November 2012 - Northeast Pharmacy Service Corporation

HIPAA SECURITY: A FOUR-PART SERIES
By Karen Hekeler
In the September issue of the Network News, we brought you through the first three
steps of the HIPAA Security rule. Hopefully, you have set aside some time to complete
those three steps. We will now continue with Step 4.
Part II of IV
HIPAA SECURITY
Step 4:
Step 5:
Step 6:
Step 7:
In Tab 4 of the HIPAA Security binder, you will find a document titled
“Risk Management Chart for Protecting Patient Information in Electric
Form Administration Safeguards.” Please go through the chart and enter
the date you completed each action item.
The Security Regulations require you to have a BUSINESS ASSOCIATE
AGREEMENT (BAA) on file with any entity you share PHI with that is
not in itself a covered entity. Examples of who needs to have BAA on
file include: IVR companies, Pharmacy and/or DME software companies,
DME billing companies and any facility you deliver to where you
are not delivering directly to the patient. Tab 4 has a copy of the BAA.
Please go through your files and ensure you have a signed BAA on file
for any of the business partners you are sharing PHI with.
Under Tab 5, we have provided you with Security Policy and Procedures
for all Employees. Please take a few minutes to familiarize your
self with this policy and have your staff do the same. We have also
provided you with a sample employment application.
In Tab 6, you will find Personnel Policies Employee Sanctions. The Se
curity Rule requires that all covered entities have appropriate sanc
tions in place for employees who fail to comply. Please review this
policy with your staff.
Part III of this series will be included in the January issue of the Network News. If at
any time during this process you have questions, please feel free to contact the
NPSC office or your pharmacy consultant.
6
NETWORK NEWS - NOVEMBER 2012