Inland Valley Cardiovascular Center
Brian A. Bui, M.D., Hoang M. Lai, M.D. & Harit V. Desai, M.D.
39755 Murrieta Hot Spring Rd., Suite E-130, Murrieta, CA 92563
Privacy Officer: Shelly Stephens, Office Manager
Effective Date: 4/8/2011
Purpose
The following privacy policy is adopted to ensure that this medical practice complies fully with all federal and state privacy protection laws and regulations. Protection of patient privacy is of paramount importance to this organization. Violations of any of these provisions will result in severe disciplinary action including termination of employment and possible referral for criminal prosecution.
It is policy of this medical practice that we will adopt, maintain and comply with our Notice of Privacy Practices, which shall be consistent with HIPAA and California Law.
Notice of Privacy Practices
It is the policy of this medical practice that a notice of privacy practices must be published, that this notice be provided to all subject individuals at the first patient encounter if possible, and that all uses and disclosures of protected health information be done in accord with this organization's notice of privacy practices. It is the policy of this medical practice to post the most current notice of privacy practices in our "waiting room" area, and to have copies available for distribution at our reception desk.
Assigning Privacy and Security Responsibilities
It is the policy of this medical practice that specific individuals within our workforce are assigned the responsibility of implementing and maintaining the HIPAA Privacy and Security Rule's requirements. Furthermore, it is the policy of this medical practice that these individuals will be provided sufficient resources and authority to fulfill their responsibilities. At a minimum it is the policy of this medical practice that there will be one individual or job description designated as the Privacy Official.
Deceased Individuals
It is the policy of this medical practice that privacy protections extend to information concerning deceased individuals.
Minimum Necessary Use and Disclosure of Protected Health Information
It is the policy of this medical practice that for all routine and recurring uses and disclosures of PHI (except for uses or disclosure made 1) for treatment purposes, 2) to or as authorized by the patient or 3) as required by law for HIPAA compliance) such uses and disclosures of protected health information must be limited to the minimum amount of information needed to accomplish the purpose of the uses or disclosure. It is also the policy of this medical practice that non-routine uses and disclosures will be handled pursuant to established criteria. It is also the policy of this organization that all requests for protected health information (except as specified above) must be limited to the minimum amount of information needed to accomplish the purpose of the request. It is also the policy of this organization that no employee or contractor may condition treatment, payment, enrollment or eligibility for benefits on the provision of an authorization to disclose protected health information except as expressly authorized under the regulations.
Responsibility
It is the policy of this medical practice that the Privacy Officer is responsible for designing and implementing procedures to carry out this policy.
Verification of Identity
It is the policy of this medical practice that the identity of all persons who request access to protected health information be verified before such access is granted.
Mitigation
It is the policy of this medical practice that the effects of any unauthorized use or disclosure of protected health information be mitigated to the extent possible.
Safeguards
It is policy of this medical practice that appropriate physical safeguards will be in place to reasonably safeguard protected health information from any intentional or unintentional use or disclosure that is in violation of the HIPAA Privacy Rule. These safeguards will include physical protection of premises and PHI, technical protection of PHI maintained electronically and administrative protection. These safeguards will extend to the oral communication of PHI. These safeguards will extend to the PHI that is removed from this organization.
Business Associates
It is the policy of this medical practice that business associates must be contractually bound to protect health information to the same degree as set forth in this policy. It is also the policy of this organization that business associates who violate their agreement will be dealt with first by an attempt to correct the problem, and if that fails by termination of the agreement and discontinuation of services by the business associate.
Training and Awareness
It is the policy of this medical practice that all members of our workforce have been trained by the compliance date on the policies and procedures governing protected health information and how this medical practice complies with the HIPAA Privacy and Security Rules. It is also the policy of this medical practice that new members of our workforce receive training on these matters within a reasonable time after they have joined the workforce. It is the policy of this medical practice to provide training should any policy or procedure related to the HIPAA Privacy and Security Rule materially change. This training will be provided within a reasonable time after the policy or procedure materially changes. Furthermore, it is the policy of this medical practice that training will be documented indicating participants, date and subject matter.