Failure to comply with this policy can result in significant consequences to the individual as well as Indiana University, including violations of law, investigations, and criminal proceedings.All reported matters will be investigated, and, where appropriate, steps will be taken to remedy the situation.The IU HIPAA Affected Area must report any violation of this policy and/or unintentional destruction of PHI to the University HIPAA Privacy Officer.Name of IU approved vendor, if applicable.Destruction documents should be permanently retained by the Unit Privacy Officer, or the University Privacy Officer, as applicable and.Signatures of the individuals supervising and witnessing the destruction.Statement that the records were destroyed in the normal course of business and.Description of the destroyed documents.Records of destruction/disposal should include: Permanent retention is required because it may become necessary to demonstrate that the records were destroyed/disposed of in the regular course of business. To ensure the contract meets the requirements of the HIPAA Privacy and Security Rules, a Business Associate Agreement must be executed and the vendor may be required to go through a security risk assessment.ĭocumentation of Destruction/Disposal of PHIĭestruction of records maintained as part of the designated record set or as required by contractual agreement must be documented and the documentation maintained permanently by the IU HIPAA Affected Area ( see the sample Certificate of Destruction form attached to this policy). Outside vendors providing destruction and disposal services must be approved by IU’s Purchasing department.UITS or the IT support personnel for the IU HIPAA Affected Areashould be contacted to coordinate the destruction of any electronic media containing ePHI.
#Nunnelee pediatric medical records software#
Protected Health Information must not be discarded in trash cans, unsecured recycle bins or other areas accessible by the public. Paper documentation containing PHI must be shredded or placed in a secure bin.Destruction/disposal shall be suspended for records involved in any open investigation, including research misconduct, audit or litigation.The destruction/disposal of any records must be approved by the IU HIPAA Affected Area responsible for the creation and/or retention of the records.Records shall not be destroyed/disposed of before the minimum retention period has been met.
Each IU HIPAA Affected Area is responsible for arranging for the safe and secure destruction/disposal of records containingPHI and other critical or restricted information.Research records that contain PHI may be governed by additional policies or regulations and shall be retained for the period of time required by the research protocol, research sponsor or funding agency or requirements of any associated research grant.ĭestruction/disposal of recordsvcontaining PHI will be carried out in accordance with IU policies and procedures, HIPAA regulations and federal and state laws.(Scanned electronic images of the record become the original, official record immediately after creation and are retained in accordance with the applicable policy.) Records may be microfilmed or electronically scanned, with procedures in place to ensure the accurate and complete retrievable reproduction of the original document.
0 kommentar(er)
