Title
Human Resources Department recommending the Board:
1) Approve and adopt revisions and a title change to Board of Supervisors Policy L-1: Protected Health Information (HIPAA): General to Privacy and Projected Information Policy; and
2) Grant the Director of Human Resources the authority to make changes to the Policy that are either non-substantive or necessary to accord with changes to relevant statutes or regulations.
FUNDING: N/A
Body
DISCUSSION / BACKGROUND
The Health Insurance Portability and Accountability Act (“HIPAA”) was enacted in 1996 to create a national standard to protect and enhance the rights of individuals by providing access to their health information and to control and limit the use and disclosure of protected health information (“PHI”). As a covered entity, El Dorado County is required to maintain written documentation of individual rights with respect to PHI. Updates to the policy are required to ensure compliance with current HIPAA requirements.
El Dorado County is designated as a covered hybrid entity, defined by HIPAA as an organization that uses or discloses protected health information for only a part of its business operations and is required to comply with 45 CFR § 160-164. Privacy regulations, under 45 CFR §164.105, require hybrid entities to implement formal written policies and procedures to ensure compliance with the Rule.
Our current HIPAA policy is being replaced to reflect the ongoing regulatory changes that have occurred since the adoption of Policy L-1 back in 2017. The current policy provides a minimal, umbrella framework that the County operates within. Additionally, the policy is being renamed to Privacy and Protected Information Policy to encompass the HIPAA Act and other related privacy statutes.
A major overhaul to this policy began in 2018 but was delayed during the COVID-19 pandemic. A project group, including representatives from County Risk Management and Human Resources, Public Health, County Counsel, and Information Technologies, collaborated throughout this time to develop a new policy that is thorough and flexible enough in detail to provide process and guidance in the HIPAA arena.
In addition to reviewing similar policies from other counties, the project group also sought the services of California HIPAA expert and attorney, Linda Garrett, Esq., to conduct a deep policy review and update to ensure that El Dorado County is compliant with current California and Federal guidelines. Ms. Garrett provided a summary document referencing specific policy sections that were enhanced from the framework the project team had earlier completed. That summary is attached for reference, along with the Policy Framework documents that Risk Management presenting to the Board for adoption.
This policy incorporates past HIPAA laws and current updates to those provisions to provide clear guidance to County Departments.
ALTERNATIVES
The Board may choose not to approve the recommended changes; direct staff to make additional modifications; or take no action.
PRIOR BOARD ACTION
On August 29, 2017 (Legistar #17-0866) the Board of Supervisors adopted policy L-1 - Protected Health Information (HIPAA): General
OTHER DEPARTMENT / AGENCY INVOLVEMENT
The revised policy was developed with assistance from the Health and Human Services Agency, Information Technologies, Risk Management, and County Counsel. The revised policy was sent to all Department Heads for review.
CAO RECOMMENDATION
Approve as recommended.
FINANCIAL IMPACT
There is no direct financial impact to updating this policy. Indirectly, the proposed policy should assist in minimizing the County’s liability.
CLERK OF THE BOARD FOLLOW UP ACTIONS
Post approved policy to the Board of Supervisors policies webpage.
CONTACT
Joseph Carruesco, Director of Human Resources