Livingston County HIPAA Compliance

What is HIPPA?

HIPAA is the United States Health Insurance Portability and Accountability Act of 1996. There are two sections to the Act. HIPAA Title I deals with protecting health insurance coverage for people who lose or change jobs. HIPAA Title II includes an administrative simplification section which deals with the standardization of healthcare-related information systems. This section is what most people mean when they refer to HIPAA.

HIPAA establishes standardized mechanisms for electronic data interchange (EDI), security, and confidentiality of all healthcare-related data. The Act mandates: standardized formats for all patient health, administrative, and financial data; unique identifiers (ID numbers) for each healthcare entity, including individuals, employers, health plans and health care providers; and security mechanisms to ensure confidentiality and data integrity for any information that identifies an individual.

HIPAA In Livingston County

Livingston County is a hybrid covered entity. This means that HIPAA only applies to parts of the county, but not all of it. The covered components of the county include:

• Livingston County Health Department (Personal Health Division but excluding the Environmental Health Division)
• Livingston County Emergency Medical Services Department
• Livingston County Sheriff’s Office, Jail Division
• Livingston County Human Resources Department (Employee Health Benefits)
• Livingston County Information Technology Department
• Livingston County Dispatch Center, to the extent that it transmits PHI to and receives PHI from Livingston County Emergency Medical Services Department

HIPAA uses a cadre of privacy officers to help implement its requirements. These include a Privacy Officer and a Security Officer as countywide points of contact and individual Privacy and Security Officials for the covered components. HIPAA is implemented through a combination of board policies and department procedures.

Policies

The Board of County Commissioners adopted Resolution 2013-04-107 on April 9, 2013, designating Livingston County as a hybrid covered entity for the purposes of HIPAA compliance. This designation describes the organizational units that are subject to HIPAA regulations and those that are not.

Livingston County has adopted four administrative procedures to implement the policies adopted above:

• HIPAA-1 Protected Health Information (PHI) (2013)
• HIPAA-2 Security of Electronic Protected Health Information – All Employees (2013)
• HIPAA-3 Security of Electronic Protected Health Information – IT Staff (2013)
• HIPAA-4 Breach Notification for Unsecured Protected Health Information (2013)
• Livingston County Personnel Rule: Information Technology Resources Policy: Resolution #2007-08-200

Contact your privacy and security officials for more information.

Training

All employees of the following organizational units are required to have HIPAA privacy and security training:

• Livingston County Health Department (Personal Health Division but excluding the Environmental Health Division)
• Livingston County Emergency Medical Services Department
• Livingston County Sheriff’s Office, Jail Division
• Livingston County Human Resources Department (Employee Health Benefits)
• Livingston County Information Technology Department
• Livingston County Dispatch Center

At the direction of department privacy officials, county employees from other units who regularly frequent areas occupied by these departments, such as facilities drivers, painters, electricians, etc. may be required to take HIPAA training.

Note that the term here, “employees” is also meant to include all contractors, students, interns, volunteers, etc., who frequent a work area for any purpose when that work area is normally occupied by county employees of these units.

Other Useful Information

• Livingston County Encrypted Email
• Email Consent Form
• External Business Partner Network Access Request
• External Business Partner Compliance Agreement