2005-030 - Laserfiche WebLink

Home Browse Search

• not use or further disclose PHI other than as permitted by the Plan documents or as required by law ; • ensure that any agents or subcontractors to whom it provides PHI received from the Plan agree to the same restrictions and conditions that apply to the County; not use or disclose PHI . for employment-related actions or in connection with any other employee benefit plan ; report to the Privacy Official any use or disclosure of the information that is inconsistent with the permitted uses or disclosures ; • make PHI available to Plan participants, consider their amendments and, upon request, provide them with an accounting of PHI disclosures as required by make the County' s internal practices and records relating to the use and disclosure of PHI received from the Plan available to Department of Health and Human Resources (DHHS) upon request; and • if feasible , return. or destroy all PHI received from the Plan that the County still maintains in any form and retain no copies of such information when no longer needed for the purpose for which disclosure was made , except that, if such return or destruction is not feasible , limit further uses and disclosures to those purposes that make the return or destruction of the information infeasible . The Plan document also requires the County to ( 1 ) certify to the Privacy Official that the Plan documents have been amended to include the above restrictions and that the County agrees to those restrictions ; and (2) provide adequate safeguards . 10. Documentation The Plan' s and the County' s privacy policies and procedures shall be documented and maintained for. at least six years . Policies and procedures must be changed as necessary or appropriate to comply with changes in the law, standards , requirements , and implementation specifications (including changes and modifications in regulations) . Any changes to policies or procedures must be promptly documented . If a change in law impacts the privacy notice, the privacy policy must promptly be revised and made available . Such change is effective only with respect to PHI created or received after the effective date of the notice . The Plan and the County shall document certain events and actions (including authorizations , requests for information, sanctions , and complaints) relating to an individual' s privacy rights . The documentation of any policies and procedures , actions , activities , and designations may be maintained in either written or electronic form. Covered entities must maintain such documentation for at least six years . 7