3419.01 - PRIVACY PROTECTIONS OF SELF-FUNDED GROUP HEALTH PLANS

West Clermont Local School District

Administrative Guidelines

3419.01 - PRIVACY PROTECTIONS OF SELF-FUNDED GROUP HEALTH PLANS

The following administrative guidelines apply to the self-funded group health plans maintained by the Board:

A.	Training: The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule requires the group health plan to train all members of the plan’s workforce on the policies and procedures with respect to Protected Health Information. The Privacy Official shall ensure that the members of the plan’s workforce receive adequate and appropriate training regarding the Privacy Rule.

B.	Business Associate Agreements: The Privacy Rule requires a group health plan to enter into business associate agreements with its third party vendors. The Privacy Official shall retain counsel to draft and negotiate these business associate agreements. The Privacy Official will oversee the review of existing business associate agreements to verify compliance with current laws. The Privacy Official shall verify that business associate agreements are entered into with new vendors.

C.	Notice of Privacy Practices: The Privacy Rule requires the group health plan to distribute a Notice of Privacy Practices to participants in the plan. The Privacy Official shall retain counsel to draft the Notice of Privacy Practices. The Privacy Official shall subsequently distribute these notices to existing group health plan participants. If there is a material change to the Notice, then the Notice shall be distributed as follows:

	1.	If the group health plan posts its Notice on its website, then the plan may post the revised Notice on its website by the effective date of the material change, and then provide a hard copy of the Notice (or information about the material change and how to obtain the revised Notice) in its next annual mailing; or


	2.	If the group health plan does not have a website, then the plan may provide the revised Notice (or information about the material change and how to obtain the revised Notice) to individuals covered by the plan within sixty (60) days of the material revision to the Notice.

	The Privacy Official shall notify all participants in the Plan of the availability of the Notice and how to obtain the Notice no less frequently than once every three (3) years.

D.	Safeguards: The Privacy Rule requires the group health plan to implement appropriate administrative, technical, and physical safeguards to protect the privacy of Protected Health Information. The Privacy Official shall implement these safeguards in a reasonable and appropriate manner.

	The Security Official shall seek the services of a third party to perform an information technology risk analysis to identify and protect against reasonably anticipated threats to the security or integrity of electronic Protected Health Information, if applicable.

E.	Amendment of Plan Documents: The Privacy Rule provides that plan documents be made to permit information sharing between the plan and the plan sponsor. The Privacy Official shall assist other school personnel in determining whether and how plan documents should be amended.

F.	Participant Rights: The Privacy Rule grants health plan participants extensive rights with respect to their Protected Health Information. The Privacy Official shall timely respond to participant requests to exercise rights afforded by the Privacy Rule.


	G.	Participant Rights: The Privacy Official shall develop a breach notification procedure. A breach occurs when there has been an acquisition, access, use or disclosure of Protected Health Information in a manner not permitted under the Privacy Rule, which compromises the security or privacy of the Protected Health Information. The Privacy Official shall train workforce members on the breach notification procedures.

C.F.R. 160.502(e)(2), 164.308(a)(1), 164.308(b), 164.402, 164.414(a)
C.F.R. 164.520 et seq., 164.520(c)(1), 164.520(c)(1)(v),
C.F.R. 164.530(b), 164.530(c)