If the marketing claims to be medically expedient then personal health records may be released.
3. Are there requirements for covered entities to have written privacy policies? If so, what has to be addressed in the policy?
Yes, covered entities do need written privacy policies. Those policies address the specific circumstances the covered entity might release his or her personal health information. For example, a person might authorize a personal representative to access personal health information and make medical decisions in emergencies: when the individual is incapacitated, unconscious, or otherwise unable to make conscious decisions. The written privacy policy must also include limitations to access: for example, limitations to access of information given to employers, marketing researchers, or other non-medical organizations.
4. How will employees in the medical office have to be trained regarding privacy (for example, who is responsible for training and record keeping)? What is required if an employee doesn't follow the privacy policy? When must employees be trained? In what manner?
Medical office personnel should be given copies of all HIPAA-related materials as well as clear memos outlining their role and responsibility in protecting patient privacy. A brief training seminar or...
An employee must be warned about the legal consequences of not following the privacy policy as well as personal consequences. Employees must be trained in proper procedures for safeguarding medical data as well as procedures for release of minimal and only relevant information.
References
United States Department of Health and Human Services. "Case Examples Organized by Covered Entity." Retrieved Nov 14, 2008 at http://www.hhs.gov/ocr/privacy/enforcement/casebyentity.html
United States Department of Health and Human Services. "Patient Guide." Retrieved Nov 14, 2008 at http://www.hhs.gov/ocr/hipaa/consumer_ffg.pdf
United States Department of Health and Human Services. "Privacy and Your Health Information." Retrieved Nov 14, 2008 at http://www.hhs.gov/ocr/hipaa/consumer_summary.pdf
United States Department of Health and Human Services. "Your Health Information Privacy Rights." Retrieved Nov 14, 2008 at http://www.hhs.gov/ocr/hipaa/consumer_rights.pdf
United States Department of Health and Human Services. "When Providers May Communicate About You With Your Family, Friends, and Others Involved in Your Care." Retrieved Nov 1, 2008 at http://www.hhs.gov/ocr/hipaa/consumer_ffg.pdf
