45 CFR 164.530 — HIPAA Privacy Rule: Administrative Requirements

What this rule requires your agency to do

• 1A covered entity must have in place appropriate administrative, technical, and physical safeguards to protect the privacy of PHI, and must reasonably safeguard PHI from any impermissible use or disclosure and to limit incidental uses or disclosures (subd. c).(45 CFR 164.530 — HIPAA Privacy Rule: Administrative Requirements)
• 2A covered entity must implement and maintain written or electronic policies and procedures designed to comply with this subpart, change them as necessary to comply with changes in law, document required actions and designations, and retain the documentation for six years from the date of creation or the date when it was last in effect, whichever is later (subds. i, j).(45 CFR 164.530 — HIPAA Privacy Rule: Administrative Requirements)
• 3A covered entity must designate a privacy official responsible for developing and implementing its privacy policies and procedures, and a contact person or office responsible for receiving complaints and providing information about the notice of privacy practices, and must document these designations (subd. a).(45 CFR 164.530 — HIPAA Privacy Rule: Administrative Requirements)
• 4A covered entity must mitigate, to the extent practicable, any known harmful effect of a use or disclosure of PHI in violation of its policies or this subpart by it or its business associate; must not intimidate, threaten, coerce, discriminate against, or retaliate against individuals for exercising their rights or filing complaints; and may not require individuals to waive their rights as a condition of treatment, payment, enrollment, or eligibility (subds. f, g, h).(45 CFR 164.530 — HIPAA Privacy Rule: Administrative Requirements)
• 5A covered entity must have and apply appropriate sanctions against workforce members who fail to comply with its privacy policies and procedures or the requirements of this subpart, and must document the sanctions applied (subd. e).(45 CFR 164.530 — HIPAA Privacy Rule: Administrative Requirements)
• 6A covered entity must provide a process for individuals to make complaints concerning its privacy policies, procedures, or compliance, and must document all complaints received and their disposition (subd. d).(45 CFR 164.530 — HIPAA Privacy Rule: Administrative Requirements)
• 7A covered entity must train all workforce members on its PHI policies and procedures as necessary to carry out their functions — by the compliance date, each new member within a reasonable time after joining, and each affected member within a reasonable time after a material change — and must document that training was provided (subd. b).(45 CFR 164.530 — HIPAA Privacy Rule: Administrative Requirements)