Purpose

The purposes of this policy are to (1) designate Wichita State University as a hybrid entity, (2) designate certain units of the University as “Covered Components, “Other Clinics,” and “Supporting Units;” (3) define the University’s organizational and administrative responsibilities as they pertain to Health Information, as required under federal and state law; and (4) designate a University Privacy Officer and University Security Officer and identify their general administrative responsibilities.

Scope

This policy applies to all University Covered Components, Other Clinics, and Supporting Units and their respective Workforce members who are involved in the creation, receipt, transmission, storage, or disposition of Protected Health Information. A current list of Covered Components, Other Clinics, and Supporting Units may be obtained by contacting the Privacy Officer.

Policy

Wichita State University is committed to protecting individuals’ health information in compliance with all applicable laws and regulations. Accordingly, in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, 1996, as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, and the Privacy and Security Regulations at 45 CFR §§ 160 and 164 (hereinafter collectively, “HIPAA”), Wichita State University has adopted the following Health Insurance Portability and Accountability Act Policy which shall serve as a supplement to other university policies as well as federal and state laws.

HIPAA specifically excludes from its purview “treatment records” or student “education records” covered by the Family Educational Rights and Privacy Act (FERPA) as defined at 20 U.S.C. 1232g or in 34 CFR Part 99, as well as records of an employer in the capacity of employer, such as workers’ compensation records and records retained regarding requests for leave.

Capitalized terms in this policy have those meanings as set forth in Appendix A, “HIPAA Definitions.”

Hybrid Entity Designation

1. HIPAA applies to individuals and organizations meeting the definition of “Covered Entities.” Covered Entities include group health plans, health care providers who conduct certain transactions electronically — including but not limited to transmissions of health care claims — health care payments, enrollment in a health plan and referral authorizations and health care clearinghouses. Although the University does not primarily or solely engage in any of these activities, some units within the University perform functions that bring them within the definition of a Covered Entity.

2. WSU has designated itself a Hybrid Entity in accordance with HIPAA. As such, it must designate as part of its Covered Functions any component that would meet the definition of a covered entity if it were a separate legal entity (“Covered Component”). A current list of the University’s Covered Components, including Supporting Units, can be obtained by contacting the Privacy Officer.

Operational Guidelines

In addition to this policy, the University has issued operational guidelines (“HIPAA Operational Guidelines”) regarding the privacy and security of Individuals’ Health Information. These operational guidelines are merely the University’s minimum standards for HIPAA compliance. Covered Components, Other Clinics, and Supporting Units may find it necessary to adopt additional operational protocols and procedures for their specific unit. Any such unit-specific operational protocols and procedures must be approved by the Privacy Officer and the Security Officer prior to implementation. A copy of the HIPAA Operational Guidelines, as well as unit-specific protocols and procedures may be obtained by contacting the Privacy Officer.

Roles and Responsibilities

1. Privacy Officer

   1. The President of the University shall designate a Privacy Officer who shall be responsible for coordination of the University’s HIPAA compliance efforts. The duties and responsibilities of the Privacy Officer will include, but are not limited to:

      1. reviewing and overseeing all privacy, confidentiality and security standards and procedures created by the Covered Components, Other Clinics, and Supporting Units;

      2. providing HIPAA guidance and acting as a compliance resource to the Workforce;

      3. overseeing the development and implementation of Privacy and Security Awareness Training;

      4. establishing and administering a process for receiving, documenting, investigating and taking action on complaints, concerns, or reports of breach regarding Health Information;

      5. cooperating with the government, other legal entities, and University administrators, as necessary, in any compliance reviews or investigations;

      6. regularly monitoring changes to privacy laws and regulations to help ensure the University continues to conform to the applicable standards of confidentiality and privacy;

      7. assisting with the identification and development of Business Associate relationships and Business Associate Agreements; and

      8. working with the Security Officer on HIPAA Security Rule compliance efforts and incorporating relevant security content into the Privacy and Security Awareness Training.

   2. The Privacy Officer shall have authority to appoint an individual or individuals to assist with HIPAA Privacy Rule compliance obligations.

2. Security Officer

   1. The President of the University shall designate a Security Officer who shall be responsible for coordination of the University’s HIPAA Security Rule compliance. The duties and responsibilities of the Security Officer will include, but are not limited to:

      1. developing, implementing, maintaining, and ensuring adherence to the University’s security policies;

      2. overseeing HIPAA training and guidance to the Workforce members on security matters;

      3. receiving any complaints or inquiries about security matters and responding to such complaints or inquiries;

      4. documenting all security-related complaints or inquiries received and ensuring complaints are investigated;

      5. cooperating with the government, other legal entities, and University administrators in any compliance reviews or investigations;

      6. working with appropriate technical personnel to protect Electronic PHI from unauthorized Use or Disclosure, and to ensure the availability and integrity of Electronic PHI; and

      7. conducting periodic security audits and taking remedial action, as necessary.

