HIPAA Compliance

United Community Wellness (UCW) is committed to protecting the privacy and security of Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. This policy outlines our commitment to maintaining the confidentiality, integrity, and availability of PHI in all forms, including electronic, paper, and oral.

Scope

This HIPAA policy applies to all employees, contractors, volunteers, and agents of United Community Wellness who have access to PHI in the course of their duties. It also extends to any business associates or third-party service providers who handle PHI on behalf of our organization.

Policy

1. Privacy and Confidentiality

• All PHI must be treated as confidential and accessed only on a need-to-know basis for providing healthcare services or carrying out authorized business activities.
• Employees must not disclose PHI to unauthorized individuals, within or outside the organization, unless permitted by law or authorized by the patient.
• Any sharing of PHI for treatment, payment, or healthcare operations must adhere to the minimum necessary standard.

2. Security Measures

• UCW implements appropriate administrative, physical, and technical safeguards to protect PHI from unauthorized access, disclosure, alteration, or destruction.
• Access to electronic PHI (ePHI) is restricted through user authentication, unique user IDs, and role-based access controls.
• All electronic devices containing PHI must be password protected and encrypted in accordance with HIPAA Security Rule requirements.

3. Training and Awareness

• All employees, contractors, volunteers, and agents receive HIPAA training upon hire and regularly thereafter.
• Training covers confidentiality, security best practices, handling of PHI disclosures, and reporting procedures for incidents or breaches.

4. Breach Notification

• In the event of a breach of unsecured PHI, UCW will promptly investigate, mitigate harmful effects, and notify affected individuals, the Secretary of Health and Human Services (HHS), and, if necessary, the media, in accordance with the HIPAA Breach Notification Rule.

5. Business Associate Agreements

• UCW enters into written agreements with all business associates and third-party providers that handle PHI, outlining their responsibilities for safeguarding PHI and complying with HIPAA.

Contact Information

For questions or concerns regarding this HIPAA policy or the handling of PHI, please contact:

Policy Review

This HIPAA policy will be reviewed and updated as necessary to ensure ongoing compliance with HIPAA regulations and changes in organizational operations or technology. Employees will be notified of any updates and provided with appropriate training as needed.

Last updated: 7/2024