Return to flip book view

HIPAACorporate Policies, Procedures & Training ManualFor Internal Use for Compliance Officer Message

1 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual My Healthy Globe, Inc. d.b.a. The Force for Health Network Health and Wellness Engagement, Publishing and Technology Company HIPAA Compliance Policy and Procedure Manual January 1, 2024 Table of Contents: 1. Introduction 1.1 Overview! 1.2 Purpose! 1.3 Scope! 1.4 Responsibility 2. HIPAA Privacy Rule 2.1 Definitions! 2.2 Protected Health Information (PHI)! 2.3 Permitted Uses and Disclosures !2.4 Individual Rights! 2.5 Minimum Necessary Standard! 2.6 Administrative Requirements 3. HIPAA Security Rule 3.1 Administrative Safeguards! 3.2 Physical Safeguards! 3.3 Technical Safeguards! 3.4 Organizational Requirements! 3.5 Policies and Procedures ! 3.6 Risk Analysis and Management 4. Information Security and Confidentiality 4.1 Data Encryption! 4.2 Access Controls! 4.3 Workstation Security! 4.4 Password Management! 4.5 Device Controls 5. Data Breach Response 5.1 Incident Reporting and Investigation! 5.2 Notification Process! 5.3 Mitigation and Corrective Action 6. Employee Training and Awareness 6.1 HIPAA Training Program !6.2 Security Awareness! 6.3 Continuing Education

2 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual 7. Business Associate Agreements 7.1 Vendor Assessment! 7.2 Contractual Requirements! 7.3 Monitoring Business Associates 8. Documentation and Recordkeeping 8.1 Policy and Procedure Documentation ! 8.2 Retention of Records! 8.3 Documentation of Disclosures ! 8.4 Access Logs 9. Security Incident Response Plan 9.1 Incident Identification! 9.2 Containment ! 9.3 Eradication ! 9.4 Recovery! 9.5 Lessons Learned 10.HIPAA Compliance Officer Responsibilities 10.1 Designation and Responsibilities! 10.2 Reporting Structure! 10.3 Monitoring and Enforcement! 10.4 Annual Compliance Audit 11.Auditing and Monitoring 11.1 Regular Audits! 11.2 Internal Monitoring! 11.3 External Audits 12.Documentation Forms 12.1 Privacy Notice Acknowledgment Form! 12.2 Security Awareness Training Acknowledgment Form! 12.3 Business Associate Agreement Template! 12.4 Incident Report Form! 12.5 Access Log Template! 12.6 Employee Training Record! 12.7 Security Risk Assessment Template Appendices: • Appendix A: Definitions • Appendix B: HIPAA Compliance Officer Contact Information • Appendix C: References •

3 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual This comprehensive policy and procedure manual is designed to ensure the ongoing compliance of our health and wellness engagement company with the Health Insurance Portability and Accountability Act (HIPAA). It is the responsibility of all employees to familiarize themselves with this manual and adhere to its guidelines. Any changes or updates to this manual will be communicated promptly, and all employees are required to undergo regular training to stay informed about HIPAA regulations and our company's policies and procedures. 1. Introduction 1.1 Overview: The Health and Wellness Engagement Company recognizes the significance of safeguarding protected health information (PHI) in compliance with the Health Insurance Portability and Accountability Act (HIPAA). This policy manual serves as a comprehensive guide outlining our commitment to maintaining the privacy and security of individuals' health information. 1.2 Purpose: The purpose of this manual is to establish a framework that ensures compliance with HIPAA regulations, promoting the confidentiality, integrity, and availability of PHI. It delineates the responsibilities of our workforce in handling health-related data, outlining procedures to prevent unauthorized access, disclosure, alteration, and destruction. 1.3 Scope: This manual applies to all employees, contractors, and third-party entities associated with the Health and Wellness Engagement Company. It encompasses all systems, processes, and activities involving the creation, storage, transmission, and disposal of PHI. The scope extends to electronic, paper, and verbal forms of communication and includes all facets of our health and wellness engagement services. 1.4 Responsibility: Every member of our workforce is responsible for understanding and adhering to the policies outlined in this manual. The HIPAA Compliance Officer, appointed to oversee compliance efforts, holds the responsibility of monitoring, enforcing, and updating this manual as necessary. The Compliance Officer also acts as the point of contact for any concerns, reports, or audits related to HIPAA compliance. 2. HIPAA Privacy Rule 2.1 Definitions: In the context of the HIPAA Privacy Rule, certain key terms are crucial for understanding the regulation's application. PHI includes identifiable

