S06. Attachment D.3 - Privacy MCP_.pdf

PRIVACY POLICY

MCP 001-31

Veterans Health Care System of the Ozarks (VHSO) Fayetteville, AR 72703

Signatory Authority:

Medical Center Director

Responsible Owner:

Privacy Officer

Rescinded Document:

001-31, Privacy Policy, dated February 26, 2018

Effective Date:

February 7, 2023

Recertification Date:

February 7, 2028

1. POLICY

This Veterans Healthcare System of The Ozarks (VHSO) policy will develop, implement, maintain, and enforce a structured privacy program to properly use, disclose and safeguard individually identifiable information. The privacy program is designed to allow continued operation of mission-critical activities while ensuring the integrity, availability, confidentiality, and authenticity of data and information; minimum necessary access to protected health information; and a continuing awareness of the need for, and the importance of, information privacy within the facility.

2. JUSTIFICATION

All members of the workforce are responsible for complying with this privacy policy, applicable federal laws, and regulations, VA/VHA policies, as well as the procedures and practices developed in support of these policies. All facility privacy policies and procedures must be consistent with VHA 1605 Directives and Handbooks.

3. RESPONSIBILITIES

a. Medical Center Director or Designee. The Medical Center Director (MCD) is responsible for:

(1) Providing the necessary resources (funding and personnel) to support the Privacy Program, maintaining a culture of privacy, and ensuring that the facility meets all the privacy requirements mandated by VA/VHA policy and other federal legislation [e.g., Freedom of Information Act (FOIA) [5 U.S.C.§ 552], Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule [45 C.F.R. Parts 160 and 164], Health Information Technology for Economic and Clinical Health (HITECH) Act, Privacy Act (PA) [5 U.S.C. §552a], VA Claims Confidentiality Statute [38 U.S.C. 5701], Confidentiality of Medical Quality Assurance Review Records [38 U.S.C. 5705], and Confidentiality of Drug Abuse, Alcoholism and Alcohol Abuse, Human Immunodeficiency Virus (HIV) Infection, and Sickle Cell Anemia Medical Records [38 U.S.C. §7332].

February 7, 2023 MCP 001-31

(2) Ensuring that the facility meets all the privacy requirements mandated by VA/VHA policy and other federal legislation ensuring compliance within the facility with all Federal Laws, regulations, VA regulations and policies, and VHA policies relating to privacy.

(3) Ensuring Privacy Officer coverage for the facility and its associated clinics. It is required by VHA Privacy Policy that the facility Privacy Officer report directly to the Medical Center Director, Associate Director or senior individual who reports directly to and is supervised by the Medical Center Director and whose primary responsibilities at the facility include privacy program compliance. Providing coverage for off-hours operations (24/7) when the facility PO or alternate is not available.

(4) Ensuring facility Privacy Officer is fully involved in all projects concerning the access, collection, maintenance, use and/or disclosure, transmission, amendment and/or disposal of individually identifiable information (III).

(5) Ensuring that new and revised Memorandums of Understanding (MOU), Contracts, Data Use Agreements (DUA), BAA, or similar agreements which involve the collection, transmission, use or sharing of information are reviewed by the facility Privacy Officer, in accordance with VA Handbook 6500.6, Contract Security, prior to approval by Executive Leadership.

(6) Ensuring that the facility Privacy Officer is included in discussions regarding privacy concerns of the facility which are addressed in strategic initiatives and maintains a facility culture of privacy.

(7) Cooperating with the facility Privacy Officer in any investigation, mediation strategies, or correspondence that is required to investigate and resolve a complaint or allegation and ensuring that appropriate disciplinary action is taken.

(8) Annually certifying (or on an as needed basis), to the VHA Privacy Office, that privacy training has been completed for all personnel. This shall include all employees, volunteers, contractors, students, residents, and any other person performing or conducting services on behalf of the facility.

(9) Fully cooperating in submissions of Facility Self-Assessments (FSA) and on-site Privacy Compliance Assurance Assessments as required by the Privacy Compliance Assurance (PCA) Office.

