons under the control of the plan sponsor to be given access to the protected health information to be disclosed, provided that any employee or person who receives protected health information relating to payment under, health care operations of, or other matters pertaining to the group health plan in the ordinary course of business must be included in such description; (B) Restrict the access to and use by such employees and other persons described in paragraph (f)(2)(iii)(A) of this section to the plan administration functions that the plan sponsor performs for the group health plan; and (C) Provide an effective mechanism for resolving any issues of noncompliance by persons described in paragraph (f)(2)(iii)(A) of this section with the plan document provisions required by this paragraph. (3) Implementation specifications: Uses and disclosures. A group health plan may: (i) Disclose protected health information to a plan sponsor to carry out plan administration functions that the plan sponsor performs only consistent with the provisions of paragraph (f)(2) of this section; (ii) Not permit a health insurance issuer or HMO with respect to the group health plan to disclose protected health information to the plan sponsor except as permitted by this paragraph; (iii) Not disclose and may not permit a health insurance issuer or HMO to disclose protected health information to a plan sponsor as otherwise permitted by this paragraph unless a statement required by § 164.520(b)(1)(iii)(C) is included in the appropriate notice; and (iv) Not disclose protected health information to the plan sponsor for the purpose of employment-related actions or decisions or in connection with any other benefit or employee benefit plan of the plan sponsor.</td>
<td valign="top">Do group health plan documents restrict the use and disclosure of PHI to the plan sponsor?<br><br>
Obtain and evaluate group health plan documents to determine if they restrict the use and disclosure of PHI to the plan sponsor consistent with the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.504(g)</td>
<td valign="top">Requirements for a covered entity with multiple covered functions</td>
<td valign="top">§164.504(g) - Requirements for a covered entity with multiple covered functions. (1) A covered entity that performs multiple covered functions that would make the entity any combination of a health plan, a covered health care provider, and a health care clearinghouse, must comply with the standards, requirements, and implementation specifications of this subpart, as applicable to the health plan, health care provider, or health care clearinghouse covered functions performed. (2 )A covered entity that performs multiple covered functions may use or disclose the protected health information of individuals who receive the covered entity's health plan or health care provider services, but not both, only for the purposes related to the appropriate function being performed.</td>
<td valign="top">For entities that perform multiple covered functions, are uses and disclosures of PHI only for the purpose related to the appropriate functions being performed?<br>
Inquire of management.<br><br>
Obtain and evaluate whether the policies and procedures restrict the uses and disclosures of PHI to only the purpose related to the appropriate function being performed.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top"> <a name="anchor26">§164.506(a)</td>
<td valign="top">Permitted uses and disclosures</td>
<td valign="top">§164.506(a) - Uses and disclosures to carry out treatment, payment, or health care operations. Except with respect to uses or disclosures that require an authorization under § 164.508(a)(2) through (4) or that are prohibited under § 164.502(a)(5)(i), a covered entity may use or disclose protected health information for treatment, payment, or health care operations as set forth in paragraph (c) of this section, provided that such use or disclosure is consistent with other applicable requirements of this subpart.</td>
<td valign="top">Do policies and procedures exist for the use or disclosure of PHI for treatment, payment, or health care operations?<br>
Inquire of management.<br><br>
Obtain and review policies and procedures regarding use or disclosure of PHI for treatment, payment, or health care operations.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.506(b); (b)(1); and (b)(2)</td>
<td valign="top">Consent for uses and disclosures</td>
<td valign="top">§164.506(b) - Standard: Consent for uses and disclosures permitted.<br><br>
§164.506(b)(1) A covered entity may obtain consent of the individual to use or disclose protected health information to carry out treatment, payment, or health care operations.<br><br>
§164.506(b)(2) Consent, under paragraph (b) of this section, shall not be effective to permit a use or disclosure of protected health information when an authorization, under §164.508, is required or when another condition must be met for such use or disclosure to be permissible under this subpart.</td>
<td valign="top">Does the entity obtain the individual's consent for uses and disclosures?<br><br>
Obtain samples of completed consents, if any, and patient intake materials and review to determine if its use is consistent with the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top"><a name="anchor27">§164.508(a)(1-3) and §164.508(b)(1-2)</td>
<td valign="top">Authorizations for uses and disclosures is required</td>
<td valign="top">§164.508(a)(1) Authorization required: General rule.<br>
Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section. When a covered entity obtains or receives a valid authorization for its use or disclosure of protected health information, such use or disclosure must be consistent with such authorization.<br><br>
§164.508(a)(2) Authorization required: Psychotherapy notes.<br>
(i) Notwithstanding any provision of this subpart, other than the transition provisions in §164.532, a covered entity must obtain an authorization for any use or disclosure of psychotherapy notes, except:<br>
(i) To carry out the following treatment, payment, or health care operations:<br>
(A) Use by the originator of the psychotherapy notes for treatment;<br>
(B) Use or disclosure by the covered entity for its own training programs in which students, trainees, or practitioners in mental health learn under supervision to practice or improve their skills in group, joint, family, or individual counseling; or<br>
(C) Use or disclosure by the covered entity to defend itself in a legal action or other proceeding brought by the individual; and<br>
(ii) A use or disclosure that is required by § 164.502(a)(2)(ii) or permitted by § 164.512(a); § 164.512(d) with respect to the oversight of the originator of the psychotherapy notes; § 164.512(g)(1); or § 164.512(j)(1)(i).<br><br>
§164.508(a)(3) Authorization required: Marketing.<br>
(i)Notwithstanding any provision of this subpart, other than the transition provisions in §164.532, a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form of:<br>
(A) A face-to-face communication made by a covered entity to an individual; or (B) a promotional gift of nominal value provided by the covered entity.<br>
(ii) If the marketing involves financial remuneration, as defined in paragraph (3) of the definition of marketing at § 164.501, to the covered entity from a third party, the authorization must state that such remuneration is involved.<br><br>
§164.508(a)(4) Authorization required: Sale of protected health information.<br>
(i) Notwithstanding any provision of this subpart, other than the transition provisions in § 164.532, a covered entity must obtain an authorization for any disclosure of protected health information which is a sale of protected health information, as defined in § 164.501 of this subpart.<br>
(ii) Such authorization must state that the disclosure will result in remuneration to the covered entity.<br><br>
§164.508(b)(1) Valid authorizations.<br>
(i) A valid authorization is a document that meets the requirements in paragraphs (a)(3)(ii), (a)(4)(ii), (c)(1), and (c)(2) of this section, as applicable.<br>
(ii) A valid authorization may contain elements or information in addition to the elements required by this section, provided, that such additional elements or information are not inconsistent with the elements required by this section.<br><br>
§164.508(b)(2) Defective authorizations. An authorization is not valid, if the document submitted has any of the following defects:<br>
(i) The expiration data has passed or the expiration event is known by the covered entity to have occurred;<br>
(ii) The authorization has not been filled out completely, with respect to an element described by paragraph (c) of this section, if applicable;<br>
(iii) The authorization is known by the covered entity to have been revoked;<br>
(iv) The authorization violates paragraph (b)(3) or (4) of this section, if applicable;<br>
(v) Any material information in the authorization is known by the covered entity to be false.</td>
<td valign="top">What policies and procedures exist for obtaining a valid authorization when required?<br>
Do policies and procedures exist to determine when authorization is required?<br><br>
Obtain and review against the established performance criterion the policies and procedures for obtaining a valid authorization as required by the standard:<br>
-Documentation of covered entity policy and procedures<br>
-Documentation that a standard covered entity authorization, if any, is valid<br><br>
Obtain and evaluate a sample of authorizations obtained to permit disclosures for consistency with the established performance criterion and entity-established policies and procedures.<br>
For providers only: obtain and review all relevant patient intake forms for both inpatient and outpatient services, including consent and authorization forms, if any, to assess whether the provider's practice is to use a consent when an authorization would be required for any use or disclosure of information pursuant to the consent.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.508(b)(3)</td>
<td valign="top">Compound authorizations -- Exceptions</td>
<td valign="top">§164.508(b)(3) Compound authorizations. An authorization for use or disclosure of protected health information may not be combined with any other document to create a compound authorization, except as follows:<br>
(i) An authorization for the use or disclosure of protected health information for a research study may be combined with any other type of written permission for the same or another research study. This exception includes combining an authorization for the use or disclosure of protected health information for a research study with another authorization for the same research study, with an authorization for the creation or maintenance of a research database or repository, or with consent to participate in research. Where a covered health care provider has conditioned the provision of research-related treatment on the provision of one of the authorizations, as permitted under paragraph (b)(4)(i) of this section, any compound authorization created under this paragraph must clearly differentiate between the conditioned and unconditioned components and provide the individual with an opportunity to opt in to the research activities described in the unconditioned authorization.<br>
(ii) An authorization for a use or disclosure of psychotherapy notes may only be combined with another authorization for a use or disclosure of psychotherapy notes.<br>
