Medical Records and the Law

HIPAA Security Rule 473sor becomes aware. 129 These mandates ensure that group health plandocuments will require the sponsor to protect the ePHI it creates or receiveson behalf of the plan, except for ePHI disclosed to a plan sponsorthat is summary health information or enrollment/disenrollment informationdiscussed in the privacy regulations.Policies, Procedures, and DocumentationThe Security Rule requires that covered entities develop and implementpolicies and procedures designed to enable them to meet thestandards of the rule. 130 These policies must be in written (includingelectronic) form, and must be maintained for six years from the later ofthe date they were created and the date they were last in effect. 131 Thecovered entity’s documentation should also include a record of actionsit has taken in compliance with the Security Rule. 132 Thus, security riskassessments, interventions in response to security incidents, implementationof security safeguards, and other actions specified in the ruleshould all be in the covered entity’s record of security compliance. If acovered entity amends its policies and procedures for any reason, theentity must also document those revisions. Finally, a covered entitymust periodically review its policies and procedures and make any revisionsrequired by environmental or operational changes. 133 The frequencywith which a covered entity conducts its reviews will dependupon the entity’s size, configuration, business environment, operationalchanges, and the particular security measures already implemented. 134Security Requirements in Health Data NetworksIn any health data network, the HDN or the participating covered entitieswill be required to implement for the HDN operations all the securitymeasures that meet the standards set forth in the SecurityRule—including assessing controls and tracking methodologies andensuring that the EHRs it maintains or uses will be free from improper12945 C.F.R. § 164.314(b).13045 C.F.R. § 164.316(a).13145 C.F.R. § 164.316(b)(2)(1).13245 C.F.R. § 164.316(b)(1)(ii).13345 C.F.R. § 164.316(B)(2)(iii).13468 Fed. Reg. 8361 (Feb. 20, 2003).