3. Privacy Liaisons/Committee

   There is hereby established a University HIPAA Committee. This Committee shall be comprised of one (1) representative from each of the Covered Components and Other Clinics and one (1) representative who shall serve on behalf of the Supporting Units. The Committee is charged with providing broad strategic guidance and oversight to support the University’s overall HIPAA compliance effort(s).

Uses and Disclosures of Protected Health Information

1. Use and Disclose without authorization

   Covered Components may Use and Disclose PHI without the Individual’s Authorization in the following specific instances:

   1. For purposes of Treatment, Payment or Health Care Operations (“TPO”)

   2. Uses and Disclosures Required by Law

   3. Uses and Disclosures for Public Health Activities

   4. Disclosures About Victims of Abuse, Neglect or Domestic Violence

   5. Uses and Disclosures for Health Oversight Activities

   6. Disclosures for Judicial and Administrative Proceedings

   7. Disclosures for Law Enforcement Purposes

   8. Uses and Disclosures for Cadaveric Organ, Eye, Tissue Donation

   9. Uses and Disclosures for Research Purposes

   10. Uses and Disclosures to Avert a Serious Threat to Health or Safety

   11. Uses and Disclosures for Specialized Government Functions

   12. Disclosures for Workers' Compensation

   13. Disclosures to Friends and Family Members Involved in an Individual’s Care

   14. Disclosures Regarding the Location of the Individual in a Disaster

2. Disclosure without authorization

   Covered Components may also Disclose PHI without obtaining Authorization from the Individual in the following specific instances:

   1. To another Covered Entity for Treatment performed by the other Covered Entity;

   2. To another Covered Entity for the other Covered Entity’s Payment activities; and

   3. To another Covered Entity for the other Covered Entity’s Health Care Operations in certain limited circumstances.

3. Written Authorization Required

   Uses and Disclosures of PHI for purposes other than those set forth herein require a valid written Authorization from the Individual.

4. Minimum Necessary Requirements

   1. When required by the HIPAA Privacy Rule, each Covered Component shall make reasonable efforts to verify the need for and to limit the Use and/or the Disclosure of PHI to only that information necessary to accomplish the intended purpose of the Use or Disclosure.

   2. Covered Components will not Disclose an Individual’s entire record or file unless the Disclosure is not subject to the minimum necessary requirements or the Covered Component has documented justification for making the Disclosure.

5. Identity Verification Prior to Disclosure

   Covered Components will Disclose PHI only after verifying the identity and authority of the person or entity requesting the PHI, in accordance with this policy, HIPAA Operational Guidelines, and unit-specific protocols and procedures.

Individual Rights

The HIPAA Privacy Rule provides Individuals with certain rights related to their PHI, which include:

1. The Right to Receive a Notice of Privacy Practices. Individuals receiving services from a Covered Component that performs Covered Functions will be notified of how and when it may Use and/or Disclose their PHI; this is accomplished through the provision and posting of a Notice of Privacy Practices (“NPP”).

2. The Right to Place Restrictions on the Use and Disclosure of PHI. Individuals have the right to request restrictions on how a Covered Component Uses and/or Discloses their PHI for TPO purposes, for notification purposes, and to family members or friends involved in the Individual’s care or payment for the Individual’s care.

3. The Right to Request Access to PHI. Individuals generally have the right to access or receive copies of their PHI maintained by a Covered Component, subject to certain limitations set forth in the relevant University guideline(s).

4. The Right to an Accounting of Disclosures. Individuals have a right to an accounting of certain Disclosures of PHI that are made by a Covered Component. Each Covered Component will maintain a record of the Disclosures that are required to be documented and will provide an Individual with an accounting of such Disclosures.

5. The Right to Request an Amendment of Protected Health Information. Individuals generally have the right to request that the PHI maintained by a Covered Component be amended, such as in instances where the Individual believes that an error has been made or information in his or her record is not correct. However, the Covered Component is not obligated to agree to the request, provided that certain processes are followed and requirements met.

6. The Right to Request Alternative Methods of Confidential Communications of PHI. Individuals have the right to request that a Covered Component communicates with them about their PHI in a certain way or at a certain location (e.g., an Individual may request that all telephone communications be made to a certain number and all mail be sent to a specific address).

7. The Right to File a Complaint. Individuals who believe that a Covered Component has violated their privacy rights may file a complaint with the University or with the Secretary.

Business Associates

1. In some cases, a Covered Component may require a person or entity that is not a part of the University to perform or assist in the performance of certain functions, activities or services for or on behalf of the Covered Component that requires Use of, or access to, PHI by the external person or entity. Examples include, but are not limited to, medical transcription services, third party billing companies, medical software vendors, billing or collections services, consulting companies, accreditation organizations, and medical record copying services.

2. Prior to permitting creation, receipt, Use, maintenance, transmission of and/or access to the PHI, the Covered Component must ensure that the external person or entity has entered into a “Business Associate Agreement.” The Covered Component shall be responsible for maintenance of the appropriate documentation and verification of the business associate, vendor, contractor or subcontractor. All Business Associate Agreements must be established contractually in accordance with University contracting procedures and HIPAA Operational Guidelines and must be approved by the Office of General Counsel.