4 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual health information, and covered entities are organizations subject to HIPAA regulations. The Privacy Rule extends protections to individually identifiable health information and establishes the rights of individuals concerning their health data. 2.2 Protected Health Information (PHI): PHI encompasses a broad array of health-related data, including demographic information, medical history, test results, and other information that can be linked to an individual. Understanding what constitutes PHI is essential for our workforce to appropriately safeguard and manage health information throughout its lifecycle. 2.3 Permitted Uses and Disclosures: The Privacy Rule outlines instances where covered entities are permitted to use or disclose PHI without obtaining the individual's authorization. This section clarifies the circumstances under which sharing health information is allowed for treatment, payment, healthcare operations, and other specific situations, ensuring compliance with HIPAA standards. 2.4 Individual Rights: One of the cornerstones of the Privacy Rule is the protection of individuals' rights regarding their health information. Covered entities must facilitate individuals' rights to access their PHI, request corrections, and have control over how their information is used and disclosed. This section details the procedures and mechanisms for individuals to exercise these rights. 2.5 Minimum Necessary Standard: The Minimum Necessary Standard emphasizes the principle of limiting the use and disclosure of PHI to the minimum necessary for a particular purpose. This helps reduce the risk of unauthorized access and ensures that only the essential information is shared or accessed to fulfill specific roles or responsibilities within the organization. 2.6 Administrative Requirements: The Privacy Rule imposes various administrative requirements on covered entities to protect PHI. This includes appointing a Privacy Officer, providing workforce training, conducting regular risk assessments, and implementing policies and procedures to safeguard health information. Adherence to these administrative requirements is crucial for maintaining HIPAA compliance. This section of the manual establishes a foundation for understanding the fundamental concepts and principles of the HIPAA Privacy Rule, enabling our

5 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual workforce to navigate the complexities of handling protected health information responsibly. 3. HIPAA Security Rule 3.1 Administrative Safeguards: The HIPAA Security Rule's Administrative Safeguards focus on the managerial, organizational, and policy aspects of ensuring the confidentiality, integrity, and availability of electronic protected health information (ePHI). This includes measures such as risk analysis, workforce training, and the appointment of a Security Official to oversee the development and implementation of security policies. 3.2 Physical Safeguards: Physical Safeguards address the physical access to facilities and devices containing ePHI. This section outlines measures such as facility access controls, workstation use policies, and the secure disposal of electronic media to prevent unauthorized physical access and protect the physical infrastructure where ePHI is stored or processed. 3.3 Technical Safeguards: Technical Safeguards focus on the technology and security measures implemented to protect ePHI. This includes access controls, encryption, and audit controls to ensure that electronic health information is secured against unauthorized access or alterations. The implementation of technical safeguards is critical to maintaining the integrity and security of ePHI. 3.4 Organizational Requirements: Organizational requirements address the relationships and agreements between covered entities and their business associates. This section details the need for establishing and maintaining business associate agreements to ensure that third-party entities handling ePHI adhere to the same level of security and privacy protections required by the covered entity. 3.5 Policies and Procedures: Establishing and implementing comprehensive policies and procedures is a key component of the Security Rule. This section outlines the development and maintenance of documented security policies that govern the use, access, and transmission of ePHI. Adherence to these policies is essential for creating a secure environment for electronic health information. 3.5.a There is function in the software referred to as “View As”. This feature allows the administrator the technical ability to temporarily view what is seen on the screen as if the administrator is logged in as a specific user. This feature will not be enabled for use by anyone at the company

