(A)
The university is
committed to compliance with all requirements of the health insurance
portability and Accountability Act of 1996 and its implementing regulations
(hereinafter "HIPAA"), as they may be amended from time to time.
Because the university only uses and
engages in electronic transactions involving HIPAA protected health information
for a part of its operations, the university has designated itself as a hybrid
entity for purposes of HIPAA compliance. The university's health care
components, and components that perform activities that would make the
component a business associate of the university if it were legally separate,
are therefore subject to the specific requirements of HIPAA. The components
subject to the requirements of HIPAA shall be designated in the university's
HIPAA privacy policy as it may be amended from time to time. Other components
may be designated as part of the hybrid as may be required to comply with
changes in the law, or as necessary for the orderly operation of the university
as determined in writing by the vice president for legal affairs and general
counsel.
In the event an additional university
component is designated as part of the university's hybrid entity, the vice
president for legal affairs and general counsel shall report such designation
to the board for information at its next regular meeting.
(B)
Overall administration of the university's HIPAA compliance
program shall be the responsibility of the university HIPAA privacy official,
who shall be appointed by and shall report to the vice president for legal
affairs and general counsel. The responsibilities of the university privacy
official shall include:
(1)
Developing, implementing and maintaining the HIPAA
compliance program:
(2)
Coordinating the implementation of appropriate policies
and procedures:
(3)
Developing and overseeing the training of employees in
the healthcare components of the hybrid entity and other employees as
appropriate;
(4)
Serving as the contact person for any HIPAA related
complaints and administering appropriate complaint procedures and
processes;
(5)
Overseeing HIPAA breach notification:
(6)
Coordinating the
implementation and enforcement of sanctions against employees who violate HIPAA
policies:
(7)
Conducting HIPAA audits:
(8)
Overseeing
institutional HIPAA compliance, and:
(9)
Developing,
implementing and monitoring all other obligations of the university under
HIPAA.
(C)
Although only the healthcare components of the
university's hybrid entity are part of a covered entity for purposes of HIPAA
compliance, all employees of the university are required to protect and
safeguard the confidentiality of individually identifiable health information
relating to the physical or mental health or condition of an individual, the
provision of health care to an individual or the payment for health care for an
individual. This requirement is a statement of university policy and is not
intended to subject components of the university that are not part of the
university's hybrid designation to the specific requirements of HIPAA.
Replaces: 3361:10-5-20
Notes
Ohio Admin. Code
3361:10-5-20
Effective:
9/25/2015
Promulgated Under:
111.15
Statutory
Authority: 3361
Rule Amplifies: 3361
Prior Effective
Dates: 07/15/2011
