HIPAA Policy, Procedure & Guidance

Policy

The University of Arizona Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security and Breach Notification Policy

Security Standards and Procedures

• HPP-SEC-100 HIPAA_InfoSec Commitment and Principles
• HPP-SEC-101 HIPAA Standards Creation and Review Procedure
• HPP-SEC-102 HIPAA Privacy and Security Responsibilities
• HPP-SEC-201 HIPAA Risk Assessment and Management Standard
• HPP-SEC-301 HIPAA Business Continuity_Disaster Recovery
• HPP-SEC-302 Incident Response
• HPP-SEC-401 HIPAA Access Control
• HPP-SEC-402 HIPAA Account Management
• HPP-SEC-403 Segregation of Duties
• HPP-SEC-404 Password Standard
• HPP-SEC-405 External Audit Coordination
• HPP-SEC-501 Vulnerability and Patch Management
• HPP-SEC-600 Data Classification
• HPP-SEC-602 Removable Media
• HPP-SEC-603 Data Disposition and Destruction
• HPP-SEC-604 Box Health
• HPP-SEC-605 Electronic Signatures
• HPP-SEC-606 Authorization to Operate
• HPP-SEC-701 Systems and Communication Protection
• HPP-SEC-702 Wireless Network Security
• HPP-SEC-703 Remote Access
• HPP-SEC-704 HIPAA Encryption
• HPP-SEC-705 Approved Communications Tools
• HPP-SEC-801 Intrusion Detection and Prevention
• HPP-SEC-802 Information System Activity Review
• HPP-SEC-902 Configuration Management
• HPP-SEC-903 Malware Protection
• HPP-SEC-904 Data Backup
• HPP-SEC-905 Personally Owned Devices
• HPP-SEC-906 Asset Management
• HPP-SEC-1001 HIPAA Secure Facility Access Standards
• HPP-SEC-1002 HIPAA Clean Workspace Standards
• HPP-SEC-1003 HIPAA Clinical Name Tag Standard
• HPP-SEC-1101 Business Associate Agreements
• HPP-SEC-1102 Third Party Risk Management
• HPP-SEC-1201 HIPAA Workforce Training Standard

Privacy Standards and Procedures

• HPP-PRV-001 Disclosure and Use of PHI
• HPP-PRV-002 Minimum Necessary Standard
• HPP-PRV-003 Notice of Privacy Practices
• HPP-PRV-004 Identification Standard
• HPP-PRV-005 Patient's Right to Access
• HPP-PRV-006 Accounting of Disclosures
• HPP-PRV-007 Right to Object to Release
• HPP-PRV-008 HIPAA Amendments
• HPP-PRV-009 Patient's Right to Request Restrictions
• HPP-PRV-010 Complaint and Investigation
• HPP-PRV-011 Breach Notification
• HPP-PRV-012 Investigations and Sanctions
• HPP-PRV-013 Records Retention
• HPP-PRV-014 Health Care Component Designation
• HPP-PRV-015 Requirements of Designated Health Care Components
• HPP-PRV-016 Breach of Protected Health Information
• HPP-PRV-022 Authorization
• HPP-PRV-028 Use of PHI in Education
• HPP-PRV-030 De-identification of PHI and Limited Data Sets

Guidance and Resources

• HIPAA Privacy Program Guidance: Definitions of Key Words
• PHI, Limited Data Set and De-Identified Data Reference Guide
• HIPAA Privacy Program Guidance: De-Identification of PHI
• HIPAA Privacy Program Guidance: Human Subjects Research and HIPAA
• HIPAA Privacy Program Guidance: Methods for Securely Emailing PHI or IIHI