6.5. ERMUSR 01-15-2008 - Laserfiche WebLink

Home Browse Search

(f) Make available to an individual for inspection and copying PHI about the individual as allowed by and in accordance with HIPAA; (g) Make PHI available for amendment and incorporate any amendments to PHI in accordance with HIPAA; (h) Make available the information required to provide an accounting of disclosures; (i) Make internal practices, books and records relating to the use and disclosure of PHI received from the Plan available to the HHS Secretary for the purposes of determining the Plan's compliance with HIPAA; and, (j) If feasible, return or destroy all PHI received for the Plan that the Employer still maintains in any form, and retain no copies of such PHI when no longer needed for the purpose for which disclosure was made (or if return or destruction is not feasible, limit further uses and disclosures to those purposes that make the return or destruction infeasible). 13.3 Employer's Obligations under the Security Rule. If the Employer creates, receives, maintains, or transmits ePHI (other than enrollment and disenrollment information and Summary Health Information, which are not subject to these restrictions), the Employer will: (a) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI; (b) Ensure that any agents, including subcontractors, who create, receive, maintain, or transmit ePHI on behalf of the Plan implement reasonable and appropriate security measures to protect the ePHI; (c) Report to the Plan any Security Incident of which it becomes aware; and (d) Implement reasonable and appropriate security measures to ensure that only those persons identified in Section 13.4 have access to ePHI and that such access is limited to the purposes identified in Section 13.5. 13.4 Adequate separation between the Plan and the Employer must be maintained. In accordance with HIPAA, only the following employees or classes of employees may be given access to PHI: (a) The benefit manager; and, (b) Staff designated by the benefits manager. For this purpose, "benefits manager" is a designation made by the Employer. 13.5 Limitation of PHI Access and Disclosure. The persons described in Section 13.4 above may only have access to and use and disclose PHI for Plan administration functions that the Employer performs for the Plan. 13.6 Noncompliance Issues. If a person described in Section 13.4 above does not comply with this Plan document, the Employer shall provide a mechanism for resolving issues of noncompliance including, but not limited to, disciplinary sanctions. ©2007 Hitesman & Associates, P.A. 34 Elk River Municipal Utilities 122707 Flexible Benefits Plan