(iii) An authorization under this section, other than an authorization for a use or disclosure of psychotherapy notes, may be combined with any other such authorization under this section, except when a covered entity has conditioned the provision of treatment, payment, enrollment in the health plan, or eligibility for benefits under paragraph (b)(4) of this section on the provision of one of the authorizations. The prohibition in this paragraph on combining authorizations where one authorization conditions the provision of treatment, payment, enrollment in a health plan, or eligibility for benefits under paragraph (b)(4) of this section does not apply to a compound authorization created in accordance with paragraph (b)(3)(i) of this section.</td>
<td valign="top">Does the covered entity use or disclose PHI for the purpose of research, conducts research, provides psychotherapy services, and uses compound authorizations?<br><br>
Obtain and review a sample of used compound authorizations, if any.<br>
Evaluate such authorizations in relation to the established performance criterion:<br>
-Compound authorizations for the same research study<br>
-difference between conditioned and unconditioned components<br>
-Use or disclosure of psychotherapy notes and<br>
-Any other prohibition required under the established performance criterion</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.508(b)(4)</td>
<td valign="top">Prohibition on conditioning of authorizations</td>
<td valign="top">§164.508(b)(4) Prohibition on conditioning of authorizations. A covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization, except:<br>
(i) A covered health care provider may condition the provision of research-related treatment on provision of an authorization for the use or disclosure of protected health information for such research under this section;<br>
(ii) A health plan may condition enrollment in the health plan or eligibility for benefits on provision of an authorization requested by the health plan prior to an individual's enrollment in the health plan, if:<br>
(A) The authorization sought is for the health plan's eligibility or enrollment determinations relating to the individual or for its underwriting or risk rating determinations; and<br>
(B) The authorization is not for a use or disclosure of psychotherapy notes under paragraph (a)(2) of this section; and<br>
(iii) A covered entity may condition the provision of health care that is solely for the purpose of creating protected health information for disclosure to a third party on provision of an authorization for the disclosure of the protected health information to such third party.</td>
<td valign="top">Does the covered entity condition treatment, payment, enrollment, or eligibility on receipt of an authorization? If so, does one of the limited exceptions apply?<br><br>
Obtain and review policies and procedures related to seeking authorizations from individuals.<br>
Obtain and review a sample of conditioned authorizations to assess whether the exceptions listed in the established performance criterion have been applied consistent with its requirements.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top"><a name="anchor24">§164.508(b)(6) and §164.508(c)(1-4)</td>
<td valign="top">Uses and Disclosures for which an Authorization is Required – Documentation and Content</td>
<td valign="top">§164.508(b)(6) Documentation. A covered entity must document and retain any signed authorization under this section as required by §164.530(j).<br><br>
§164.508(c) Implementation specifications: Core elements and requirements. (1) Core elements. A valid authorization under this section must contain at least the following elements:<br>
(i) A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion.<br>
(ii) The name or other specific identification of the person(s), or class of persons, authorized to make the requested use or disclosure.<br>
(iii) The name or other specific identification of the person(s), or class of persons, to whom the covered entity may make the requested use or disclosure.<br>
(iv) A description of each purpose of the requested use or disclosure. The statement “at the request of the individual” is a sufficient description of the purpose when an individual initiates the authorization and does not, or elects not to, provide a statement of the purpose.<br>
(v) An expiration date or an expiration event that relates to the individual or the purpose of the use or disclosure. The statement “end of the research study,” “none,” or similar language is sufficient if the authorization is for a use or disclosure of protected health information for research, including for the creation and maintenance of a research database or research repository.<br>
(vi) Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative's authority to act for the individual must also be provided.<br>
§164.508(c)(2) Required Statements. In addition to the core elements, the authorization must contain statements adequate to place the individual on notice of all of the following:<br>
(i) The individual's right to revoke the authorization in writing and either:<br>
(ii) The ability or inability to condition treatment, payment, enrollment or eligibility for benefits on the authorization.<br>
(iii) The potential for information disclosed pursuant to the authorization to be subject to redisclosure by the recipient can no longer be protected by this subpart.<br>
§164.508(c)(3) The authorization must be written in plain language.<br>
§164.508(c)(4) If a covered entity seeks an authorization from an individual for a use or disclosure of protected health information, the covered entity must provide the individual with a copy of the signed authorization.</td>
<td valign="top">Does the covered entity document and retain signed, valid authorizations?<br><br>
Obtain and review a sample of authorizations used as the basis for making uses and disclosures to determine if the authorizations are valid.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.510(a)(1) and §164.510(a)(2)</td>
<td valign="top">Use and Disclosure for Facility Directories; Opportunity to Object</td>
<td valign="top">§164.510(a) Standard: Use and disclosure for facility directories. (1) Permitted uses and disclosure. Except when an objection is expressed in accordance with paragraph (a)(2) or (3) of this section, a covered health care provider may:<br>
(i) Use the following protected health information to maintain a directory of individuals in its facility:<br>
(A) The individual's name;<br>
(B) The individual's location in the covered health care provider's facility;<br>
(C) The individual's condition described in general terms that does not communicate specific medical information about the individual; and<br>
(D) The individual's religious affiliation; and<br>
(ii) Use or disclose for directory purposes such information:<br>
(A) To member of the clergy; or<br>
(B) Except for religious affiliation, to other persons who ask for the individual by name.<br>
(2) Opportunity to object. A covered health care provider must inform an individual of the protected health information that it may include in a directory and the persons to whom it may disclose such information (including disclosures to clergy of information regarding religious affiliation) and provide the individual with the opportunity to restrict or prohibit some or all of the uses or disclosures permitted by paragraph (a)(1) of this section.</td>
<td valign="top">Does the entity maintain a directory of individuals in its facility?<br><br>
Obtain and review policies and procedures that address determining if the individual has objected to uses and disclosures for facility directories and for documenting such determination.<br><br>
Obtain and review a sample of the directory of individuals in the entity's facility that exists on the specified date and related documentation of individual objections. Evaluate the content against documentation of individual objections and against the listed content criteria.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.510(a)(3)</td>
<td valign="top">Uses and Disclosures for Facility Directories in Emergency Circumstances</td>
<td valign="top">§164.510(a)(3) Emergency circumstances. (i) If the opportunity to object to uses or disclosures required by paragraph (a)(2) of this section cannot practicably be provided because of the individual's incapacity or an emergency treatment circumstance, a covered health care provider may use or disclose some or all of the protected health information permitted by paragraph (a)(1) of this section for the facility's directory, if such disclosure is: (A) Consistent with a prior expressed preference of the individual, if any, that is known to the covered health care provider; and (B) In the individual's best interest as determined by the covered health care provider, in the exercise of professional judgment. (ii) The covered health care provider must inform the individual and provide an opportunity to object to uses or disclosures for directory purposes as required by paragraph (a)(2) of this section when it becomes practicable to do so.</td>
<td valign="top">Do policies and procedures exist to use or disclose PHI for the facility directory in emergency circumstances?<br><br>
Obtain and review the policies and procedures used to disclose PHI for the facility directory due to an emergency circumstance.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top"><a name="anchor5"> §164.510(b)(1)</td>
<td valign="top">Permitted uses and disclosures</td>
<td valign="top">§164.510(b) Standard: Uses and disclosures for involvement in the individual's care and notification purposes<br>
(1) Permitted uses and disclosures. (i) A covered entity may, in accordance with paragraphs (b)(2), (b)(3), or (b)(5) of this section, disclose to a family member, other relative, or a close personal friend of the individual, or any other person identified by the individual, the protected health information directly relevant to such person’s involvement with the individual’s health care or payment related to the individual’s health care.<br>
(ii) A covered entity may use or disclose protected health information to notify, or assist in the notification of (including identifying or locating), a family member, a personal representative of the individual, or another person responsible for the care of the individual of the individual's location, general condition, or death. Any such use or disclosure of protected health information for such notification purposes must be in accordance with paragraphs (b)(2), (b)(3), (b)(4), or (b)(5) of this section, as applicable.</td>
<td valign="top">What policies and procedures exist for disclosing PHI to family members, relatives, close personal friends, or other persons identified by the individual?<br><br>
Obtain and review policies and procedures for such disclosures.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top"><a name="anchor6"> §164.510(b)(2)</td>
<td valign="top">Uses and disclosures with the individual present</td>
<td valign="top">§164.510(b) Standard: Uses and disclosures for involvement in the individual's care and notification purposes<br>
(2) Uses and disclosures with the individual present. If the individual is present for, or otherwise available prior to, a use or disclosure permitted by paragraph (b)(1) of this section and has the capacity to make health care decisions, the covered entity may use or disclose the protected health information if it:<br>