6 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual except for the senior administrator. Any employee that sees this ability shall not use it and should notify HIPAA Officer so that their permissions are altered. For the senior administrator of the company, it may be used by them under one very specific scenario only. 3.5.a.1 The first is view a “demo user” account to test functionality for the role of that demo user. The demo user is not an actual person but an alias named account for this purpose only. 3.5.a.2 “View As’ is never used to see a live user account. 3.6 Risk Analysis and Management: Regular risk analysis is a fundamental aspect of the Security Rule. This involves identifying potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. The subsequent risk management process entails implementing measures to mitigate identified risks and ensuring ongoing monitoring and assessment to adapt to changing security landscapes. This section of the manual delves into the specific requirements and measures outlined in the HIPAA Security Rule. By understanding and implementing these safeguards, our organization can effectively protect electronic health information and maintain compliance with HIPAA standards. 4. Information Security and Confidentiality 4.1 Data Encryption: Data encryption is a critical measure to protect the confidentiality and integrity of electronic protected health information (ePHI). Encryption involves converting data into a secure format that can only be deciphered with the appropriate decryption key. This section outlines the use of encryption for data at rest, in transit, and during storage to prevent unauthorized access and safeguard ePHI from potential breaches. 4.2 Access Controls: Access controls are mechanisms that restrict access to ePHI based on user roles and responsibilities. This section details the implementation of role-based access controls to ensure that only authorized individuals have access to specific types of health information. This includes user authentication, authorization processes, and regular reviews of user access privileges to prevent unauthorized disclosures.

7 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual 4.3 Workstation Security: Workstation security measures are essential for protecting ePHI stored on computers and other devices. This section outlines policies and procedures for securing workstations, including the use of password protection, automatic logoff, and physical safeguards. By implementing these measures, we mitigate the risk of unauthorized access to ePHI through workstations, ensuring the security of health information. 4.4 Password Management: Password management is a crucial component of information security. This section establishes policies and procedures for creating strong passwords, regular password updates, and secure storage of passwords. By promoting effective password management practices, we enhance the overall security posture of our systems and reduce the risk of unauthorized access to ePHI. 4.5 Device Controls: Device controls address the security measures applied to hardware and electronic devices that store, process, or transmit ePHI. This section outlines policies for inventory management, device disposal, and the implementation of security features on mobile devices. By controlling the use and access to devices, we minimize the risk of data breaches and ensure the confidentiality and integrity of ePHI. 5. Data Breach Response 5.1 Incident Reporting and Investigation: Prompt identification and reporting of security incidents are crucial for mitigating the impact of potential data breaches. This section outlines procedures for reporting security incidents, including the establishment of an incident response team. By fostering a culture of reporting and investigation, we can address security incidents swiftly and minimize the potential harm to ePHI. 5.2 Notification Process: In the event of a data breach, timely notification is essential to comply with legal requirements and inform affected individuals. This section details the process for assessing the severity of a breach, determining the appropriate parties to notify, and preparing notification letters. Clear communication during a data breach is vital to maintaining transparency and trust with individuals affected by the breach. 5.3 Mitigation and Corrective Action: After a data breach, mitigating the impact and implementing corrective actions are critical steps to prevent future incidents. This section outlines the development and implementation of a corrective action plan, including measures to address vulnerabilities, enhance

8 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual security controls, and prevent similar breaches in the future. By learning from incidents, we strengthen our overall security posture and protect ePHI more effectively. 6. Employee Training and Awareness 6.1 HIPAA Training Program: A comprehensive HIPAA training program is essential for ensuring that all members of our workforce understand their roles and responsibilities in maintaining the privacy and security of ePHI. This section outlines the development and implementation of a training program covering HIPAA regulations, our company's policies, and the specific security measures in place to protect health information. 6.2 Security Awareness: Security awareness initiatives aim to foster a culture of security consciousness among employees. This section details ongoing efforts to raise awareness about security risks, best practices, and the importance of individual contributions to maintaining a secure environment. By promoting a security-aware culture, we enhance our overall defense against potential threats to ePHI. 6.3 Continuing Education: HIPAA regulations and the healthcare landscape are subject to change. This section emphasizes the importance of continuing education for our workforce to stay informed about updates to HIPAA requirements, emerging security threats, and best practices in information security. Ongoing education ensures that our workforce remains vigilant and adaptable to evolving challenges in safeguarding ePHI. These sections focus on the specific measures and procedures related to information security, data breach response, and employee training. By implementing these guidelines, our organization can establish a robust framework for protecting electronic protected health information and maintaining compliance with HIPAA regulations. 7. Business Associate Agreements 7.1 Vendor Assessment: Before entering into agreements with third-party entities, a thorough assessment of their security practices is essential. This section outlines the process of conducting vendor assessments to evaluate the security controls and HIPAA compliance of business associates. By selecting and maintaining relationships with secure partners, we enhance the overall protection of ePHI.

