5.3. ERMUSR 02-09-2010 - Laserfiche WebLink

Home Browse Search

d. use or disclose PHI in connection with any other benefit or employee benefit plan of Deleted: Not the Employer unless authorized by an individual; e. to the any PHI use or disclosure, that is inconsistent with the uses or Deleted: Report disclosures provided for, of which it becomes aware; Deleted: Plan f. PHI available for amendment and incorporate any amendments to PHI in Deleted: Make available to an individual for accordance with HIPAA; inspection and copying PHI about the individual as allowed by and in accordance with HIPAA;¶ g. available the information required to provide an accounting of disclosures; Make Deleted: Make h. internal practices, books and records relating to the use and disclosure of PHI Deleted: Make received from the available to the HHS Secretary for the purposes of determining peleted: Plan the compliance with HIPAA; and ' Deleted: Plan s i. feasible, return or destroy all PHI received for the that the Employer still maintains Deleted: , in any form, and retain no copies of such PHI when no longer needed for the purpose for Deleted: If which disclosure was made (or if return or destruction is not feasible, limit further uses Deleted: Plan and disclosures to those purposes that make the return or destruction infeasible). 13.3 Employer's Obligations under Security If the Employer creates, receives, maintains, Deleted: the or transmits ePHI (other than enrollment and disenrollment information and Summary Health Deleted: Rule. Information, which are not subject to these restrictions), the Employer will: Deleted: (a) Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI; that any agents, including subcontractors, who create, receive, maintain, or Deleted: (b) Ensure transmit ePHI on behalf of the implement reasonable and appropriate security Deleted: Plan measures to protect the ePHI; to the any Security Incident of which it becomes aware; and Deleted: (c) Report Deleted: Plan reasonable and appropriate security measures to ensure that only those persons identified have access to ePHI and that such access is limited to the Deleted: (d) Implement purpOSeS Identified Deleted: in Section 13.4 Deleted: in Section 13.5. 13.4 Adequate separation between the and the Employer must be maintained. In Deleted: Plan accordance with HIPAA, only the following employees or classes of employees may be given access to PHI: Deleted: (a) The benefit manager; and,¶ Deleted: Staff (b) designated by the Deleted: beneftr manager. 13.5 Limitation of PHI Access and Disclosure. The described above may only have Deleted: For this purpose, "benefits manager" access to and use and disclose PHI for administration functions that the Employer performs is a designation made by me employer. ¶ fOr the Deleted: persons Deleted: in Section 13.4 13.6 Noncompliance Issues. If person described above does not comply with this Deleted: Plan document, the Employer shall provide a mechanism for resolving issues of noncompliance Deleted: Plan. including, but not limited to, disciplinary sanctions. Deleted: a Deleted: in Section 13.4 Deleted: Plan © 2009 Hitesman & Associates, P.A. 35 Elk River Municipal Utilities Flexible Benefitr Plan (No. 8.0.0.0)