(i) Obtains the individual's agreement;<br>
(ii) Provides the individual with the opportunity to object to the disclosure, and the individual does not express an objection; or<br>
(iii) Reasonably infers from the circumstances, based on the exercise of professional judgment, that the individual does not object to the disclosure.</td>
<td valign="top">Under what circumstances does the covered entity disclose PHI to persons involved in the individual's care when the individual is present?<br><br>
Obtain and review policies and procedures for determining or inferring individual agreement or lack of objection to disclosure of PHI with the individual present.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.510(b)(3)</td>
<td valign="top">Limited uses and disclosures when the individual is not present</td>
<td valign="top">§164.510(b)(3) Limited uses and disclosures when the individual is not present. If the individual is not present, or the opportunity to agree or object to the use or disclosure cannot practicably be provided because of the individual’s incapacity or an emergency circumstance, the covered entity may, in the exercise of professional judgment, determine whether the disclosure is in the best interests of the individual and, if so, disclose only the protected health information that is directly relevant to the person’s involvement with the individual’s care or payment related to the individual’s health care or needed for notification purposes. A covered entity may use professional judgment and its experience with common practice to make reasonable inferences of the individual's best interest in allowing a person to act on behalf of the individual to pick up filled prescription, medical supplies, X-rays, or other similar forms of protected health information.</td>
<td valign="top">Do policies and procedures exist for disclosing only information relevant to the person's involvement in the individual's health care when the individual is not present and in related situations?<br><br>
Obtain and review the policies and procedures used for disclosing only information relevant to the person's involvement with the individual's health care.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.510(b)(4)</td>
<td valign="top">Uses and disclosures for disaster relief purposes</td>
<td valign="top">§164.510(b) Standard: Uses and disclosures for involvement in the individual's care and notification purposes<br>
(4) Uses and disclosures for disaster relief purposes. A covered entity may use or disclose protected health information to a public or private entity authorized by law or by its charter to assist in disaster relief efforts, for the purpose of coordinating with such entities the uses or disclosures permitted by paragraph (b)(1)(ii) of this section. The requirements in paragraphs (b)(2), (b)(3) or (b)(5) of this section apply to such uses and disclosures to the extent that the covered entity, in the exercise of professional judgment, determines that the requirements do not interfere with the ability to respond to the emergency circumstances.</td>
<td valign="top">Do policies and procedures exist for disclosing PHI to a public or private entity authorized by law or by its charter to assist in disaster relief efforts? Obtain and review policies and procedures in relation to such use or disclosure.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.510(b)(5)</td>
<td valign="top">Uses and disclosures when the individual is deceased</td>
<td valign="top">164.510(b) Standard: Uses and disclosures for involvement in the individual's care and notification purposes (5) Uses and disclosures when the individual is deceased. If the individual is deceased, a covered entity may disclose to a family member, or other persons identified in paragraph (b)(1) of this section who were involved in the individual’s care or payment for health care prior to the individual’s death, protected health information of the individual that is relevant to such person’s involvement, unless doing so is inconsistent with any prior expressed preference of the individual that is known to the covered entity.</td>
<td valign="top">Does the covered entity disclose the PHI of deceased individuals in accordance with the established performance criterion?<br>
Obtain and review policies and procedures related to documenting the individual’s prior expressed preference and relationship of family members and other persons to the individual’s care or payment for care, consistent with the established performance criterion.<br>
Note: any information that would otherwise constitute PHI of a decedent under §160.201 ceases to be PHI 50 years after the death of the decedent.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(a)</td>
<td valign="top">Uses and disclosures required by law</td>
<td valign="top">§164.512(a)(1) - A covered entity may use or disclose protected health information to the extent that such use or disclosure is required by law and the use or disclosure complies and is limited to the relevant requirements of such law.<br><br>
§164.512(a)(2) - A covered entity must meet the requirements described in paragraph (c), (e), or (f) of this section for uses or disclosures required by law.</td>
<td valign="top">Does the covered entity use and disclose PHI pursuant to requirements of other law? If so, are such uses and disclosures made consistent with the requirements of this performance criterion as well as the applicable requirements related to victims of abuse, neglect or domestic violence, pursuant to judicial and administrative proceedings and law enforcement purposes of this section? Obtain and review policies and procedures for uses and disclosures required by law.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(b)</td>
<td valign="top">Uses and disclosures for public health activities</td>
<td valign="top">§164.512(b) Standard: Uses and disclosures for public health activities.<br>
(1) Permitted uses and disclosures. A covered entity may use or disclose protected health information for the public health activities and purposes described in this paragraph to:<br>
(i) A public health authority that is authorized by law to collect or receive such information for the purpose of preventing or controlling disease, injury, or disability, including, but not limited to, the reporting of disease, injury, vital events such as birth or death, and the conduct of public health surveillance, public health investigations, and public health interventions; or, at the direction of a public health authority, to an official of a foreign government agency that is acting in collaboration with a public health authority;<br>
(ii) A public health authority or other appropriate government authority authorized by law to receive reports of child abuse or neglect.<br>
(iii) A person subject to the jurisdiction of the Food and Drug Administration (FDA) with respect to an FDA-regulated products or activity for which that person has responsibility, for the purpose of activities related to the quality, safety or effectiveness of such FDA-regulated product or activity. Such purposes include:<br>
(A) To collect or report adverse events (or similar activities with respect to food or dietary supplements), product defects or problems (including problems with the use or labeling of a product), or biological product deviations; (B) To track FDA-regulated products; (C) To enable product recalls, repairs, or replacement, or look back (including locating and notifying individuals who have received products that have been, withdrawn, or are the subject of look back); or (D) To conduct post marketing surveillance; (iv) A person who may have been exposed to a communicable disease or may otherwise be at risk of contracting or spreading a disease or condition, if the covered entity or public health authority is authorized by law to notify such person as necessary in the conduct of a public health intervention or investigation; or<br>
(v) An employer, about an individual who is a member of the workforce of the employer, if:<br>
(A) The covered entity is a covered health care provider who provides health care to the individual at the request of the employer:<br>
(1) To conduct an evaluation relating to medical surveillance of the workplace; or<br>
(2) To evaluate whether the individual has a work-related illness or injury;<br>
(B) The protected health information that is disclosed consists of findings concerning a work-related illness or injury or a workplace-related medical surveillance;<br>
(C) The employer needs such findings in order to comply with its obligations, under 29 CFR parts 1904 through 1928, 30 CFR parts 50 through 90, or under state law having a similar purpose, to record such illness or injury or to carry out responsibilities for workplace medical surveillance; and<br>
(D) The covered health care provider provides written notice to the individual that protected health information relating to the medical surveillance of the workplace and work-related illnesses and injuries is disclosed to the employer:<br>
(1) By giving a copy of the notice to the individual at the time the health care is provided; or<br>
(2) If the health care is provided on the work site of the employer, by posting the notice in a prominent place at the location where the health care is provided.<br>
(vi) A school, about an individual who is a student or prospective student of the school, if:<br>
(A) The protected health information that is disclosed is limited to proof of immunization;<br>
(B) The school is required by State or other law to have such proof of immunization prior to admitting the individual; and (C) The covered entity obtains and documents the agreement to the disclosure from either:<br>
(1) A parent, guardian, or other person acting in loco parentis of the individual, if the individual is an unemancipated minor; or<br>
(2) The individual, if the individual is an adult or emancipated minor.<br>
(2) Permitted uses. If the covered entity also is a public health authority, the covered entity is permitted to use protected health information in all cases in which it is permitted to disclose such information for public health activities under paragraph (b)(1) of this section.</td>
<td valign="top">Are policies and procedures in place that specify how the covered entity uses or disclosures PHI for public health activities consistent with this standard?<br>
Obtain and review policies and procedures in relation to the established performance criterion regarding permitted uses and disclosures for public health activities.<br><br>
Obtain and review a sample of such uses and disclosures, to include uses and disclosures to an employer about an individual who is a member of the workforce of the employer, and determine whether all criteria were met.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(c)</td>
<td valign="top">Disclosures about victims of abuse, neglect or domestic violence</td>
<td valign="top">§164.512(c) Standard: Disclosures about victims of abuse, neglect or domestic violence<br>