(10) Ensuring that signs are placed alerting Veterans to auditory privacy concerns in areas, elevators, and other spaces requiring auditory privacy and that facility employees exercise appropriate precautions and safeguards when discussing Veterans III in public areas, such as clinic waiting rooms.

b. Privacy Officer (or designee). The Privacy Officer (PO) is responsible for:

(1) Developing, implementing, and updating local privacy policies and procedures.

(2) Reviewing all health care center facility policies to ensure compliance with all privacy laws and regulations.

(3) Conducting periodic physical assessments, compliance reviews and/or audits of the facility’s collection, use, storage and maintenance of personal information. Reviews will include identification and correction of privacy vulnerabilities related to incidental disclosure such as posted and displayed PHI in clinical areas.

(4) Establishing effective working relationships with the Information Systems Security Officer (ISSO), Facility Chief, Information Officer (FCIO), Contracting Officer, Compliance Officer, Research Compliance Officer, and Human Resources Management (HRM) personnel to ensure that local policies and procedures which may impact the privacy program support and complement each other.

(5) Ensuring that Executive Leadership is apprised of all privacy vulnerabilities and related issues.

(6) Coordinating with the Information System Security Officer (ISSO) for the assurance of reasonable safeguards as required by the HIPAA Privacy Rule, HITECH or other federal privacy statutes.

(7) Serving as the facility’s point of contact (POC) for privacy matters relating to privacy policies and procedures.

(8) Ensuring that all workforce members (employees, volunteers, students and contractors) complete mandatory privacy training, in conjunction with the facility Education Coordinator and other staff/office, per facility policy, and review training records as per Appendix D in VHA Directive 1605.03(1).

(9) Ensuring members of the workforce know whom to contact when a privacy complaint or incident is identified or received.

(10) Monitoring facility and workforce compliance with VHA privacy policies and procedures as well as compliance with local privacy policies and procedures.

(11) Identifying and reviewing areas within the facility for auditory privacy risks, to ensure appropriate safeguards are in place to limit incidental disclosures. Ensure the placement of signs alerting Veterans and staff to auditory privacy concerns in the waiting areas, elevators, and other spaces requiring auditory privacy and ensure the placement of chairs in waiting areas are optimally placed to minimize auditory privacy violations.

(12) Ensuring the placement of signs prohibiting the use of camera phone or video in restricted areas to comply with VHA Directive 1078(1).

(13) Ensuring processes are in place for the appropriate accounting of disclosures of individually identifiable information made by the facility and appropriate utilization of the Release of Information (ROI) Plus software or other tracking mechanism are used in accordance with facility’s policies and procedures. The processes will include accounting for authorizations electronically conducted through iMedConsent™.

(14) Collaborating with various program officials, and the Contracting Officer, to ensure identification of all entities meeting the definition of Business Associates.

(15) Maintaining a list of active Business Associates utilized by the facility and ensuring all Business Associates have a signed BAA in place prior to disclosure of individually identifiable health information (IIHI) and that the Business Associate adheres to the requirements of the BAA.

(16) Collaborating with the facility Records Manager to ensure that RCS 10-1 is followed for record control requirements and no unauthorized system of records are being kept.

(17) Ensuring all facility developed paper, web-based or electronic forms that collect personal information contain the appropriate Privacy Act statements.

(18) Reviewing and approving all Memorandum of Understanding (MOU), contracts, and DUAs when required for the sharing of VA sensitive data between the facility and other parties.

(19) Ensuring prompt investigation and follow-up on allegations or known occurrences of privacy violations or, complaints including logging the complaint or violation in the Privacy and Security Event Tracking System (PSETS). PSETS should be initiated upon notification of the violation or complaint during normal business hours or as soon as possible outside of normal business hours. If a privacy violation presents the risk of media involvement, congressional inquiry, legal action, immediate harm to any individual or any other high-risk outcome, the incident must be reported within one hour of discovery regardless of discovery time (even during non-business hours).

(20) Promptly reporting any potential privacy complaint, allegation, or activity that has VISN-level or national-level significance to the VHA Privacy Office.

(21) As a non-voting member of the facility Institutional Review Board (IRB), the PO will review all human subject research protocols, exempt and non-exempt, in accordance with VHA Directive 1200.5(01) and other applicable guidance to ensure legal authority exists prior to use and disclosure of VHA information for research.

