HIPAA Security, Privacy & Breach-Notification Rules

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.308(a) — Security Management Process
• HIPAA (45 CFR Part 164) 164.308(a)(1)(ii)(A) — Security Management Process - Risk Analysis
• HIPAA (45 CFR Part 164) 164.308(a)(1)(ii)(B) — Security Management Process - Risk Management
• HIPAA (45 CFR Part 164) 164.308(a)(1)(ii)(C) — Security Management Process - Sanction Policy
• HIPAA (45 CFR Part 164) 164.308(a)(1)(ii)(D) — Security Management Process -Information System Activity Review

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.512(a) — Uses and disclosures required by law
• HIPAA (45 CFR Part 164) 164.512(b) — Uses and disclosures for public health activities
• HIPAA (45 CFR Part 164) 164.512(c) — Disclosures about victims of abuse, neglect or domestic violence
• HIPAA (45 CFR Part 164) 164.512(d) — Uses and disclosures for health oversight activities
• HIPAA (45 CFR Part 164) 164.512(e) — Disclosures for judicial and administrative proceedings

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.524(a)(1) — Right of access
• HIPAA (45 CFR Part 164) 164.524(a)(2) — Unreviewable grounds for denial
• HIPAA (45 CFR Part 164) 164.524(a)(3) — Reviewable grounds for denial
• HIPAA (45 CFR Part 164) 164.524(a)(4) — Review of denial of access
• HIPAA (45 CFR Part 164) 164.524(b)(1) — Individual request for access

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.508(a)(1) — Authorization requirements - general rule
• HIPAA (45 CFR Part 164) 164.508(a)(2) — Authorization requirements - psychotherapy notes
• HIPAA (45 CFR Part 164) 164.508(a)(3) — Authorization requirements - marketing
• HIPAA (45 CFR Part 164) 164.508(b)(1) — Authorization - defective authorizations
• HIPAA (45 CFR Part 164) 164.508(b)(2) — Authorization - compound authorizations

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.310(a)(1) — Facility Access Controls
• HIPAA (45 CFR Part 164) 164.310(a)(2)(i) — Facility Access Controls - Contingency Operations
• HIPAA (45 CFR Part 164) 164.310(a)(2)(ii) — Facility Access Controls - Facility Security Plan
• HIPAA (45 CFR Part 164) 164.310(a)(2)(iv) — Facility Access Controls - Maintain Maintenance Records
• HIPAA (45 CFR Part 164) 164.310(a)(2)(iii) — Facility Access Controls - Access Control and Validation Procedures

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.312(a)(1) — Access Control
• HIPAA (45 CFR Part 164) 164.312(a)(2)(i) — Access Control - Unique User Identification
• HIPAA (45 CFR Part 164) 164.312(a)(2)(ii) — Access Control - Emergency Access Procedure
• HIPAA (45 CFR Part 164) 164.312(a)(2)(iv) — Access Control - Encryption and Decryption
• HIPAA (45 CFR Part 164) 164.312(a)(2)(iii) — Access Control - Automatic Logoff

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.514(b) — De-identification of protected health information
• HIPAA (45 CFR Part 164) 164.514(c) — Re-identification of protected health information
• HIPAA (45 CFR Part 164) 164.514(d)(1) — Minimum necessary requirements - standard
• HIPAA (45 CFR Part 164) 164.514(d)(2) — Minimum necessary requirements - implementation specifications
• HIPAA (45 CFR Part 164) 164.514(d)(3) — Minimum Necessary - Disclosures of PHI

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.530(a) — Personnel designations
• HIPAA (45 CFR Part 164) 164.530(b) — Training
• HIPAA (45 CFR Part 164) 164.530(c) — Safeguards
• HIPAA (45 CFR Part 164) 164.530(d)(1) — Complaints to the Covered Entity
• HIPAA (45 CFR Part 164) 164.530(d)(2) — Complaints to the Covered Entity

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.314(a)(1) — Business Associate Contracts or Other Arrangements
• HIPAA (45 CFR Part 164) 164.314(a)(2)(i)(A) — Business associate contracts
• HIPAA (45 CFR Part 164) 164.314(a)(2)(i)(B) — Business associate contracts.
• HIPAA (45 CFR Part 164) 164.314(a)(2)(i)(C) — Business associate contracts.
• HIPAA (45 CFR Part 164) 164.314(a)(2)(ii) — Other Arrangements