(1) Permitted disclosures. Except for reports of child abuse or neglect permitted by paragraph (b)(1)(ii) of this section, a covered entity may disclose protected health information about an individual whom the covered entity reasonably believes to be a victim of abuse, neglect, or domestic violence to a government authority, including a social service or protective services agency, authorized by law to receive reports of such abuse, neglect, or domestic violence: (i) To the extent the disclosure is required by law and the disclosure complies with and is limited to the relevant requirements of such law; (ii) If the individual agrees to the disclosure; or (iii) To the extent the disclosure is expressly authorized by statute or regulation and: (A) The covered entity, in the exercise of professional judgment, believes the disclosure is necessary to prevent serious harm to the individual or other potential victims; or (B) If the individual is unable to agree because of incapacity, a law enforcement or other public official authorized to receive the report represents that the protected health information for which disclosure is sought is not intended to be used against the individual and that an immediate enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure.<br><br>
§164.512(c)(2) Informing the individual. A covered entity that makes a disclosure permitted by paragraph (c)(1) of this section must promptly inform the individual that such a report has been or will be made, except if: (i) The covered entity, in the exercise of professional judgment, believes informing the individual would place the individual at risk of serious harm; or (ii) The covered entity would be informing a personal representative, and the covered entity reasonably believes the personal representative is responsible for the abuse, neglect, or other injury, and that informing such person would not be in the best interests of the individual as determined by the covered entity, in the exercise of professional judgment.</td>
<td valign="top">How does the covered entity determine whether and how to make disclosures about victims of abuse, neglect, or domestic violence consistent with this standard?<br><br>
Obtain and review policies and procedures. When and in what instances will the individual be notified that a disclosure has been or will be made?<br>
</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(d)</td>
<td valign="top">Uses and disclosures for health oversight activities</td>
<td valign="top">§164.512(d) Standard: Uses and disclosures for health oversight activities<br>
(1) Permitted disclosures. A covered entity may disclose protected health information to a health oversight agency for oversight activities authorized by law, including audits; civil, administrative, or criminal investigations; inspections; licensure or disciplinary actions; civil, administrative, or criminal proceedings or actions; or other activities necessary for appropriate oversight of:<br>
(i) The health care system;<br>
(ii) Government benefit programs for which health information is relevant to beneficiary eligibility;<br>
(iii) Entities subject to government regulatory programs for which health information is necessary for determining compliance with program standards; or<br>
(iv) Entities subject to civil rights laws for which health information is necessary for determining compliance.<br><br>
§164.512(d)(2) Exception to health oversight activities. For the purpose of the disclosures permitted by paragraph (d)(1) of this section, a health oversight activity does not include an investigation or other activity in which the individual is the subject of the investigation or activity and such investigation or other activity does not arise out of and is not directly related to:<br>
(i) The receipts of health care;<br>
(ii) A claim for public benefits related to health; or<br>
(iii) Qualification for, or receipt of, public benefits or services when a patient's health is integral to the claim for public benefits or services.<br><br>
§164.512(d)(3) Joint activities or investigations. Notwithstanding paragraph (d)(2) of this section, if a health oversight activity or investigation is conducted in conjunction with an oversight activity or investigation relating to a claim for public benefits not related to health, the joint activity or investigation is considered a health oversight activity for purposes of paragraph (d) of this section.<br><br>
§164.512(d)(4) Permitted uses. If a covered entity also is a health oversight agency, the covered entity may use protected health information for health oversight activities as permitted by paragraph (d) of this section.</td>
<td valign="top">Is PHI used or disclosed for health oversight activities consistent with the established performance criterion?<br><br>
Obtain and review policies and procedures for using or disclosing PHI for health oversight activities.<br><br>
Obtain a sample of disclosures made for this purpose and verify that the established performance criterion have been met.<br>
Regarding §164.512(d)(4), is the covered entity also a health oversight agency? If so, is PHI used for health oversight activities conducted by the covered entity?<br><br>
If yes, obtain and review policies and procedures for using PHI for health oversight activities conducted by the covered entity and determine whether they are consistent with the requirements of the established performance criterion.<br><br>
Obtain a sample of uses made for this purpose and verify that the established performance criterion have been met.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(e)</td>
<td valign="top">Disclosures for judicial and administrative proceedings</td>
<td valign="top">§164.512(e)(1) Permitted disclosures. A covered entity may disclose protected health information in the course of any judicial or administrative proceeding:<br>
(i) In response to an order of a court or administrative tribunal, provided that the covered entity discloses only the protected health information expressly authorized by such order; or<br>
(ii) In response to a subpoena, discovery request, or other lawful process, that is not accompanied by an order of a court or administrative tribunal, if:<br>
(A) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iii) of this section, from the party seeking the information that reasonable efforts have been made by such party of the protected health information that has been requested has been given notice of the request; or<br>
(B) The covered entity receives satisfactory assurance, as described in paragraph (e)(1)(iv) of this section, from the party seeking the information that reasonable efforts have been made by such party to secure a qualified protective order that meets the requirements of paragraph (e)(1)(v) of this section.<br>
(iii) For the purposes of paragraph (e)(1)(ii)(A) of this section, a covered entity receives satisfactory assurances from a party seeking protected health information if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:<br>
(A) The party requesting such information has made a good faith attempts to provide written notice to the individual (or, if the individual's location is unknown, to mail a notice to the individual's last known address);<br>
(B) The notice included sufficient information about the litigation or proceeding in which the protected health information is requested to permit the individual to raise an objection to the court or administrative tribunal; and<br>
(C) The time for the individual to raise objections to the court or administrative tribunal has elapsed, and<br>
(1) No objections were filed; or<br>
(2) All objections filed by the individual have been resolved by the court or the administrative tribunal and the disclosures being sought are consistent with such resolution.<br>
(iv) For the purpose of paragraph (e)(1)(ii)(B) of this section, a covered entity receives satisfactory assurance from a party seeking protected health information, if the covered entity receives from such party a written statement and accompanying documentation demonstrating that:<br>
(A) The parties to the dispute given rise to the request for information have agreed to a qualified protective order and have presented it to the court or administrative tribunal with jurisdiction over and dispute; or<br>
(B) The party seeking the protected health information has requested a qualified protective order from such court or administrative tribunal.<br>
(v) For purpose of paragraph (e)(1) of this section, a qualified protective order means, with respect to protected health information requested under paragraph (e)(1)(ii) of this section, an order of a court of an administrative tribunal stipulation by the parties to the litigation or administrative proceeding that:<br>
(A) Prohibits the parties from using or disclosing the protected health information for any purpose other than the litigation or proceeding for which such information was requested; and<br>
(B) Requires the return to the covered entity or destruction of the protected health information (including all copies made) at the end of the litigation or proceeding.<br>
(vi) Notwithstanding paragraph (e)(1)(ii) of this section, a covered entity may disclose protected health information in response to lawful process described in paragraph (e)(1)(ii) of this section without receiving satisfactory assurance under paragraph (e)(1)(ii)(A) or (B) of this section, if the covered entity makes reasonable efforts to provide notice to the individual sufficient to meet the requirements of paragraph (e)(1)(iii) of this section or to seek a qualified protective order sufficient to meet the requirements of paragraph (e)(1)(v) of this section.<br>
(2) Other uses and disclosures under this section. The provisions of this paragraph do not supersede other provisions of this section that otherwise permit or restrict uses or disclosures of protected health information.</td>
<td valign="top">Do policies and procedures exist related to making disclosures in the course of any judicial or administrative proceeding to limit such disclosures to those permitted by the established performance criterion?<br>
Obtain and review policies and procedures related to disclosures of PHI made pursuant to judicial and administrative proceedings.<br>
Obtain and review a sample of disclosures and the corresponding court orders, subpoenas, or discovery requests for judicial and administrative proceedings. Elements to consider include, but are not limited to, whether<br>
the disclosure of PHI:<br>
-Is in response to an order of a court or administrative tribunal<br>
-Is in response to a subpoena, discovery request, or other lawful process.<br>
Verify disclosure of PHI in the course of any judicial or administrative proceeding is appropriate. Elements to consider should consist of the established performance criterion and include, but are not limited to:<br>
-A court order requesting a response<br>
-A subpoena.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(f)(1)</td>
<td valign="top">Disclosures for law enforcement purposes</td>
<td valign="top">§164.512(f) Standard: Disclosures for law enforcement purposes. A covered entity may disclose protected health information for a law enforcement purpose to a law enforcement official if the conditions in paragraphs (f)(1) through (f)(6) of this section are met, as applicable.<br>
(1) Permitted disclosures: Pursuant to process and as otherwise required by law. A covered entity may disclose protected health information:<br>
(i) As required by law including laws that require the reporting of certain types of wounds or other physical injuries, except for laws subject to paragraph (b)(1)(ii) or (c)(1)(i) of this section; or<br>
(ii) In compliance with and as limited by the relevant requirements of:<br>