9 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual 7.2 Contractual Requirements: Business Associate Agreements (BAAs) are formal contracts that establish the responsibilities of third-party entities in safeguarding ePHI. This section outlines the necessary elements of BAAs, including security obligations, breach reporting requirements, and the termination process. Strict adherence to contractual requirements ensures that business associates are held accountable for maintaining the privacy and security of health information. 7.3 Monitoring Business Associates: Ongoing monitoring of business associates is crucial to ensure continued compliance with HIPAA regulations. This section details the procedures for monitoring and auditing the activities of business associates, including periodic assessments and reviews of security practices. By actively overseeing the actions of our business associates, we mitigate potential risks and maintain a high standard of security for ePHI. 8. Documentation and Recordkeeping 8.1 Policy and Procedure Documentation: Clear and comprehensive documentation of policies and procedures is essential for demonstrating compliance with HIPAA regulations. This section emphasizes the importance of maintaining up-to-date documentation for all aspects of our HIPAA compliance program. Documented policies and procedures serve as a reference for the workforce, auditors, and regulatory authorities, showcasing our commitment to safeguarding ePHI. 8.2 Retention of Records: Retention of records is a key element of compliance with HIPAA regulations. This section outlines the retention periods for various types of documentation, including policies, training records, and incident reports. By adhering to established retention schedules, we ensure that documentation is available for audits, investigations, and ongoing assessments of our HIPAA compliance program. 8.3 Documentation of Disclosures: Accurate documentation of disclosures is necessary to track instances where ePHI is shared with external entities. This section details the process of documenting disclosures, including the information to be recorded, the individuals involved, and the purpose of the disclosure. Maintaining a comprehensive record of disclosures helps demonstrate transparency and compliance with HIPAA privacy requirements.

10 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual 8.4 Access Logs: Access logs play a crucial role in monitoring and auditing access to ePHI. This section outlines the creation and maintenance of access logs, detailing the information to be recorded, including user activities, timestamps, and the nature of access. Access logs serve as a valuable tool for identifying potential security incidents, conducting audits, and ensuring accountability in the use of health information. 9. Security Incident Response Plan 9.1 Incident Identification: Prompt identification of security incidents is a critical component of the incident response plan. This section outlines the procedures for recognizing and reporting potential security incidents, emphasizing the importance of a quick and accurate response to mitigate the impact on ePHI. 9.2 Containment: Once a security incident is identified, containment measures are implemented to prevent further unauthorized access or disclosure of ePHI. This section details the steps involved in containing a security incident, including isolating affected systems and limiting the scope of the breach to minimize potential harm. 9.3 Eradication: Eradication involves eliminating the root cause of a security incident to prevent recurrence. This section outlines the procedures for identifying and addressing vulnerabilities, removing malware, and implementing corrective actions to eradicate the source of the incident. Eradication efforts aim to strengthen overall security and prevent similar incidents in the future. 9.4 Recovery: After containing and eradicating a security incident, the recovery phase focuses on restoring affected systems and processes. This section details the steps involved in the recovery process, including data restoration, system testing, and resuming normal operations. Effective recovery measures ensure minimal disruption to our services and the restoration of the confidentiality and integrity of ePHI. 9.5 Lessons Learned: The incident response plan includes a crucial component for learning from security incidents. This section outlines the procedures for conducting post-incident reviews, analyzing the effectiveness of the response, and identifying areas for improvement. By incorporating lessons learned into our security practices, we continually enhance our incident response capabilities and overall security posture.

