Letters: Breach Notice Letters

Form: Request for Access to PHI

Who is covered by HIPAA?

Has HIPAA changed recently?

What is the HITECH Act?

What is HIPAA?

What is Protected Health Information (PHI)?

What is a HIPAA Breach?

What to Do in the Event of a Breach?

Form: Authorization for Marketing

Contract: Business Associate Agreement

Form: Authorization for Release of Records

Form: Multimedia Release

Form: Opt-Out of Fundraising

Form: Authorization for Marketing - Testimonials

Form: Notice of Privacy Practices (NPP)

Form: Plan Book

How is HIPAA enforced?

What are the penalties for failing to comply with HIPAA?

Can HIPAA breaches lead to criminal prosecution and/or incarceration?

What does a covered entity do if their computers become infected by malicious software?

What does a covered entity do if their PHI is being held by "Ransomware?"

What is a business associate?

What is a business associate agreement?

What are the responsibilities of a business associate (BA) under HIPAA?

Is an insurance company a business associate of a provider under HIPAA?

Is a laboratory a business associate of a provider under HIPAA?

Is a pharmacy a business associate of a provider under HIPAA?

Is a cloud computing provider a business associate?

Is an email service provider a business associate?

Is an internet service provider (ISP) a business associate?

Is an electronic health record software (EHR) vendor a business associate?

What office policies are required under HIPAA?

How does federal-level HIPAA interact with state-level medical information privacy laws?

Does a covered entity's workforce need to be trained in HIPAA?

What is a covered entity's workforce?

How soon and how often should training be conducted?

What does a covered entity's workforce training need to include?

How should workforce training be documented?

How long must HIPAA-related documents be kept?

Are dispensaries covered by HIPAA in states where medical marijuana is legal?

Is a funeral home or crematorium a covered entity under HIPAA?

Are Privacy and Security Officers required by HIPAA?

What is the Privacy Rule?

What is a Notice of Privacy Practices (NPP)?

What must be in an NPP?

When must a covered entity provide an NPP?

Must a patient sign an acknowledgement that they received an NPP?

Can a covered entity provide an NPP electronically through email or other electronic methods?

Must a new written acknowledgment of receipt be obtained if the NPP is changed?

Can an NPP be used to bypass the requirement to obtain patient Authorization before certain non-essential uses of their PHI?

How often must a covered entity provide an NPP to patients? Do they expire?

Must an NPP be provided to minors?

What is de-identified PHI?

What PHI does the patient have the right to see, copy, or send to a third party?

How long do I have to respond to a request by a patient to access their own PHI?

Are patients required to submit requests for their own PHI in writing?

Are patients required to submit a written request to send their own PHI to a third party?

Can patients request their own PHI in a specific format?

Can a fee be charged for providing access or copies of PHI?

Can records be withheld for non-payment for services?

Can patients be denied access to their own PHI for any reason?

Can I send PHI to an insurance company when a patient pays in cash and requests it?

What is a personal representative?

How does a covered entity verify the identity of a personal representative or parent of a minor child?

Must a covered entity give PHI to law enforcement?

Must I give PHI to the parent of a minor child?

If the parents of a minor child are divorced, to whom does a covered entity give the child's PHI?

If I suspect the abuse or neglect of a minor child (or incapacitated adult), does HIPAA prevent me from reporting it?

If I suspect that a patient will harm themselves or others, does HIPAA prevent me from reporting it?

Must I give PHI in response to a subpoena?

Must I give PHI in response to a request from a government agency?

What is an Authorization under HIPAA?

When is a patient Authorization required under HIPAA?

What is electronic PHI (ePHI)?

What is a risk analysis, assessment, and management under HIPAA?

Is encryption required?

Are electronic health records HIPAA compliant?

I'm cash-only. Does HIPAA apply to me?

Is YourHIPAATraining or CEDR Solutions a business associate?

How must devices containing ePHI be disposed of or reused?

What is a Security Officer?

Can mobile devices (smartphone, tablet, laptop) be used to access ePHI?

Can ePHI be sent via email?

Sample Policies and Procedures

Public Good Disclosures Reference Sheet