(A) A court order or court-ordered warrant, or a subpoena or summons issued by a judicial officer;<br>
(B) A grand jury subpoena; or<br>
(C) An administrative request, including an administrative subpoena or summons, a civil or an authorized investigative demands, or similar process authorized under law, provided that:<br>
(1) The information sought is relevant and material to a legitimate law enforcement inquiry;<br>
(2) The request is specific and limited in scope to the extent reasonably practicable in light of the purpose for which the information is sought; and<br>
(3) De-identified information could not reasonably be used.</td>
<td valign="top">Have disclosures made by the covered entity for law enforcement purposes been consistent with the performance criterion?<br>
Obtain and review policies and procedures related to disclosures of PHI for law enforcement purposes against the established performance criterion.<br><br>
Obtain and review a sample, as available, of disclosures and the corresponding court orders, subpoenas, discovery requests, etc., and determine if such disclosures are consistent with the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(f)(2)</td>
<td valign="top">Disclosures for law enforcement purposes - for identification and location -</td>
<td valign="top">§164.512(f)(2) Permitted disclosures: Limited information for identification and location purposes. Except for disclosures required by law as permitted by paragraph (f)(1) of this section, a covered entity may disclose protected health information in response to a law enforcement official's request for such information for the purpose of identifying or locating a suspect, fugitive, material witness, or missing person, provided that:<br>
(i) The covered entity may disclose only the following information:<br>
(A) Name and address;<br>
(B) Date and place of birth;<br>
(C) Social security number;<br>
(D) ABO blood type and rh factor;<br>
(E) Type of injury;<br>
(F) Date and time of treatment;<br>
(G) Date and time of death, if applicable; and<br>
(H) A description of distinguishing physical characteristics, including height, weight, gender, race, hair and eye color, presence or absence of facial hair (beard or moustache), scars, and tattoos.<br>
(ii) Except as permitted by paragraph (f)(2)(i) of this section, the covered entity may not disclose for the purpose of identification or location under paragraph (f)(2) of this section any protected health information related to the individual's DNA or DNA analysis, dental records, or typing, samples or analysis of blood fluids or tissue.</td>
<td valign="top">Are disclosures made to law enforcement for identification and location purposes by the covered entity consistent with the limitations listed in the established performance criterion?<br><br>
Obtain and review policies and procedures related to disclosures of PHI to law enforcement officials for identification and location purposes.<br>
Obtain and review a sample of responses to law enforcement officials request for PHI for identification and location purposes and assess whether the disclosures were consistent with the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(f)(3)</td>
<td valign="top">Disclosures for law enforcement purposes-- PHI of a possible victim of a crime</td>
<td valign="top">§164.512(f)(3) Permitted disclosure: Victims of a crime. Except for disclosures required by law as permitted by paragraph (f)(1) of this section, a covered entity may disclose protected health information in response to a law enforcement official's request for such information about an individual who is or is suspected to be a victim of a crime, other than disclosures that are subject to paragraph (b) or (c) of this section, if:<br>
(i) The individual agrees to the disclosure; or<br>
(ii) The covered entity is unable to obtain the individual's agreement because of incapacity or other emergency circumstance, provided that:<br>
(A) The law enforcement official represents that such information is needed to determine whether a violation of law by a person other than the victim has occurred, and such information is not intended to be used against the victim;<br>
(B) The law enforcement official represents that immediate law enforcement activity that depends upon the disclosure would be materially and adversely affected by waiting until the individual is able to agree to the disclosure; and<br>
(C) The disclosure is in the best interest of the individual as determined by the covered entity, in the exercise of professional judgment.</td>
<td valign="top">Are policies and procedures consistent with the established performance criterion regarding the conditions in which the covered entity may disclose PHI of a possible victim of a crime in response to a law enforcement official's request?<br><br>
Obtain and review policies and procedures related to such disclosures of PHI to law enforcement. If any, obtain and review a sample of responses to a law enforcement official's request to determine whether disclosure was made consistent with the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(f)(4)</td>
<td valign="top">Disclosures for law enforcement purposes-- an individual who has died as a result of suspected criminal conduct</td>
<td valign="top">§164.512(f)(4) Permitted disclosure: Decedents. A covered entity may disclose protected health information about an individual who has died to a law enforcement official for the purpose of alerting law enforcement of the death of the individual if the covered entity has a suspicious that such death may have resulted from criminal conduct.</td>
<td valign="top">Are policies and procedures in place to determine when it is permitted to disclose PHI to law enforcement about an individual who has died as a result of suspected criminal conduct?<br>
Obtain and review policies and procedures related to disclosures of PHI to law enforcement officials that address the requirement.<br>
Obtain and review documentation of such a disclosure, if available. Elements to consider include, but are not limited to, documentation of:<br>
-Whether the entity exercised professional judgment<br>
-Whether the entity believes in good faith that there was evidence of criminal conduct.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(f)(5)</td>
<td valign="top">Disclosures for law enforcement purposes: crime on premises</td>
<td valign="top">§164.512(f)(5) Permitted disclosure: Crime on premises. A covered entity may disclose to a law enforcement official protected health information that the covered entity believes in good faith constitutes evidence of criminal conduct that occurred on the premises of the covered entity.</td>
<td valign="top">Are policies and procedures in place to determine when it is permitted to disclose PHI about an individual who may have committed a crime on the premises?<br><br>
Determine whether policies and procedures related to disclosures of PHI to law enforcement officials address the established performance criterion.<br>
Obtain and review a disclosure, if available. Elements to consider include, but are not limited to, documentation of:<br>
-Whether the entity exercised professional judgment<br>
-Whether the entity believes in good faith that there was evidence of criminal conduct that occurred on its premises.<br>
</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(f)(6)</td>
<td valign="top">Disclosures for law enforcement purposes</td>
<td valign="top">§164.512(f)(6) Permitted disclosure: Reporting crime in emergencies.<br>
(i) A covered health care provider providing emergency health care in response to a medical emergency, other than such emergency on the premises of the covered health care provider, may disclose protected health information to a law enforcement official if such disclosure appears necessary to alert law enforcement to: (A) The commission and nature of a crime; (B) The location of such crime or of the victim(s) of such crime; and (C) The identity, description, and location of the perpetrator of such crime.<br>
(ii) If a covered health care provider believes that the medical emergency described in paragraph (f)(6)(i) of this section is the result of abuse, neglect, or domestic violence of the individual in need of emergency health care, paragraph (f)(6)(i) of this section does not apply and any disclosure to a law enforcement official for law enforcement purposes is subject to paragraph (c) of this section.</td>
<td valign="top">Are policies and procedures in place to determine what information about a medical emergency is necessary to disclose to alert law enforcement?<br>
Determine whether policies and procedures related to disclosures of PHI to law enforcement officials address the established performance criterion.<br>
Obtain and review a sample of such disclosures. Elements to consider include, but are not limited to, whether the disclosure:<br>
-Indicates the commission and nature of the crime<br>
-Includes the location of the crime or the victim(s) of the crime<br>
-Includes the identity, description, and location of the perpetrator of the crime.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(g)</td>
<td valign="top">Uses and disclosures about decedents</td>
<td valign="top">§164.512(g) Standard: Uses and disclosures about decedents.<br>
(1) Coroners and medical examiners. A covered entity may disclose protected health information to a coroner or medical examiner for the purpose of identifying a deceased person, determining a cause of death, or other duties as authorized by law. A covered entity that also performs the duties of a coroner or medical examiner may use protected health information for the purposes described in this paragraph.<br><br>
§164.512(g)(2) Funeral directors. A covered entity may disclose protected health information to funeral directors, consistent with applicable law, as necessary to carry out their duties with respect to the decedent. If necessary for funeral directors to carry out their duties, the covered entity may disclose the protected health information prior to, and in reasonable anticipation of, the individual's death.</td>
<td valign="top">Are policies and procedures consistent with the established performance criterion for disclosing PHI to (1) a coroner or medical examiner; and (2) a funeral director?<br><br>
Obtain and review policies and procedures related to disclosures of PHI to coroners and medical examiners and funeral directors.<br>
Obtain and review a sample of such disclosures. Elements to consider include, but are not limited to, whether the purpose of disclosure is:<br>
-To identify a deceased person<br>
-To determine the cause of death.<br>
-Authorized by law.<br><br>
Information elements to consider include, but are not limited to, whether the information disclosed is limited to:<br>
-Name of deceased person<br>
-Cause of death<br>
-Compliance with such law.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(h)</td>
<td valign="top">Uses and disclosures for cadaveric organ, eye or tissue donation</td>
<td valign="top">§164.512(h) Standard: Uses and disclosures for cadaveric organ, eye or tissue donation purposes. A covered entity may use or disclose protected health information to organ procurement organizations or other entities engaged in the procurement, banking, or transplantation of cadaveric organs, eyes, or tissue for the purpose of facilitating organ, eye or tissue donation and transplantation.</td>