11 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual These sections provide detailed insights into business associate relationships, documentation practices, and the incident response plan. By following these guidelines, our organization can establish effective processes for managing third-party collaborations, maintaining comprehensive documentation, and responding swiftly to security incidents. 10. HIPAA Compliance Officer Responsibilities 10.1 Designation and Responsibilities: The role of the HIPAA Compliance Officer is pivotal in overseeing and ensuring the organization's adherence to HIPAA regulations. This section outlines the criteria for designating a Compliance Officer and delineates their core responsibilities. These responsibilities include the development and implementation of policies, ongoing monitoring of compliance efforts, and serving as the primary point of contact for HIPAA-related matters. 10.2 Reporting Structure: Establishing a clear reporting structure for the HIPAA Compliance Officer is essential for effective communication and collaboration within the organization. This section details the reporting relationships, ensuring that the Compliance Officer has direct access to executive leadership and can communicate findings, recommendations, and compliance updates efficiently. 10.3 Monitoring and Enforcement: Continuous monitoring of HIPAA compliance is imperative to identify and address potential issues promptly. This section outlines the procedures for ongoing monitoring, including regular assessments, audits, and the analysis of security incidents. Additionally, it emphasizes the enforcement mechanisms in place to address non-compliance, such as corrective actions, disciplinary measures, and reporting to regulatory authorities when necessary. 10.4 Annual Compliance Audit: Conducting an annual compliance audit is a proactive measure to assess the effectiveness of the organization's HIPAA compliance program. This section details the components of the annual audit, including a review of policies and procedures, employee training records, security controls, and incident response capabilities. The results of the audit inform updates and improvements to the organization's overall HIPAA compliance strategy. 11. Auditing and Monitoring

12 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual 11.1 Regular Audits: Regular audits are essential for ensuring ongoing compliance with HIPAA regulations. This section outlines the schedule and methodology for conducting regular internal audits, including assessments of security controls, policies, and procedures. The goal is to identify areas of improvement, address vulnerabilities, and maintain a proactive approach to HIPAA compliance. 11.2 Internal Monitoring: Internal monitoring involves continuous oversight of day-to-day activities related to PHI handling. This section details the processes for internal monitoring, which may include reviewing access logs, tracking user activities, and assessing compliance with established policies. Internal monitoring is a foundational element of maintaining a secure environment for health information. 11.3 External Audits: External audits, conducted by third-party entities or regulatory bodies, are part of the checks and balances to ensure comprehensive HIPAA compliance. This section outlines the procedures for preparing and cooperating with external audits, including the provision of requested documentation, facilitating on-site visits, and addressing audit findings promptly. Effective collaboration during external audits demonstrates a commitment to transparency and accountability. 12. Documentation Forms 12.1 Privacy Notice Acknowledgment Form: This form is used to document that individuals have received and acknowledged the organization's privacy notice. It includes fields for the individual's name, signature, and the date of acknowledgment. By obtaining these acknowledgments, the organization ensures that individuals are informed about their rights and the organization's privacy practices. 12.2 Security Awareness Training Acknowledgment Form: Acknowledging completion of security awareness training is vital for ensuring that employees understand their role in safeguarding ePHI. This form includes fields for the employee's name, signature, and the date of training completion. It serves as documentation that employees have been educated on security practices and are aware of their responsibilities. 12.3 Business Associate Agreement Template: This template outlines the necessary components of a Business Associate Agreement (BAA) when

