HIPAA

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

In May 2002, the Board of Regents designated the Surgical Center for the Treatment of Morbid Obesity and determined that Surgical Center for the Treatment of Morbid Obesity would be a Single Health Care Component for the purposes of complying with the HIPAA Rule. All of the entities at Surgical Center for the Treatment of Morbid Obesity covered by the HIPAA Privacy and Security Rules — medical centers, medical clinics, health care providers, health plans, student health centers — are a single entity for purposes of compliance with HIPAA. However, the research function is excluded from HIPAA coverage at Surgical Center for the Treatment of Morbid Obesity. Accordingly, research health information that is not associated with a health care service is not subject to the HIPAA Privacy and Security Rules. Other state and federal laws govern privacy and confidentiality of personal health information obtained in research.

HIPAA Privacy Compliance. The HIPAA Privacy Rule, effective April 14, 2003, established national standards to guard the privacy of a patient’s protected health information. Protected health information includes:

* Information created or received by a health care provider or health plan that includes health information or health care payment information plus information that personally identifies the individual patient or plan member. * Personal identifiers include: a patient’s name and email, web site and home addresses; identifying numbers (including Social Security, medical records, insurance numbers, biomedical devices, vehicle identifiers and license numbers); full facial photos and other biometric identifiers; and dates (such as birth date, dates of admission and discharge, death).

HIPAA Security Compliance. The HIPAA Security Rule, effective April 20, 2005, requires that workforce members adhere to controls and safeguards to: (1) ensure the confidentiality, integrity and availability of confidential information; and (2) detect and prevent reasonably anticipated errors and threats due to malicious or criminal actions, system failure, natural disasters and employee or user error. Such events could result in damage to or loss of personal information, corruption or loss of data integrity, interruption of University activities, or compromise to the privacy of the University patients or employees and its records.

Scope – Who is subject to HIPAA at Surgical Center for the Treatment of Morbid Obesity? HIPAA regulations apply to employees, health care providers, trainees and volunteers at Surgical Center for the Treatment of Morbid Obesity medical centers and affiliated health care sites or programs and employees who work with Surgical Center for the Treatment of Morbid Obesity health plans. HIPAA regulations also apply to anyone who provides financial, legal, business, or administrative support to Surgical Center for the Treatment of Morbid Obesity health care providers or health plans.

For More Information. If you have questions regarding the University’s HIPAA compliance practices, please contact the Surgical Center for the Treatment of Morbid Obesity HIPAA staff office at Surgical Center for the Treatment of Morbid Obesity or via e-mail: Surgical Center for the Treatment of Morbid Obesity.

Surgical Center for the Treatment of Morbid Obesity Complaint Process. You may file a complaint if you believe that the University is not complying with applicable HIPAA requirements. All complaints must be in writing. Please identify the entity or individual that is the subject of the compliant and describe the activities believed to be in violation of the HIPAA rule. The complaint must be filed within 180 days of the activity. Mail complaints to Surgical Center for the Treatment of Morbid Obesity’s HIPAA Official. Information for filing an anonymous complaint consistent with the Surgical Center for the Treatment of Morbid Obesity Whistleblower Policy is available at Surgical Center for the Treatment of Morbid Obesity