General Information

Identifiers

Privacy

Security

Transactions & Code Sets

Education

Services by Members

General Info

Identifiers

Privacy

Security

Transactions & Code Sets

Privacy - Compliance Topics

Consent | Authorization | Disclosures | Business Associate | Minimum Necessary | De-Identification | Research | State Law Preemption | Marketing & Fundraising | Public Health

• Status of Implementation of the Law
• Covered Entity

Consent

Back to top

• Presentation on Developing a HIPAA Compliant Consent Form and Related Documents, given by Debbie Mikels, Corporate Manager, Confidentiality, Partners Healthcare System, at the Privacy Officers Forum meeting, October 29, 2001
  -- "Developing a HIPAA Compliant Consent Form" slide presentation (PDF)
  -- Consent for Use and Disclosure of Protected Helath Information Form -- DRAFT (PDF)
  Note: Partners is still reviewing this Draft Consent and will probably release a revised version at the end of November 2001
• Duke University, Standard Consent Form Language for HIPAA Compliance (PDF)

Authorization

Back to top

Presentation on Authorizations and supporting documents, given by Lianne Ankner, Esq. & Stephen W. Bernstein, Esq. of McDermott, Will & Emery at the Privacy Officers' Forum meeting, October 29, 2001:

• "Authorizations" slide presentation (PDF)
• Research-Related Authorization Form (PDF)
• Authorization Requirements -- Checklist (PDF)

Disclosures

Back to top

• The Office of Civil Rights (OCR) - Fact Sheet on Incidental Disclosures
  www.hhs.gov/ocr/hipaa/guidelines/incidentalud.pdf (PDF)
• The Office of Civil Rights (OCR) - Fact Sheet, "Uses and Disclosures for Treatment / Payment / Health Care Operations"
  www.hhs.gov/ocr/hipaa/guidelines/sharingfortpo.pdf (PDF)

Business Associate

Back to top

Presentations on Business Associate Agreements by Covered Entities and Chain of Trust, given at the Privacy Officers' Forum meeting, January 11, 2002, at the Massachusetts Medical Society

• Stephen W. Bernstein, McDermott, Will & Emery - "Drafting the Business Associate Contract: Yeah, But What Should It Actually Say?" (PDF)
• McDermott, Will & Emery - "Business Associate Addendum - Contract Language" (PDF)
• David Szabo, Nutter, McClennen & Fish - "Business Associate Agreements and Covered Entities" (PDF)

Other Links:

• American Hospital Association, Model Business Associate Agreement (Available to AHA Members only)
• Hawaii Health Information Corporation, HIPAA Readiness Collaborative, Sample Chain of Trust Letter
• Massachusetts Division of Medical Assistance, Trading Partner Agreement (Revised 12/2002)

White Papers:

• Rotbert Law Group, LLC and the Information Technology Association of America, "HIPAA and Its Legal Implications for Health Care Information Technology Solution Providers", April 9, 2004 (PDF)

Remember - your vendors are not required by Federal regulation to be HIPAA compliant!

Minimum Necessary

Back to top

Articles

• "Privacy officials: Determine the mimimum necessary information" - Briefings on HIPAA, (December 2001). Also "Article of the Month: January" on hcPro's himinfo.com website.
• "The Minimum Necessary Standard: A Substantial Compliance Challenge", by Michael L. Blau, Esq. McDermott, Will & Emery (PDF)

Presentations

• McDonald, Keith, First Consulting Group, "The Impacts of Complying with HIPAA's Minimum Necessary Requirements". Presented at the Privacy Officers' Forum Meeting on March 8, 2002 (PDF)
• "Minimal Disclosures: Protecting Privacy without Compromising Care", presented by Michael L. Blau, Esq. McDermott, Will & Emery, Murray Klein, Esq., Reed Smith Shaw & McClay LLP, and Larry A. Short, Esq., Arent Fox Kintner Plotkin & Kahn, PLLC (PDF)

De-Identification

Back to top

Articles

• Comments on the Proposed Changes submitted by Massachusetts Health Data Consortium to the Office of the Secretary, Department of Health and Human Services, April 26, 2002

