" Written Policies

Covered entities must develop and implement written privacy policies that are consistent with the Privacy Rule (OCR, 2003). This policy must address several components. One is that there must be a privacy official. The privacy official is responsible for developing and implementing privacy policies. There must also be a contact person responsible for the receipt of complaints (Ibid.).

The written policy must also cover other key areas. These included workforce training, which should also include any employee under the direct control of the covered entity, even if they are under contract and not an employee of the entity. There must be data safeguards as well, so the written policy needs to include specific procedures for verification of identity, release of information and disposal of PHI.

There must also be a policy with respect to the handling of complaints. This procedure must be outlined in the notice that the patients receive. Under HIPAA, each of these different components must be included in the written policy, for the protection of both the covered entity and the consumer.

Training

Covered entities are responsible for training staff on the proper handling of protected health information. The term 'staff' includes all employees under direct control of the covered entity, regardless of their contract status. This includes employees of "business associates." Under most circumstances, covered entities are required to have a contract in place with business associates stipulating that the associates will adhere to HIPAA and other law surrounding the release of information with which the covered entity is entrusting them.

Thus, the covered entity is responsible for the development and implementation of a comprehensive ROI training program. The covered entity also bears all responsibility for recordkeeping. Records must be kept for six years after the last effective date, every record with respect to HIPAA, including the entity's own procedures, disposition of complaints and its privacy notices.

Each...

Failure to train staff will lead to violations of HIPAA which can subject the covered entity to punishment. Because the entity is subject to punishment, they must take responsibility for discipline of employees. If an employee does not follow the rules, the covered entity must have a discipline structure that includes sanctions against the employee. Specific sanctions are not outlined in the regulations but must be
Conclusion

HIPAA has overhauled the handling of medical records. It has given individuals access to his/her own health care records in a standardized, nationwide system. However, individual rights are limited. Covered entities can release information for a wide range of non-medical purposes, including marketing, law enforcement, and medical research. Consumers need to be aware of their rights regarding PHI, and covered entities need to be aware of their responsibilities. Covered entities are responsible for all training, handling, recordkeeping and employee discipline. Failure to adhere to the rules stated in HIPAA subjects a covered entity to sanction from the Office of Civil Rights, so it is imperative that the entity fully understand what is expected of it under HIPAA.

Works Cited:

Office for Civil Rights: Health Information Privacy. Retrieved April 2, 2009 from http://www.hhs.gov/ocr/privacy/index.html

No author. (2003). What is HIPAA? HIPAAps.com. Retrieved April 2, 2009 from http://www.hipaaps.com/main/background.html

Francis, Theo (2006). Spread of Records Stirs Fear of Privacy Erosion. Wall Street Journal. Retrieved April 2, 2009 from http://www.post-gazette.com/pg/06362/749444-114.stm

Office for Civil Rights: HIPAA Privacy Rule FAQ. Retrieved April 2, 2009 from http://www.hhs.gov/ocr/privacy/familyhealthhistoryfaqs.pdf

Office for Civil Rights: Summary of the HIPAA Privacy Rule. (2003) Retrieved April 2, 2009 from http://www.hhs.gov/ocr/privacy/hipaa/understanding/summary/privacysummary.pdf