3. In some cases, a unit of the University may function as a Business Associate of an outside HIPAA Covered Entity or another Business Associate. Such Business Associate relationships must be established contractually in accordance with University contracting procedures and HIPAA Operational Guidelines and must be approved by the Office of General Counsel.

HIPAA Security Rule Compliance

1. Administrative, Technical and Physical Safeguards

   1. Each Covered Component, Other Clinic, and Supporting Unit must ensure that appropriate administrative, technical, and physical safeguards are implemented to protect the confidentiality, integrity and availability of the PHI in its care. Safeguards shall apply regardless of form or format of data, device or storage (e.g., verbal, paper, electronic, server, portable device, etc.) and shall be consistent with the HIPAA Operational Guidelines. Safeguards must be approved by the Privacy Officer and the Security Officer prior to implementation.

2. Risk Analysis and Risk Management Plan

   1. The HIPAA Security Rule requires the University to: (a) conduct thorough and timely risk assessments of the potential threats and vulnerabilities to the confidentiality, integrity and availability of its Electronic PHI (“Risk Analysis”); (b) develop and implement security measures to reduce risks and vulnerabilities to a reasonable and appropriate level, as well as efficiently and effectively mitigate the risks identified in the assessment process (“Risk Management Plan”); and (c) perform information system activity reviews.

   2. Each Covered Component shall coordinate with the Privacy Officer and the Security Officer to ensure the Risk Analysis and Risk Management Plan(s) are accomplished in accordance with the HIPAA Security Rule and HIPAA Operational Guidelines, including regular reviews and updates.

   3. All Workforce members must cooperate fully with all persons charged with performing the Risk Analysis and implementing and managing the Risk Management Plan.

Retention Of HIPAA-Related Documents

HIPAA requires that certain documents be retained for six (6) years from the date of creation or the date the document was last in effect. This includes, but is not limited to, the following documentation:

1. Business Associate Agreements

2. NPPs and Acknowledgement of NPPs

3. Authorization Forms

4. Requests for Restriction and related documentation

5. Requests for Access and related documentation

6. Requests for Amendment and related documentation

7. Request for Accounting of Disclosures and related documentation

8. Training materials and documentation of training completion

9. Privacy Complaints and related documentation

10. Versions of the HIPAA Policies and Procedures

11. Any action, activity or designation required by the Privacy Rule

12. Designation of the Privacy Officer and Security Officer

13. A list of all current and past Privacy Liaison Coordinators; and

14. Breach investigations and risk assessments

Training And Awareness

1. Covered Components, Other Clinics and Supporting Units are responsible for implementation of training and awareness programs (“Privacy and Security Awareness Training”) that meet the requirements set forth in the HIPAA Operational Guidelines. Such training and awareness programs must be approved by the Privacy Officer and the Security Officer.

2. All Workforce members with access to PHI, or potential access to PHI, must complete Privacy and Security Awareness Training within ninety (90) days of hire and annually thereafter.

3. Workforce members must sign the University’s HIPAA Confidentiality Agreement prior to accessing PHI. A copy of this signed Confidentiality Agreement must be maintained by the Covered Component, Other Clinic, or Supporting Unit.

Reporting And Handling Violations

1. All University employees, including but not limited to Workforce members, shall report any known or suspected Use or Disclosure of PHI made in violation of this policy and/or the HIPAA Operational Guidelines, or any known or suspected Security Incident, to the Privacy Officer and the Security Officer.

2. The Privacy Officer and Security Officer shall investigate and respond to such reports, including making any legally required notifications in accordance with the relevant legal requirements and University policies and HIPAA Operational Guidelines.

Questions and Complaints

Questions, concerns or complaints regarding the Use and Disclosure of PHI may be submitted to the applicable Privacy Liaison Coordinator, the Privacy Officer, the Security Officer, or to the Secretary. Complaints may also be anonymously submitted via the University’s Ethics Fraud and Abuse line either via phone (844-724-5631) or via online report form.

Contact information for the University’s Privacy Officer, Security Officer, and Covered Component Privacy Liaison Coordinators can be found here.

No Retaliation

Intimidation, retaliation and/or discrimination against any person for reporting any non-compliance with HIPAA, this policy, or the HIPAA Operational Guidelines, including but not limited to filing a complaint regarding a privacy practice, is strictly prohibited.

Sanctions

Violations of this policy, the HIPAA Operational Guidelines, unit-specific protocols and procedures, and/or federal and/or state law may result in disciplinary action and/or other corrective measures. Such investigations and determinations regarding corrective measures will be made in accordance with the University’s existing policies and procedures regarding such matters, as well as applicable federal and state law.

Implementation

This policy shall be included in the WSU Policies and Procedures Manual and shared with appropriate constituencies of the University.

The HIPAA Privacy Officer shall have primary responsibility for publication, dissemination and implementation of this policy.