13 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual engaging with third-party entities. It includes sections on security obligations, breach reporting requirements, and termination clauses. Customizing this template for each business associate ensures that agreements align with HIPAA requirements and protect the confidentiality and security of ePHI. 12.4 Incident Report Form: The Incident Report Form is used to document any security incidents involving ePHI. It includes fields for describing the incident, identifying affected individuals, and outlining the corrective actions taken. Timely completion of this form facilitates a swift and organized response to security incidents, helping to minimize the impact on ePHI. 12.5 Access Log Template: The Access Log Template is used to record and monitor access to ePHI. It includes fields for user details, timestamp, accessed information, and the purpose of access. Maintaining accurate access logs is crucial for internal monitoring, audits, and investigations to ensure that access to ePHI is authorized and appropriate. 12.6 Employee Training Record: The Employee Training Record documents the training history of each employee regarding HIPAA regulations and security practices. It includes fields for the employee's name, training dates, and topics covered. This record serves as evidence of ongoing compliance training and facilitates the tracking of employees' awareness and understanding of HIPAA requirements. 12.7 Security Risk Assessment Template: The Security Risk Assessment Template is used to conduct and document regular risk assessments as required by the HIPAA Security Rule. It includes sections for identifying potential risks, assessing their likelihood and impact, and outlining risk management strategies. This template ensures a systematic approach to identifying and mitigating risks to the confidentiality, integrity, and availability of ePHI. These sections provide detailed insights into the responsibilities of the HIPAA Compliance Officer, auditing and monitoring processes, and essential documentation forms. Implementing these guidelines and utilizing the provided forms will contribute to a robust HIPAA compliance program within our health and wellness engagement company.

14 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual 12.1 Privacy Notice Acknowledgment Form Privacy Notice Acknowledgment Form I, [Individual's Name], hereby acknowledge that I have received and read the Privacy Notice provided by The Force for Health Network I understand my rights and the company's practices regarding the use and disclosure of my protected health information (PHI). Signature: ___________________________ Date: _____________________ 12.2 Security Awareness Training Acknowledgment Form Security Awareness Training Acknowledgment Form I, [Employee's Name], certify that I have completed the security awareness training provided by The Force for Health Network I understand the importance of safeguarding electronic protected health information (ePHI) and acknowledge my responsibilities in maintaining information security. Signature: ___________________________ Date: _____________________ 12.3 Business Associate Agreement Template Business Associate Agreement This Business Associate Agreement ("Agreement") is entered into on [Date] between [Health and Wellness Engagement Company] ("Covered Entity") and [Business Associate]. [Include sections for security obligations, breach reporting requirements, and termination clauses as needed.]

15 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual 12.4 Incident Report Form Incident Report Form Date of Incident: ______________ Time of Incident: ______________ Description of Incident: Nature of the incident: Individuals involved: Any corrective actions taken: Any witness or supportive documents or screenshots: Signed, Employee Date

16 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual 12.5 Access Log Template Access Log Template Date and Time User ID Accessed Information Purpose of Access [Date & Time Entry] [User ID] [Accessed Information] [Purpose of Access] [Date & Time Entry] [User ID] [Accessed Information] [Purpose of Access] [Date & Time Entry] [User ID] [Accessed Information] [Purpose of Access] [Include additional rows for each access log entry.] 12.6 Employee Training Record Employee Training Record Employee Name Training Date Training Topic [Employee 1] [Date] [Training Topic 1] [Employee 2] [Date] [Training Topic 2] [Employee 3] [Date] [Training Topic 3] [Include additional rows for each training record.] 12.7 Security Risk Assessment Template Security Risk Assessment Template Risk ID Risk Description Likelihood Impact Risk Level Risk Management Strategies 1 [Description of Risk 1] [Likelihood] [Impact] [Risk Level] [Risk Management Strategies] 2 [Description of Risk 2] [Likelihood] [Impact] [Risk Level] [Risk Management Strategies] 3 [Description of Risk 3] [Likelihood] [Impact] [Risk Level] [Risk Management Strategies] [Include additional rows for each identified risk, its description, likelihood, impact, risk level, and strategies for risk management.]

17 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual Appendix A: Definitions Protected Health Information (PHI):!Protected Health Information refers to any individually identifiable health information held or transmitted by a covered entity or its business associate, in any form or medium, whether electronic, paper, or oral. PHI includes demographic information that can be used to identify an individual and relates to the individual's past, present, or future physical or mental health condition, healthcare provision, or payment for healthcare services. Health Insurance Portability and Accountability Act (HIPAA):!HIPAA is a federal law enacted in 1996 that establishes national standards to protect individuals' medical records and other personal health information. The law includes provisions to ensure the confidentiality and security of health information, as well as to provide individuals with certain rights regarding their health data. The Privacy Rule and the Security Rule are two significant components of HIPAA that outline specific requirements for safeguarding health information. Business Associate:!A Business Associate is an individual or entity that performs functions or activities on behalf of, or provides services to, a covered entity that involve the use or disclosure of protected health information (PHI). Business Associates may include contractors, consultants, and other external entities that handle PHI, and they are required to enter into a Business Associate Agreement (BAA) with the covered entity to ensure compliance with HIPAA regulations.