<td valign="top">Is the covered entity’s process for disclosing PHI to organ procurement organizations or other entities engaged in the procurement consistent with the established performance criterion?<br><br>
Obtain and review policies and procedures related to disclosures of PHI for purposes of cadaveric organ, eye, or tissue donation.<br>
Obtain and review a sample of disclosures of PHI to organ procurement organizations to determine whether such disclosures are consistent with the policies and procedures and the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(i)(1)</td>
<td valign="top">Uses and disclosures for research purposes -- Permitted Uses and Disclosures</td>
<td valign="top">§164.512(i) Standard: Uses and disclosures for research purposes (1) Permitted uses and disclosures. A covered entity may use or disclose protected health information for research, regardless of the source of funding of the research, provided that:<br>
(i) Board approval of a waiver of authorization. The covered entity obtains documentation that an alteration to or waiver, in whole or in part, of the individual authorization required by §164.508 for use or disclosure of protected health information has been approved by either:<br>
(A) An Institutional Review Board (IRB), established in accordance with7 CFR lc.107, 10 CFR 745.107, 14 CFR 1230.107, 15 CFR 27.107, 16 CFR 1028.107, 21 CFR 56.107, 22 CFR 225.107, 24 CFR 60.107, 28 CFR 46.107, 32 CFR 219.107, 34 CFR 97.107, 38 CFR 16.107, 40 CFR 26.107, 45 CFR 46.107, 45 CFR 690.107, or 49 CFR 11.107; or<br>
(B) A privacy board that:<br>
(1) Has members with varying backgrounds and appropriate professional competency as necessary to review the effect of the research protocol on the individual's privacy rights and related interests;<br>
(2) Includes at least one member who is not affiliated with the covered entity, not affiliated with any entity conducting or sponsoring the research, and not related to any person who is affiliated with any of such entities; and<br>
(3) Does not have any member participating in a review of any project in which the member has a conflict of interest.<br>
(ii) Reviews preparatory to research. The covered entity obtains from the researcher representations that:<br>
(A) Uses or disclosures is sought solely to review protected health information as necessary to prepare a research protocol or for similar purposes preparatory to research;<br>
(B) No protected health information is to be removed from the covered entity by the researcher in the course of the review; and<br>
(C) The protected health information for which use or access is sought is necessary for the research purposes.<br>
(iii) Research on decedent's information. The covered entity obtains from the researchers:<br>
(A) Representation that the use or disclosure sought is solely for research on the protected health information or decedents;<br>
(B) Documentation, at the request of the covered entity, of the death of such individuals; and<br>
(C) Representation that the protected health information for which use or disclosure is sought is necessary for the research purposes.</td>
<td valign="top">Does the covered entity use or disclose PHI for research purposes? Inquire of management.<br><br>
For entities that conduct research using or disclosing PHI, obtain and review related policies and procedures.<br><br>
Elements to consider include, but are not limited to, how the entity:<br>
-Obtains documentation that an alteration to a required authorization, or waiver of the authorization, has been approved by an IRB or appropriately configured privacy board<br>
-Obtains from the researchers the required representations regarding reviews preparatory to research on decedents.<br>
Verify if the entity obtained the necessary authorization and/or waiver to conduct the research. Elements to consider include, but are not limited to:<br>
-Board approval of a waiver of authorization<br>
- Whether the use or disclosure is solely to review PHI as necessary to prepare a research protocol<br>
-Representation that the use or disclosure is solely for research on the PHI of decedents.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(i)(2)</td>
<td valign="top">Uses and disclosures for research purposes -- Documentation of Waiver Approval</td>
<td valign="top">§164.512(i) Standard: Uses and disclosures for research purposes (2) Documentation of waiver approval. For a use or disclosure to be permitted based on documentation of approval of an alteration or waiver, under paragraph (i)(1)(i) of this section, the documentation must include all of the following:<br>
(i) Identification of IRB or date of action - A statement identifying the institutional review board or privacy board and the date on which the alteration or waiver of authorization was approved;<br>
(ii) Waiver criteria - A statement that the institutional review board or privacy board has determined that the alteration or waiver, in whole or in part, of authorization satisfies the following criteria:<br>
(A) The use or disclosure of protected health information involves no more than a minimal risk to the privacy of individuals, based on, at least, the presence of the following elements;<br>
(1) An adequate plan to protect the Identifiers from improper use and disclosure;<br>
(2) An adequate plan to destroy the identifiers at the earliest opportunity consistent with conduct of the research, unless there is a health or research justification for retaining the identifiers or such retention is otherwise required by law; and<br>
(3) Adequate written assurances that the protected health information will not be reused or disclosed to any other person or entity, except as required by law, for authorized oversight of the research study, or for other research for which the use or disclosure of protected health information would be permitted by this subpart;<br>
(B) The research could not practicably be conducted without the waiver or alteration; and<br>
(C) The research could not practicably be conducted without access to and use of the protected health information.<br>
(iii) Protected health information needed - A brief description of the protected health information for which use or access has been determined to be necessary by the institutional review board or privacy board, pursuant to paragraph (i)(2)(ii)(C) of this section;<br>
(iv) Review and approval procedures - A statement that the alteration or waiver of authorization has been reviewed and approved under either normal or expedited review procedures, as follows:<br>
(A) An institutional review board must follow the requirements of the Common Rule, including the normal review procedures or the expedited review procedures: 7 CFR 1c.108(b), 10 CFR 745.108(b), 14 CFR 1230.108(b), 15 CFR 27.108(b), 16 CFR 1028.108(b), 21 CFR 56.108(b22 CFR 225.108(b), 24 CFR 60.108(b), 28 CFR 46.108(b), 32 CFR 219.108(b), 34 CFR 97.108(b),38 CFR 16.108(b), 40 CFR 26.108(b), 45 CFR 46.108(b), 45 CFR 690.108(b), or 49 CFR 11.108(b)) or the expedited review procedures (7 CFR 1c.110, 10 CFR 745.110, 14 CFR 1230.110, 15 CFR27.110, 16 CFR 1028.110, 21 CFR 56.110, 22 CFR 225.110, 24 CFR 60.110, 28 CFR 46.110, 32 CFR 219.110, 34 CFR 97.110, 38 CFR 16.110, 40 CFR 26.110, 45 CFR 46.110, 45;<br>
(B) A privacy board must review the proposed research at convened meetings at which a majority of the privacy board members are present, including at least one member who satisfies the criterion stated in paragraph (i)(1)(i)(b)(2) of this section, and the alteration or waiver of authorization must be approved by the majority of the privacy board members present at the meeting, unless the privacy board elects to use an expedited review procedures in accordance with paragraph (i)(2)(iv)(C) of this section;<br>
(C) A privacy board may use an expedited review procedure if the research involves no more than minimal risk to the privacy of the individuals who are the subject of the protected health information for which use or disclosure is being sought. If the privacy board elects to use an expedited review procedure, the review and approval of the alteration or waiver of authorization may be carried out by the chair of the privacy board, or by one or more members of the privacy board as designated by the chair; and<br>
(v) Required signature - The documentation of the alteration or waiver of authorization must be signed by the chair or other member, as designated by the chair, of the institutional review board or the privacy board, as applicable.</td>
<td valign="top">Do policies and procedures exist to determine what documentation of approval or waiver is needed to permit a use or disclosure and to apply that determination?<br>
Obtain and review policies and procedures against established performance criterion. Is the entity using or disclosing PHI consistent with requirements for documentation of a waiver approval? Verify that the documentation of any approval or waiver contains all the information necessary to permit a use or disclosure. Elements to consider include, but are not limited to:<br>
-A statement identifying IRB and the date on which the alteration or waiver of authorization was approved<br>
-Whether IRB determined that the alteration or waiver satisfied the criteria listed in the standard, including determination of no more than minimal risk to privacy, adequate plan to protect identifiers, adequate plan to destroy identifiers, etc.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(k)(1)</td>
<td valign="top">Uses and disclosures for specialized government functions -- Military</td>
<td valign="top">§164.512(k) Standard: Uses and disclosures for specialized government functions.<br>
(1) Military and veterans activities<br>
(i) Armed Forces personnel. A covered entity may use or disclose the protected health information of individuals who are Armed Forces personnel for activities deemed necessary by appropriate military command authorities to assure the proper execution of the military mission, if the appropriate military authority has published by notice in the Federal Register the following information:<br>
(A) Appropriate military command authorities; and<br>
(B) The purposes for which the protected health information may be used or disclosed.<br>
(ii) Separation or discharge from military service. A covered entity that is a component of the Departments of Defense or Homeland Security may disclose to the Department of Veterans Affairs (DVA) the protected health information of an individual who is a member of the Armed Forces upon the separation or discharge of the individual from military service for the purpose of a determination by DVA of the individual’s eligibility for or entitlement to benefits under laws administered by the Secretary of Veterans Affairs.<br>
(iii) Veterans. A covered entity that is a component of the Department of Veterans Affairs may use and disclose protected health information to components of the Department that determine eligibility for or entitlement to, or that provide, benefits under the laws administered by the Secretary of Veterans Affairs.<br>
(iv) Foreign military personnel. A covered entity may use or disclose the protected health information of individuals who are foreign military personnel to their appropriate foreign military authority for the same purposes for which uses and disclosures are permitted for Armed Forces personnel under the notice published in the Federal Register pursuant to paragraph (k)(1)(i) of this section.</td>
<td valign="top">Does the covered entity disclose PHI of individuals for military and veterans activities consistent with the established performance criterion?<br>