(22) Collaborating with the facility Information System Security Officer (ISSO), Facility Chief Information Owner (FCIO) to ensure that a Privacy Threshold Analysis (PTA) and Privacy Impact Assessment (PIA) are completed on all information technology systems, applications or programs that collect, maintain, and/or disseminate personally identifiable information (PII).

(23) Reviewing, processing, and monitoring requests to amend any information or record retrieved by an individual’s name that is contained in a VA system of records, to include designated record sets, and coordinating such requests with the author of the document.

(24) Collaborating with the facility Information System Security Officer (ISSO), Contracting Officer Representative (COR) and the Contracting Officer to ensure all contracts are reviewed in compliance with VA Handbook 6500.6.

(25) Ensuring all facility policies and procedures relating to HIPAA, HITECH, PA, 38 U.S.C. § 5701, § 5705, and § 7332, and FOIA are consistent with current guidelines and requirements, complementing and supporting each other. Ensuring local departmental policies and procedures are developed if not specifically outlined in the facility privacy and FOIA policies.

(26) Ensuring local departmental policies and procedures are developed if not specifically outlined in the facility Privacy policy.

(27) Provide awareness training through various means for Veterans to inform them of their privacy rights and responsibilities.

(28) Completing and submitting the Privacy Facility Self-Assessment (FSA) by the last business day of each quarter or as required by PCA and work with facility staff and leadership to facilitate a successful Privacy Compliance Audit.

(29) Ensuring that the Social Security number (SSN) usage is reviewed to determine the necessity and encouraging the reduction of the usage of the SSN whenever possible.

(30) Administering facility C3R activities, documenting the findings of these activities, remediating non-compliance, recording actions taken and making the documentation of these actions available to PCA upon request. NOTE: This requires that all C3R activities are appropriately documented. C3R tools and checklists on the PCA intranet site or other tools generated by the facility may be used to ensure documentation.

c. FOIA Officer. The FOIA Officer is responsible for:

(1) Processing all FOIA requests (for Federal records that would not otherwise be disclosed in accordance with HIPAA or the PA) that are traditional FOIA requests.

Ensuring all FOIA requests or HIPAA/PA requests where information is withheld under a FOIA exemption is entered into FOIAXpress® within the same day as receipt.

(2) Requests on deceased Veterans by the legal next of kin or personal representative of the estate that have been determined to be a full disclosure of the records is no longer processed under FOIA. Since they are no longer processed under FOIA, they do not require entry into FOIAXpress®. Medical records requests by legal next of kin or personal representative of the estate involving 38 U.S.C. § 7332 information is required to obtain survivorship benefits. If the 38 U.S.C.§ 7332 information is required, 38 U.S.C. § 7332 will be disclosed pursuant to the statute. In such instances, requests are not processed under the FOIA and therefore do not require entry into FOIAXpress®.

(3) Medical records requests by the legal next of kin or the personal representative of the estate in which involve 38 U.S.C. § 7332 information and a determination has been made that the 38 U.S.C. 7332 information is not required to obtain survivorship benefits, will be processed as FOIA requests. In these instances, the 38 U.S.C. § 7332 information will be withheld citing FOIA Exemption 6 and Exemption 3. This guidance has not changed from previous direction.

(4) Third Party medical record requests that are accompanied with a HIPAA-compliant written authorization by the legal next of kin or the personal representative of the estate that do not involve 38 U.S.C. § 7332 information and to which a full disclosure will be made are no longer processed under the FOIA. Since these requests are no longer processed under the FOIA, they do not require entry into FOIAXpress®.

(5) Third Party PA requests that are accompanied with a HIPAA-compliant written authorization, but the authorization does not address 38 U.S.C. § 7332 protected information is no longer processed under the FOIA. Privacy/FOIA Officers and Health Information Management (HIM) staff should make efforts to confirm the individual does not wish the 38 U.S.C. § 7332 protected information disclosed. If this was an oversight by the individual, a new authorization must be obtained before the information may be disclosed. If the individual does not wish the 38 U.S.C. § 7332 protected information disclosed, the information must be redacted if possible. If adequate redaction is not possible, the record must be withheld in its entirety. In this instance, the redaction is not pursuant to the FOIA. The information is redacted without citing a FOIA exemption.