• Comments on the Proposed Changes made by the Association of American Medical Colleges (AAMC), with particular regard to de-identification and research, April 22, 2002

Research

Back to top

Background Reading
U.S. Department of Health and Human Services. Protecting Personal Health Information in Research: Understanding the HIPAA Privacy Rule. There are also five companion pieces to this booklet, available through the above link:

• Health Services Research and the HIPAA Privacy Rule
• Repositories, Databases, and the HIPAA Privacy Rule
• Clinical Research and the HIPAA Privacy Rule
• Institutional Review Boards and the HIPAA Privacy Rule
• Privacy Boards and the HIPAA Privacy Rule

Organizations

• Public Responsibility in Medicine and Research (PRIM&R)
  www.primr.org
  This non-profit organization is dedicated to creating, implementing, and advancing the highest ethical standards in the conduct of research.
• Applied Research Ethics National Association (ARENA)
  www.arena.org
  The Applied Research Ethics National Association, PRIM&R's membership division, is the professional home for those whose responsibilities include the protection of human and animal subjects.
• The Privacy Board
  www.theprivacyboard.com
  An independent board established to meet the requirements for research utilizing protected health information. Intended to serve the needs of research organizations not subject to review by an Institutional Review Board (IRB).

Sample forms

• Duke University, Standard Consent Form Language for HIPAA Compliance
  
• University of Oklahoma, HIPAA Privacy Policies and Procedures
  

State Law Preemption

Back to top

Organizations

• Boston Bar Association
  www.bostonbar.org/hipaa
  The Boston Bar Association has been working on identifying all state laws pertaining to the privacy of medical records. Their site includes a list of statutes analyzed, a list of decisions, minutes from HIPAA Task Force meetings, as well as a list of Task Force members and committee assignments. The BBA's "HIPAA Massachusetts Analysis" will be available during the Fall of 2002, orders accepted via the link above starting in Summer 2002.
• American Association of Health Plans
  www.aahp.org/template.cfm?section=Our_Issues
  The AAHP is conducting analysis of state law preemption for all 50 states. It appears, however, that one must be a member of AAHP to view the analysis. The Association also has a number of other privacy resources on its website, including comparisons of NAIC and NOIC Model Regulations as compared to the HHS Final Privacy Regulations.
• Health Insurance Association of America
  www.hiaa.org
  In conjunction with the law firm of Shaw Pittman, LLP and Blue Cross Blue Shield Association of America (BCBSA), the HIAA is offering a subscription service comparing the HIPAA privacy regulations with state privacy statutes and regulations for all fifty states. The service is available on CD-ROM and includes quarterly updates. E-mail to: hipaaready@hiaa.org for more information.

Other States
Please note that these are not necessarily free resources.

• Colorado SNIP HIPAA, Colorado Preemption Analysis http://www.cosnip.com/article.php?sid=74

• State Bar of Michigan Health Care Law Section http://www.mihealthlaw.com/hchipaa.html

Presentations

• Christine Solt, Choate, Hall & Stewart, Boston Bar Association/HIPAA, "Mental Health in Massachusetts and the Impact of HIPAA" , Presentation made at the Privacy Officers' Forum Meeting, March 8, 2002 -- Slides (PDF)

Marketing & Fundraising

Back to top

• Association of Fundraising Professionals
• University of Miami's Ethics Program:
  • Fundraising Fundamentals (HIPAA)
  • Fundraising (HIPAA)
  • Fundraising: Post-HIPAA (PDF)
  • "Fundraising Quiz"
• National Committee on Vital and Health Statistics (NCVHS)'s Recommendations on Marketing & Fundraising

Public Health

Back to top

• HHS, HIPAA Privacy Rule: Disclosures for Emergency Preparedness - A Decision Tool http://www.hhs.gov/ocr/hipaa/decisiontool/
• The Office of Civil Rights (OCR) - Fact Sheet on Public Health
  www.hhs.gov/ocr/hipaa/guidelines/publichealth.pdf (PDF)

Did you find what you were looking for? Would you like to contribute policies, procedures or other documents to be a shared resource? Please contact us at via e-mail.