Obtain and review policies and procedures related to disclosures of PHI for purposes of military and veterans’ activities.<br>
Obtain and review a list of uses and disclosures for military and veterans activities. Elements to consider are, 1) whether the entity is a component of the DoD, HSA; or VA; and 2) include whether the disclosure relates to:<br>
- Armed force personnel<br>
- Separated or discharged military service personnel<br>
- A veteran<br>
- Foreign military personnel.<br><br>
. Elements to consider include, but are not limited to:<br>
-Whether the activities deemed necessary by appropriate military command authorities<br>
-Whether the purpose is to determine the individual's eligibility for or entitlement to benefits under laws.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(k)(2)</td>
<td valign="top">Uses and disclosures for specialized government functions -- National Security and intelligence activities</td>
<td valign="top">§164.512(k)(2) National security and intelligence activities. A covered entity may disclose protected health information to authorized federal officials for the conduct of lawful intelligence, counter-intelligence, and other national security activities authorized by the National Security Act (50 U.S.C. 401, et seq.) and implementing authority (e.g., Executive Order 12333).</td>
<td valign="top">How would the covered entity respond to a request for PHI from Federal officials for intelligence and other national security activities?<br><br>
Obtain and review policies and procedures related to disclosures of PHI for national security purposes.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(k)(3)</td>
<td valign="top">Uses and disclosures for specialized government functions -- Protective Services</td>
<td valign="top">§164.512(k)(3) Protective services for the President and others. A covered entity may disclose protected health information to authorized Federal officials for the provision of protective services to the President or other persons authorized by 18 U.S.C. 3056 or to foreign heads of state or other persons authorized by 22 U.S.C. 2709(a)(3), or for the conduct of investigations authorized by 18 U.S.C. 871 and 879.</td>
<td valign="top">How would the covered entity respond to a request for PHI from Federal officials for the provision of protective services or the conduct of certain investigations?<br>
Obtain and review policies and procedures related to disclosures of PHI for protective services.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(k)(4)</td>
<td valign="top">Uses and disclosures for specialized government functions -- Medical Suitability Determinations</td>
<td valign="top">§164.512(k)(4) Medical suitability determinations.- A covered entity that is a component of the Department of State may use protected health information to make medical suitability determinations and may disclose whether or not the individual was determined to be medically suitable to the officials in the Department of State who need access to such information for the following purposes:<br>
(i) For the purpose of a required security clearance conducted pursuant to Executive Orders 10450 and 12698;<br>
(ii) As necessary to determine worldwide availability or availability for mandatory service abroad under sections 101(a)(4) and 504 of the Foreign Service Act; or<br>
(iii) For a family to accompany a Foreign Service member abroad, consistent with section 101(b)(5) and 904 of the Foreign Service Act.</td>
<td valign="top">Is the covered entity a component of the Department of State?<br>
If yes, does the covered entity have policies and procedures consistent with the established performance criterion to use and disclose PHI for the purposes described in the established performance criterion? Obtain and review such policies and procedures for consistency with the established performance criterion.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top"><a name="anchor36">§164.512(k)(5)</td>
<td valign="top">Uses and disclosures for specialized government functions – Correctional institutions</td>
<td valign="top">§164.512(k)(5) Correctional institutions and other law enforcement custodial situations.<br>
(i) Permitted disclosures. A covered entity may disclose to a correctional institution or a law enforcement official having lawful custody of an inmate or other individual protected health information about such inmate or individual, if the correctional institution or such law enforcement official represents that such protected health information is necessary for: (A) The provision of health care to such individuals; (B) The health and safety of such individual or other inmates; (C) The health and safety of the officers or employees of or others at the correctional institution; (D) The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another; (E) Law enforcement on the premises of the correctional institution; or (F) The administration and maintenance of the safety, security, and good order of the correctional institution.<br>
(ii) Permitted uses. A covered entity that is a correctional institution may use protected health information of individuals who are inmates for any purpose for which such protected health information may be disclosed.<br>
(iii) No application after release. For the purposes of this provision, an individual is no longer an inmate when released on parole, probation, supervised release, or otherwise is no longer in lawful custody.</td>
<td valign="top">How does the covered entity determine whether to disclose PHI to a correctional institution or a law enforcement official with custody of an individual?<br>
Are policies and procedures in place to determine whether a use or disclosure of PHI to a correctional institution or law enforcement official is permitted?<br><br>
Obtain and review policies and procedures related to disclosures of PHI to correctional institutions or other law enforcement custodial situations for consistency with the established performance criterion.<br>
Obtain and review a sample of documentation of disclosures to a correctional institution or law enforcement official; elements to consider include, but are not limited to, whether the disclosure is necessary for:<br>
-The provision of health care to such individuals<br>
-The health and safety of such individual or other inmates<br>
-The health and safety of the officers or employees of or at the correctional institution<br>
-The health and safety of such individuals and officers or other persons responsible for the transporting of inmates or their transfer from one institution, facility, or setting to another<br>
-Law enforcement on the premises of the correctional institution<br>
-The administration and maintenance of the safety, security, and good order of the correctional institution.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.512(k)(6)</td>
<td valign="top">Uses and disclosures for specialized government functions – Providing public benefits</td>
<td valign="top">(6) Covered entities that are government programs providing public benefits.<br>
(i) A health plan that is a government program providing public benefits may disclose protected health information relating to eligibility for or enrollment in the health plan to another agency administering a government program providing public benefits if the sharing of eligibility or enrollment information among such government agencies or the maintenance of such information in a single or combined data system accessible to all such government agencies is required or expressly authorized by statute or regulation.<br>
(ii) A covered entity that is a government agency administering a government program providing public benefits may disclose protected health information relating to the program to another covered entity that is a government agency administering a government program providing public benefits if the programs serve the same or similar populations and the disclosure of protected health information is necessary to coordinate the covered functions of such programs or to improve administration and management relating to the covered functions of such programs.</td>
<td valign="top">Is the covered entity a health plan that is a government program providing public benefits, or is it a government agency administering a government program providing public benefits?<br>
If yes. does the covered entity have policies and procedures consistent with the established performance criterion in place to disclose PHI for the purposes listed? Obtain and review the policies and procedures.<br><br>
Obtain and review a sample of such disclosures.</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.512(l)</td>
<td valign="top">Disclosures for workers' compensation</td>
<td valign="top">§164.512(l) Standard: Disclosures for workers' compensation. A covered entity may disclose protected health information as authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.</td>
<td valign="top">Are policies and procedures in place regarding disclosure of PHI for the purpose of workers' compensation, that are consistent with the established performance criterion?<br><br>
Obtain and review policies and procedures related to disclosures of PHI for workers’ compensation or other similar programs for consistency with the established performance criterion.<br>
Obtain and review a sample of documentation of disclosures for the purpose of workers' compensation; elements to consider include, but are not limited to, whether the disclosure is authorized by and to the extent necessary to comply with laws relating to workers' compensation or other similar programs, established by law, that provide benefits for work-related injuries or illness without regard to fault.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.514(b) & §164.514(c)</td>
<td valign="top">Requirements for De-Identification of PHI & Re-Identification of PHI</td>
<td valign="top">§164.514 (b) Implementation specifications: Requirements for de-identification of protected health information. A covered entity may determine that health information is not individually identifiable health information only if:<br>
(1) A person with appropriate knowledge of any experience with generally accepted statistical scientific principles and methods for rendering information not individually identifiable:<br>
(i) Applying such principles and methods, determines that the risk is very small that the information could be used, alone or in combination with other reasonably available information, by an anticipated recipient to identify and individual who is a subject for the information; and<br>
(ii) Documents the methods and results of the analysis that justify such determination; or<br>
(2)(i) The following identifiers of the individual or of relatives, employers, or household members of the individual, are removed:<br>
(A) Names;<br>
(B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current available data from the Bureau of the Census;<br>
(1) The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and<br>
(2) The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.<br>
(C) All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into single category of age 90 or older;<br>
(D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses; (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger voice prints;<br>
