Division of behavioral health



Download 75.5 Kb.
Date21.01.2021
Size75.5 Kb.

STATE OF ALASKA

DEPARTMENT OF HEALTH & SOCIAL SERVICES

SECTION:

HIPAA


Number:

HIPAA Security 5



Page:



DIVISION OF BEHAVIORAL HEALTH
POLICY & PROCEDURE MANUAL

SUBJECT:
Disposal and destruction of PHI on media




APPROVED:

DATE:

July 2003




Destruction/disposal of PHI Media




Purpose


The purpose of this policy and procedure is to assure that protected health information (PHI) is destroyed in accordance with HIPAA.

Policy


It is the policy of DBH to ensure the privacy and security of protected health information in the maintenance, retention, and eventual destruction/disposal of such media. Destruction/disposal of protected health information will be carried out in accordance with federal and state law, state policy and as defined in DBH’s retention policy. The schedule for destruction/disposal shall be suspended for records involved in any open investigation, audit, or litigation.
Definitions
Protected Health Information/ Media:


  • Any record of an individual’s health information, regardless of medium or characteristic that can be retrieved at any time.

    • This includes all original consumer records, documents, papers, letters, billing statements, x-rays, films, cards, photographs, sound and video recordings, microfilm, magnetic tape, electronic media, and other information recording media, regardless of physical form or characteristic, that are generated and/or received in connection with transacting consumer care or business.


Procedures


  • All destruction/disposal of protected health information media will be done in accordance with federal and state law, state policy and following DBH’s written retention policy/schedule. Records that have satisfied the period of retention will be destroyed/disposed of in an appropriate manner.




  • Records involved in any open investigation, audit or litigation should not be destroyed/disposed of. If notification is received that any of the above situations have occurred or there is the potential for such, the record retention schedule shall be suspended for these records until such time as the situation has been resolved. If the records have been requested in the course of a judicial or administrative hearing, a qualified protective order will be obtained to ensure that the records are returned to the organization or properly destroyed/disposed of by the requesting party.




  • Records or other documents containing PHI scheduled for destruction/disposal should be secured against unauthorized or inappropriate access until the destruction/disposal of consumer information is complete. This means that this material should be stored in secure containers (not in wastebaskets, boxes, recycle bins, etc.) until the time of destruction/disposal.




  • Contracts between DBH and its business associates will provide that, upon termination of the contract, the business associate will return or destroy/dispose of all consumer health information. The destruction of PHI by the Business Associate will be documented in writing and sent to the DBH.




      • Date of destruction/disposal.

      • Method of destruction/disposal.

      • Description of the destroyed/disposed record series or medium.

      • Inclusive dates covered.

      • A statement that the consumer information records were destroyed/disposed of in the normal course of business.

      • The signatures of the individuals supervising and witnessing the destruction/disposal.




  • If such return or destruction/disposal is not feasible, the contract will limit the use and disclosure of the information to the purposes that prevent its return or destruction/disposal.




  • A record of all case files containing protected health information that are destroyed or disposed will be made and retained permanently by DBH. Permanent retention is required because the records of destruction/disposal may become necessary to demonstrate that the consumer information records were destroyed/disposed of in the regular course of business. Records of destruction/disposal should include:




    • Date of destruction/disposal.

    • Method of destruction/disposal.

    • Description of the destroyed/disposed record series or medium.

    • Inclusive dates covered.

    • A statement that the consumer information records were destroyed/disposed of in the normal course of business.

    • The signatures of the individuals supervising and witnessing the destruction/disposal.




  • If destruction/disposal services are contracted or performed by another state agency, the contract or agreement will provide that DBH’s business associate will establish the permitted and required uses and disclosures of information by the business associate as set forth in the federal and state law and include the following elements:




    • Specify the method of destruction/disposal.

    • Specify the time that will elapse between acquisition and destruction/disposal of data/media.

    • Establish safeguards against breaches in confidentiality.

    • Indemnify DBH from loss due to unauthorized disclosure.

    • Require that a non-state government business associate maintain liability insurance in specified amounts at all times the contract is in effect.

    • Provide proof of destruction/disposal.

Consumer information media will be destroyed/disposed of using a method that ensures the consumer information cannot be recovered or reconstructed. DBH will follow the State of Alaska Information Systems Advisory Committee recommendations for disposal, when available.

Methods of destruction/disposal may be reassessed annually by the Security Officer, based on current technology, accepted practices, and availability of timely and cost-effective destruction/disposal services.


CERTIFICATE OF DESTRUCTION
The information described below was destroyed in the normal course of business pursuant to the organizational retention schedule and destruction policies and procedures.

Date of Destruction:


Authorized By:


Description of Information Disposed Of/Destroyed:








Inclusive Dates Covered:


METHOD OF DESTRUCTION:




  • Burning

  • Overwriting

  • Pulping

  • Pulverizing

  • Reformatting

  • Shredding

  • Other: _________________________________________________________________

Records Destroyed By*:


If On Site, Witnessed By:


Department Manager:




*If records destroyed by outside firm, must confirm a contract exists




Share with your friends:




The database is protected by copyright ©essaydocs.org 2020
send message

    Main page