Health Information Privacy Manual

The Health Information Privacy Manual sections are available for download as PDF files.

All sections are final unless indicated as DRAFT VERSION. Sections without links will be posted in the future.

Table of Contents

Chapter 1. UW-Madison HIPAA Health Care Component

• 1.1 Designation of UW-Madison Health Care Component
• 1.2 Designation of the University of Wisconsin Affiliated Covered Entity (UW ACE)

Chapter 2. Notice of Privacy Practices

• 2.1—Distribution of Notice of Privacy Practices

  Related forms

  • Acknowledgment for Receipt of Notice of Privacy Practices

Chapter 3. Uses and Disclosures of Protected Health Information for Purposes Other Than Human Subjects Research

• 3.1—Overview
• 3.2—Uses and Disclosures of Protected Health Information That Require Patient Authorization (Clinical, Non-Research)

  Related forms

  • Authorization for Disclosure of Medical Information
    
  • Additional Information regarding Disclosure of Patient Medical Information
    
  • Staff Instructions for Completing Authorization for Disclosure of Medical Information
• 3.3—Uses and Disclosures Not Requiring Authorization
• 3.4—Uses and Disclosures or Protected Health Information That Require Providing the Patient An Opportunity to Agree or to Object
• 3.5—Uses and Disclosures for Teaching
• 3.6—Uses and Disclosures for Marketing
• 3.7—Uses and Disclosures or Protected Health Information for Fundraising
• 3.8—Minimum Necessary Standard

  Related forms

  • Determination of Access to Protected Health Information
• 3.9—Verifying Identity and Authority of Outsiders Seeking Disclosure of A Patient’s Protected Health Information
• 3.10—Designated record set

Chapter 4. Uses and Disclosures of Protected Health Information for Human Subjects Research

Chapter 5. Other Uses and Disclosures of Protected Health Information

• 5.1—De-Identification of Protected Health Information Under the HIPAA Privacy Rule
• 5.2—Limited Data Set

Chapter 6. Business Associates

• 6.1—Managing Arrangements with Business Associates of UW-Madison

  Related forms

  • Business Associate Contract: PDF MS Word
• 6.2—Managing Incoming Business Associate Contracts
• 6.3—Use and Disclosure of PHI by UW-Madison Internal Business Associates

Chapter 7. Patient Rights

• 7.1—Requests by Patients for an Accounting of Certain DisclosuresDRAFT VERSION

  Related forms

  • Sample Request for Accounting of Disclosures
  • Sample Disclosure Tracking Log
  • Sample Reports of Disclosures to Third Parties
• 7.2—Requests by Patients to Amend Protected Health Information

  Related forms

  • Sample Request for Amendment of Health Information
  • Sample Letter Accepting Amendment
  • Sample Letter Denying Amendment
  • Sample Letter Responding to Statement of Disagreement
  • Sample Letter Notifying of Need for 30 Day Extension
  • Sample Request for Notification of Amendment
• 7.3—Requests by Patients for Alternative Confidential Communications

  Related forms

  • Alternative Confidential Communication Request Form
  • Sample Letter Accepting Individual’s Request for Alternative Confidential Communications
  • Sample Letter Denying Individual’s Request for Alternative Confidential Communications
• 7.4—Requests by Patients for Access to Inspect and Obtain a Copy of Protected Health Information
• 7.5—Requests by Patients for Restrictions On Uses and Disclosures of Protected Health Information

Chapter 8. Safeguards

• 8.1—Privacy Rule – Administrative Safeguards- Information Access Management
• 8.2—Privacy Rule – Administrative Safeguards – Contingency Plan for Electronic Data
• 8.3—Privacy Rule – Physical Safeguards For Protected Health Information
• 8.4— Rescinded
• 8.5—Security of Faxed, Printed, and Copied Documents

  Related forms

  • Fax transmission cover sheet
• 8.6—Provider-Patient Email
• 8.7—Disposal of Protected Health Information

  Related forms

  • Sample Certificate of Destruction

Chapter 9. Human Resources and Student Affairs

• 9.1—HIPAA Privacy Training Policy
• 9.2—HIPAA Employee Compliance Policy
• 9.3—Policy on Disciplinary Actions for Violations of HIPAA by Students Participating in a Clinical Health Professional Training Program at UW-Madison

Chapter 10. Administrative Policies and Procedures

• 10.1—Complaints Under the Privacy Rule of the Health Insurance Portability and Accountability Act

  Related forms

  • Patient Complaint – HIPAA Privacy
• 10.2—Designation of Privacy, Security, and Training Coordinators
• 10.3—Written Policies