18 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual Appendix B: HIPAA Compliance Officer Contact Information HIPAA Compliance Officer: Robert Gillio MD Contact Information: • Email: drrobgillio@theforceforhealth.com • Phone: 717-940-5922 • Address: 517 Cricklewood Drive State College PA 16803 • Responsibilities: The HIPAA Compliance Officer is responsible for overseeing and coordinating all aspects of the organization's HIPAA compliance efforts. This includes the development and implementation of policies and procedures, ongoing monitoring of compliance activities, and serving as the main point of contact for any inquiries, reports, or audits related to HIPAA compliance. Reporting Structure: The HIPAA Compliance Officer reports directly to [Executive Leadership/Designated Authority]. This reporting structure ensures that the Compliance Officer has direct access to decision-makers within the organization, facilitating effective communication and collaboration on HIPAA-related matters.

19 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual Appendix C: References References and Regulatory Guidance: 1. HIPAA Privacy Rule: The official text of the HIPAA Privacy Rule can be found on the website of the U.S. Department of Health & Human Services (HHS) - HIPAA Privacy Rule. 2. HIPAA Security Rule: The official text of the HIPAA Security Rule can be found on the website of the U.S. Department of Health & Human Services (HHS) - HIPAA Security Rule. 3. HHS Office for Civil Rights (OCR): The OCR is the federal agency responsible for enforcing HIPAA rules. Their website provides valuable resources, guidance, and updates related to HIPAA compliance - HHS OCR. 4. National Institute of Standards and Technology (NIST) - Cybersecurity Framework: NIST's Cybersecurity Framework provides a valuable resource for enhancing and managing the security of information systems - NIST Cybersecurity Framework. Term Crossword Definition Comprehensive Definition HIPAA Health data protection law The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted to safeguard the privacy and security of individuals' health information, establishing standards for its use and disclosure. FERPA Student privacy law The Family Educational Rights and Privacy Act (FERPA) is a federal law protecting the privacy of students' educational records, regulating the access

20 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual and disclosure of these records by educational institutions. PHI Protected health information Protected Health Information (PHI) refers to any information related to an individual's health condition, treatment, or payment for healthcare services, the disclosure of which is regulated by HIPAA. De-identified Data Stripped of identifying details De-identified data is health information from which specific identifiers have been removed, making it no longer personally identifiable, and is exempt from certain HIPAA privacy regulations. Minimum Necessary Accessing only essential information The Minimum Necessary Standard is a principle in HIPAA requiring entities to limit the use, disclosure, and request of PHI to the minimum necessary to achieve the intended purpose, based on job roles and responsibilities. BAA Contract for third-party HIPAA compliance A Business Associate Agreement (BAA) is a contract between a

21 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual covered entity and a business associate outlining responsibilities and ensuring HIPAA compliance when the business associate handles PHI on behalf of the covered entity. EHR Digital patient charts Electronic Health Records (EHRs) are digital versions of patients' paper charts, containing information about their medical history, diagnoses, medications, treatment plans, immunization dates, allergies, radiology images, and laboratory test results. Breach Unauthorized PHI disclosure or access A breach, in the context of HIPAA, is an impermissible use or disclosure of PHI that compromises its security, leading to the potential compromise of patient privacy. Phishing Cyber-attack through deceptive emails Phishing is a cyber-attack where individuals are tricked into revealing sensitive information, such as login credentials or financial details, by posing as a trustworthy entity through deceptive

22 Private & Confidential – The Force for Health® Network HIPAA Compliance Manual emails or messages. Opt-Out Option Patient choice to decline marketing communications The Opt-Out Option allows patients to decline participation in marketing communications, ensuring they have control over the use of their information for promotional purposes under HIPAA.