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.510(a)(1) — Use and disclosure for facility directories - general
• HIPAA (45 CFR Part 164) 164.510(a)(2) — Use and disclosure for facility directories - opportunity to object
• HIPAA (45 CFR Part 164) 164.510(a)(3) — Uses and Disclosures for Facility Directories in Emergency Circumstances
• HIPAA (45 CFR Part 164) 164.510(b)(1) — Permitted uses and disclosures
• HIPAA (45 CFR Part 164) 164.510(b)(2) — Uses and disclosures with the individual present

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.502(a)(5)(i) — Prohibited uses and disclosures - Use and disclosure of genetic information for underwriting purposes
• HIPAA (45 CFR Part 164) 164.502(f) — Deceased individuals
• HIPAA (45 CFR Part 164) 164.502(g) — Personal representatives
• HIPAA (45 CFR Part 164) 164.502(h) — Confidential communications
• HIPAA (45 CFR Part 164) 164.502(i) — Uses and disclosures consistent with notice

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.520(a)(1) — Notice of privacy practices for covered health care providers
• HIPAA (45 CFR Part 164) 164.520(b)(1) — Notice of privacy practices for health plans
• HIPAA (45 CFR Part 164) 164.520(c)(1) — Provisions of Notice - Health Plans
• HIPAA (45 CFR Part 164) 164.520(c)(2) — Provisions of Notice - Certain Covered Health Care Providers
• HIPAA (45 CFR Part 164) 164.520(c)(3) — Provision of Notice - Electronic Notice

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.316(a) — Policies and Procedures
• HIPAA (45 CFR Part 164) 164.316(b)(1) — Documentation
• HIPAA (45 CFR Part 164) 164.316(b)(2)(i) — Documentation - Time Limit
• HIPAA (45 CFR Part 164) 164.316(b)(2)(ii) — Documentation- Availability
• HIPAA (45 CFR Part 164) 164.316(b)(2)(iii) — Documentation - Updates

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.404(a) — Notice to Individuals
• HIPAA (45 CFR Part 164) 164.404(b) — Timeliness of Notification
• HIPAA (45 CFR Part 164) 164.404(c)(1) — Content of Notification
• HIPAA (45 CFR Part 164) 164.404(d) — Methods of Notification

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.506(a) — Permitted uses and disclosures
• HIPAA (45 CFR Part 164) 164.506(b) — Consent for uses and disclosures
• HIPAA (45 CFR Part 164) 164.506(b)(1) — Permitted uses and disclosures
• HIPAA (45 CFR Part 164) 164.506(b)(2) — Required provisions

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.522(a)(1) — Right of an Individual to Request Restriction of Uses and Disclosures
• HIPAA (45 CFR Part 164) 164.522(a)(2) — Terminating a Restriction
• HIPAA (45 CFR Part 164) 164.522(a)(3) — Documentation
• HIPAA (45 CFR Part 164) 164.522(b)(1) — Confidential Communications Requirements

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.526(a)(1) — Right to Amend
• HIPAA (45 CFR Part 164) 164.526(a)(2) — Denying the Amendment
• HIPAA (45 CFR Part 164) 164.526(c) — Accepting the Amendment
• HIPAA (45 CFR Part 164) 164.526(d) — Denying the Amendment

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.528(a) — Right to an Accounting of Disclosures of PHI
• HIPAA (45 CFR Part 164) 164.528(b) — Content of the Accounting
• HIPAA (45 CFR Part 164) 164.528(c) — Provision of the Accounting
• HIPAA (45 CFR Part 164) 164.528(d) — Documentation

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.504(e) — Business associate contracts
• HIPAA (45 CFR Part 164) 164.504(f) — Requirements for group health plans
• HIPAA (45 CFR Part 164) 164.504(g) — Requirements for a covered entity with multiple covered functions

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.402(a) — Definitions: Breach - Risk Assessment
• HIPAA (45 CFR Part 164) 164.402(b) — Definitions: Breach - exceptions (unsecured PHI)

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.414(a) — Administrative Requirements
• HIPAA (45 CFR Part 164) 164.414(b) — Burden of Proof

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.306(a) — General Requirements
• HIPAA (45 CFR Part 164) 164.306(b) — Flexibility of approach

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.406 — Notification to the Media

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.408 — Notification to the Secretary

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.410 — Notification by a Business Associate

HIPAA Security, Privacy & Breach-Notification Rules

• HIPAA (45 CFR Part 164) 164.412 — Law Enforcement Delay