(Q) Full face photographic images and any comparable images; and (R) Any other unique identifying number, characteristic, or code, except as permitted by paragraph (c) of this section; and<br>
(ii) The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.<br><br>
§164.514(c) Implementation specifications: Re-identification. A covered entity may assign a code or other means of record identification to allow information de-identified under this section to be re-identified by the covered entity, provided that: (1) The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and (2) Security. The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.</td>
<td valign="top">A covered entity may be , but is not required, to de-identify PHI.<br><br>
Does the covered entity de-identify PHI consistent with the established performance criterion?<br><br>
Obtain and review policies and procedures to determine whether they comply with the established performance criterion.<br>
Refer to the de-identification guidance for assistance in these determinations: <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-identification/index.html?language=es" id="anch_88">http://www.hhs.gov/ ocr/privacy /hipaa/ understanding/ coveredentities/ De-identif ication/ guidance.html</a></td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.514(d)(1)-§164.514(d)(2)</td>
<td valign="top">Standard: Minimum Necessary & Minimum Necessary Uses of PHI</td>
<td valign="top">(b) Standard: Minimum necessary<br>
(1) Minimum necessary applies. When using or disclosing protected health information or when requesting protected health information from another covered entity or business associate, a covered entity or business associate must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.<br>
(2) Minimum necessary does not apply. This requirement does not apply to:<br>
(i) Disclosures to or requests by a health care provider for treatment;<br>
(ii) Uses or disclosures made to the individual, as permitted under paragraph (a)(1)(i) of this section or as required by paragraph (a)(2)(i) of this section;<br>
(iii) Uses or disclosures made pursuant to an authorization under § 164.508;<br>
(iv) Disclosures made to the Secretary in accordance with subpart C of part 160 of this subchapter;<br>
(v) Uses or disclosures that are required by law, as described by § 164.512(a); and<br>
(vi) Uses or disclosures that are required for compliance with applicable requirements of this subchapter.<br>
§164.514(d)(2) Implementation specifications: Minimum necessary uses of protected health information.<br>
(i) A covered entity must identify: (A) Those persons or classes of persons, as appropriate, in its workforce who need access to protected health information to carry out their duties; and (B) For each such person or class of persons, the category or categories of protected health information to which access is needed and any conditions appropriate to such access.<br><br>
(ii) A covered entity must make reasonable efforts to limit the access of such persons or classes identified in paragraph (d)(2)(i)(A) of this section to protected health information consistent with paragraph (d)(2)(i)(B) of this section.</td>
<td valign="top">Has the covered entity implemented policies and procedures consistent with the requirements of the established performance criterion to identify need for and limit use of PHI?<br><br>
Obtain and review policies and procedures for limiting access to PHI. Elements to consider include, but are not limited to:-<br>
-Criteria for determining what level of access a person or class of persons will need<br>
-Criteria for modifying, reviewing, or terminating an individual’s access<br>
--Efforts to limit access consistent with the needs and conditions described for each person or class of persons<br>
-Whether the policies and procedures take into account access to both PHI and ePHI.<br><br>
Obtain and review the access of a sample of workforce members with access to PHI for their corresponding job title and description to determine whether the access is consistent with the policies and procedures.<br><br>
NOTE: The rule requires that the class/job functions that need to use or disclose PHI be determined and the information be limited to what is needed for that job classification.</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.514(d)(3)</td>
<td valign="top">Minimum Necessary - Disclosures of PHI</td>
<td valign="top">§164.514(d)(3) Implementation specification: Minimum necessary disclosures of protected health information.<br>
(i) For any type of disclosure that it makes on a routine and recurring basis, a covered entity must implement policies and procedures (which may be standard protocols) that limit the protected health information disclosed to the amount reasonably necessary to achieve the purpose of the disclosure.<br>
(ii) For all other disclosures, a covered entity must: (A) Develop criteria designed to limit the protected health information disclosed to the information reasonably necessary to accomplish the purpose for which disclosure is sought; and (B) Review requests for disclosure on an individual basis in accordance with such criteria.<br>
(iii) A covered entity may rely, if such reliance is reasonable under the circumstances, on a requested disclosure as the minimum necessary for the stated purpose when: (A) Making disclosures to public officials that are permitted under § 164.512, if the public official represents that the information requested is the minimum necessary for the stated purpose(s); (B) The information is requested by another covered entity; (C) The information is requested by a professional who is a member of its workforce or is a business associate of the covered entity for the purpose of providing professional services to the covered entity, if the professional represents that the information requested is the minimum necessary for the stated purpose(s); or (D) Documentation or representations that comply with the applicable requirements of § 164.512(i) have been provided by a person requesting the information for research purposes.</td>
<td valign="top">Are policies and procedures in place to limit the PHI disclosed to the amount reasonably necessary to achieve the purpose of the disclosure?<br><br>
Obtain and review policies and procedures related to minimum necessary disclosures and evaluate the content relative to the established performance criterion.<br>
Obtain and review a sample of protocols for disclosures made on a routine and recurring basis and determine if such protocols limit to the PHI to what is reasonably necessary to achieve the purpose of the disclosure, as required by 514(d)(3).</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.514(d)(4)</td>
<td valign="top">Minimum Necessary requests for protected health information</td>
<td valign="top">§164.514(d)(4) Implementation specifications: Minimum necessary requests for protected health information. (i) A covered entity must limit any request for protected health information to that which is reasonably necessary to accomplish the purpose for which the request is made, when requesting such information from other covered entities.<br>
(ii) For a request that is made on a routine and recurring basis, a covered entity must implement policies and procedures (which may be standard protocols) that limit the protected health information requested to the amount reasonably necessary to accomplish the purpose for which the request is made.<br>
(iii) For all other requests, a covered entity must:<br>
(A) Develop criteria designed to limit the request for protected health information to the information reasonably necessary to accomplish the purpose for which the request is made; and<br>
(B) Review requests for disclosure on an individual basis in accordance with such criteria.</td>
<td valign="top">Are policies and procedures in place to limit the PHI requested by the entity being audited to the amount minimally necessary to achieve the purpose of the disclosure?<br><br>
Obtain and review policies and procedures related to minimum necessary requests and evaluate the content relative to the specified criteria.<br>
Obtain and review a sample of requests made on a routine and recurring basis and determine if they are limited to the PHI reasonably necessary to achieve the purpose of the disclosure, as required by §164.514(d)(4).</td>
<td valign="top"> </td>
</tr><tr class="color2"><td valign="top">Privacy</td>
<td valign="top">§164.514(d)(5)</td>
<td valign="top">Minimum Necessary - Other content requirement</td>
<td valign="top">§164.514(d)(5) Implementation specification: Other content requirement. For all uses, disclosures, or requests to which the requirements in paragraph (d) of this section apply, a covered entity may not use, disclose or request an entire medical record, except when the entire medical record is specifically justified as the amount that is reasonably necessary to accomplish the purpose of the use, disclosure, or request.</td>
<td valign="top">Are policies and procedures in place to address uses, disclosures, or requests for an entire medical record?<br><br>
Obtain and review policies and procedures related to minimum necessary uses, disclosures, or requests for an entire medical record for consistency with the established performance criterion.<br>
Obtain and review a sample of use, disclosure, or request for an entire medical record and determine if it is limited to the PHI reasonably necessary to achieve the purpose of the use, disclosure, or request as required by §164.514(d)(5).</td>
<td valign="top"> </td>
</tr><tr class="color1"><td valign="top">Privacy</td>
<td valign="top">§164.514(e)</td>
<td valign="top">Limited Data Sets and Data Use Agreements</td>
<td valign="top">§164.514(e)(1) Standard: Limited data set. A covered entity may use or disclose a limited data set that meets the requirements of paragraphs (e)(2) and (e)(3) of this section, if the covered entity enters into a data use agreement with the limited data set recipient, in accordance with paragraph (e)(4) of this section.<br><br>
§164.514(e)(2) Implementation specification: Limited data set: A limited data set is protected health information that excludes the following direct identifiers of the individual or of relatives, employers, or household members of the individual: (i) Names; (ii) Postal address information, other than town or city, State, and zip code; (iii) Telephone numbers; (iv) Fax numbers; (v) Electronic mail addresses; (vi) Social security numbers; (vii) Medical record numbers; (viii) Health plan beneficiary numbers; (ix) Account numbers; (x) Certificate/license numbers; (xi) Vehicle identifiers and serial numbers, including license plate numbers; (xii) Device identifiers and serial numbers; (xiii) Web Universal Resource Locators (URLs); (xiv) Internet Protocol (IP) address numbers; (xv) Biometric identifiers, including finger and voice prints; and (xvi) Full face photographic images and any comparable images.<br><br>
§164.514(e)(3) Implementation specification: Permitted purposes for uses and disclosures. (i) A covered entity may use or disclose a limited data set under paragraph (e)(1) of this section only for the purposes of research, public health, or health care operations.<br>
(ii) A covered entity may use protected health information to create a limited data set that meets the requirements of paragraph (e)(2) of this section, or disclose protected health information only to a business associate for such purpose, whether or not the limited data set is to be used by the covered entity.<br><br>