c. Comm Policy 39.00/HIPAA - Laserfiche WebLink

CASS COUNTY COMMISSION POLICY MANUAL 39.00 SUBJECT: HEALTH INSURANCE PORTABILITY & ACCESSIBILITY ACT (HIPAA) PAGE 8 OF 10 to another entity if it receives satisfactory assurances, provided in a written contract, that the business associate will appropriately safeguard the IIHI. If Cass County and business associate are both governmental entities, a memorandum of agreement will provide satisfactory assurances. The requirement for business associates does not apply to: *Disclosures made to a provider for treatment; *Disclosures made to a health-plan sponsor; and *Use or disclosures by a health plan that is a government program providing public benefits, if eligibility for, or enrollment in, the health plan is determined by an agency other than the agency administering the health plan, or if the protected IIHI used to determine enrollment or eligibility in the health plan is collected by an agency other than the agency administering the health plan, and such activity is authorized by law, with respect to the collection and sharing of IIHI for the performance of such functions by the health plan and the agency other than the agency administering the health plan. A contract or other written arrangement will provide satisfactory assurances to Cass County that the business associate will comply with HIPAA requirements necessary to protect the protected IIHI shared by Cass County. The contract or other written arrangement will establish permitted and required uses and disclosures and will also require the business associate to: *Appropriately safeguard the IIHI; *Report any misuse of IIHI; *Secure satisfactory assurances from any subcontractor; *Grant individuals access and ability to amend their IIHI; *Make available an accounting of disclosures; *Release applicable records to Cass County, if requested; and *Upon termination, return or destroy all IIHI.