Privacy Procedures

Representative role map (illustrative: replace with your roles):

2. Authorization intake and revocation (164.508)

1. When a requested use or disclosure is not permitted without authorization (e.g., marketing, sale of PHI, most psychotherapy-note disclosures, or any non-permitted purpose), the workforce member routes the request to the [Privacy Officer], who provides the authorization form.
2. The [Privacy Officer] confirms the signed authorization is valid and complete (description of the information; persons authorized to disclose and to receive; purpose; expiration date/event; signature and date; right-to-revoke statement; re-disclosure and conditioning statements) and that treatment/payment/eligibility is not improperly conditioned on it.
3. The disclosure is made only to the extent the authorization allows; a copy of the signed authorization is retained and the disclosure is logged for accounting where required (see §7).
4. A revocation (in writing) is recorded against the authorization and honored going forward, except where [Organization] already acted in reliance on it.

Authorization form (required fields): individual's name & identifier · specific PHI to be used/disclosed · who may disclose · who may receive · purpose of the use/disclosure · expiration date or event · signature of individual (or personal representative + description of authority) & date · statement of right to revoke and how · statement that re-disclosed information may lose protection · statement on conditioning.

3. Disclosure-decision guide (164.510, 164.512)

Before disclosing PHI without an authorization, the workforce member (with [Privacy Officer] support for anything non-routine) works through this guide:

1. Is it TPO? If the disclosure is for treatment, payment, or [Organization]'s operations, it is permitted; apply minimum necessary (except for treatment disclosures). Proceed.
2. Is the individual giving the chance to agree/object? For directory, family/caregiver involvement, or disaster relief, obtain agreement or offer the opportunity to object; if the individual is absent or incapacitated, use professional judgment and disclose only directly relevant PHI. (§164.510)
3. Is it a permitted public-interest purpose? Required by law; public health; abuse/neglect/DV; health oversight; judicial/administrative proceedings; law enforcement; coroner/ME/funeral director; organ donation; research (with approval); serious threat to safety; government functions; workers' compensation. Confirm the specific conditions for that category are met, verify the requester's identity and authority, and disclose the minimum necessary. (§164.512)
4. None of the above? Stop. Obtain a valid authorization (§2) before disclosing.
5. Record the disclosure for accounting unless it falls in an excluded category (see §7), and retain any supporting document (court order, subpoena assurances, agency request).

4. De-identification (164.514(b))

1. To de-identify by Safe Harbor, remove all 18 identifiers of the individual and of relatives, employers, and household members (names; geographic subdivisions smaller than a state per the Rule; all date elements finer than year for dates directly related to the individual, and ages over 89; phone/fax; email; SSN; MRN; health-plan numbers; account numbers; certificate/license numbers; vehicle and device identifiers; URLs; IP addresses; biometric identifiers; full-face photos; and any other unique identifying number, characteristic, or code), and confirm there is no actual knowledge the remainder could identify the individual.
2. To de-identify by Expert Determination, engage a qualified expert who documents the methods and the conclusion that re-identification risk is very small; retain the determination.
3. Any re-identification code must not be derived from PHI; its mechanism is documented, access- controlled, and used only by [Organization].
4. For a limited data set, execute a data use agreement with the recipient before disclosure.

5. Notice of Privacy Practices: distribution & acknowledgement (164.520)

1. The [Privacy Officer] maintains the current Notice of Privacy Practices (plain language; includes uses/disclosures, individual rights, [Organization]'s duties, complaint instructions, [Privacy Officer] contact, and effective date) in the [knowledge base] and on any public website.
2. The Notice is provided to each individual no later than the first service delivery (and on request thereafter); it is posted prominently where individuals are seen.
3. [Organization] makes a good-faith effort to obtain written acknowledgement of receipt; if acknowledgement is not obtained, the reason is documented.
4. When the Notice is materially revised, the new version is made available promptly and re-posted; the revision and effective date are recorded.
5. Signed acknowledgements (or documented good-faith efforts) and superseded Notice versions are retained.

6. Records-request SOP: access and amendment (164.524, 164.526)

1. Intake. Any individual request to inspect, copy, or amend PHI is logged in the [records-request log] with date received, requester, and the PHI involved. Verify identity and, for a personal representative, verify their authority before acting.
2. Access (§164.524). Locate the PHI in the designated record set and respond within 30 days (one 30-day extension allowed with written notice and reason). Provide the copy in the form/format requested if readily producible (including electronic copies and transmission to a designated third party on a signed, clear request); charge only a reasonable, cost-based fee. If access is denied, send a written, plain-language denial stating the basis and, if reviewable, the right to review by an independent licensed professional.
3. Amendment (§164.526). Respond within 60 days (one 30-day extension with written notice). If accepted, make the amendment, flag the record, and notify persons the individual identifies and those known to hold the erroneous PHI. If denied, send a written denial stating the basis and the right to submit a statement of disagreement; include that statement (or a summary) with future disclosures of the disputed PHI.
4. Retain the request, the response, and all supporting correspondence.

7. Records-request SOP: accounting of disclosures (164.528)

1. [Organization] records every accountable disclosure (i.e., not TPO, not to the individual, not under authorization, not directory/involvement-in-care, and not otherwise excluded) at the time it is made, capturing: date, recipient, description of PHI, and purpose (a standing reference may be used for recurring like-disclosures to the same recipient).
2. On an accounting request (verify identity/authority first), compile disclosures from the six years prior to the request, including those made by business associates, and respond within 60 days (one 30-day extension with written notice).
3. The first accounting in any 12-month period is free; a reasonable, cost-based fee may apply to additional requests after notice and an opportunity to withdraw or narrow the request.
4. Retain the accounting provided and the underlying disclosure records.

8. Restrictions & confidential communications (164.522)

1. Log each restriction request in the [records-request log]. [Organization] need not agree to most restrictions, but must agree to restrict disclosure to a health plan for payment/operations when the individual has paid in full out of pocket and the disclosure is not required by law.
2. Record agreed restrictions where the affected workforce and systems will see them, and honor them (except in an emergency, after which any emergency disclosure is handled appropriately).
3. For confidential communications, accommodate reasonable requests for alternative means or locations (e.g., a specified phone number or address) without requiring a reason; record the accommodation so it is applied consistently.

9. Complaint intake and handling (164.530(d))

1. Complaints (verbal or written) about privacy practices are routed to the [Privacy Officer] and entered in the complaint log with date, complainant (if provided), and a description.
2. The [Privacy Officer] investigates, determines disposition and any corrective action (and whether the matter is also a reportable incident under the Breach Notification Policy), and records the outcome.
3. No retaliation is permitted against anyone for filing a complaint, cooperating, or exercising a privacy right; the individual is informed they may also complain to the HHS Office for Civil Rights.
4. The complaint, investigation notes, and disposition are retained.

Complaint log (fields): date received · intake channel · complainant (optional) · summary · assigned to · investigation notes · disposition & corrective action · date closed.

Records produced (evidence)

Minimum-necessary role map & review sign-offs · signed authorizations and revocations · disclosure / accounting records · de-identification determinations and data use agreements · current and superseded Notices of Privacy Practices · signed NPP acknowledgements · access/amendment request files · agreed restrictions and confidential-communication accommodations · complaint log and investigation records. All privacy documentation is retained for 6 years. These are the artifacts an auditor will request to confirm the controls operate.

HIPAA controls addressed

Review & version

Reviewed at least annually by the [Privacy Officer]. v1.0.