Since these requests are no longer processed under the FOIA, they do not require entry into FOIAXpress®.

(6) Third Party PA requests that are not accompanied with a HIPAA-compliant written authorization, the Privacy/FOIA Officers and HIM staff should make every effort to obtain a valid authorization on these requests. If the facility is unable to obtain an authorization, these requests will be processed under the FOIA. As FOIA requests, these requests will be closed withholding the medical record in its entirety citing FOIA Exemption 6 and Exemption 3 citing 38 U.S.C.§ 5701. As FOIA requests, these requests must be entered into FOIAXpress®.

(7) Other responsibilities as defined by VHA FOIA Office.

d. Information Security Officer (ISSO) or designee. The ISSO is responsible for:

(1) Coordinating with the facility PO for the assurance of reasonable safeguards as required by the HIPAA Privacy Rule, HITECH or other federal privacy statutes.

(2) Coordinating, facilitating, and updating the establishment of information security policies and procedures, to work in tandem with privacy policies and procedures.

Serving as the facility’s point of contact for matters relating to the information security policies and procedures.

(3) Establishing effective working relationships with the PO; FCIO; Contracting Officer; Compliance Officer; Research Compliance Officer, and HRM personnel to assure that information technology (IT) security and HIPAA/FOIA/PA/Federal Information Security Management Act (FISMA) policies and procedures complement and support each other.

(4) Reviewing and evaluating the security program impact(s) of any proposed facility information privacy policy and procedure changes.

(5) Collaborating with the facility PO on addressing/resolving privacy complaints, investigations, and access rights to audits and other information maintained by the ISSO, on issues related to common facility impacts from privacy and security requirements.

(6) Collaborating with the facility Privacy Officer, Area Manager and System Owner to ensure that the Privacy Threshold Analysis (PTA) and the Privacy Impact Assessment (PIA) if applicable, are completed and fully executed on all information technology systems, applications or programs that collect, maintain and/or disseminate

PII.

(7) Entering all Information Security violations through the Privacy and Security Event Tracking System (PSETS) to the VA Cyber Security Operations Center (VA- CSOC) within 1 hour of discovery.

(8) Ensuring that all media (paper, electronic, CDs, disks, portable devices, etc.) with III is disposed of via approved means.

(9) Ensuring that Executive Leadership is apprised of all information security related issues.

e. Clinical Service Chiefs (or designee(s) and Appropriate Staff.

(1) Reviewing and determining appropriateness for granting individuals’ requests for record amendment.

(2) Accessing, using and disclosing protected health information only when legal authority exists.

f. Area Manager/Facility Chief Information Officer (FCIO) or Designee. The FCIO is responsible for:

(1) Coordinating with facility ISSO and PO to provide technical advice and other assistance relative to the reasonable safeguards requirements of privacy statutes and regulations dealing with implementation of IT systems, policies, and procedures.

(2) Identifying each locally maintained computer system that contains III and providing technical input for various mandated documents, reports, and investigations.

(3) Ensuring all computer rooms meet acceptable reasonable safeguards and that minimum necessary access is maintained.

(4) Collaborating with the ISSO, PO and Information System Owner to ensure that the PTA and the PIA, if applicable, are completed and fully executed on all information technology systems, application or programs that collect, maintain and /or disseminate

PII.

g. Chief, Human Resources Management (HRMS) or designee. The Chief, Human Resources Management (HRM) is responsible for:

(1) Providing consistent and uniform guidance to supervisors and managers regarding personnel actions, sanctions, or other actions to be taken when employees have violated information privacy practices, laws, regulations, policies and procedures, and rules of behavior (see VA Directive 5021).

(2) Providing appropriate information to PO for completion of PSETS entries in a timely manner regarding mitigation/disciplinary actions.

(3) Ensuring that appropriate disciplinary action is taken when privacy violations are brought to their attention.

(4) Coordinating with facility PO on the privacy and disclosure of personnel records and other records maintained by HRMS.

(5) Ensuring that personnel records maintained by HRM are maintained in compliance with applicable privacy policies, statutes, and regulations.

h. VA Contracting Officer (CO)/Contracting Officer Representative (COR). The CO/COR is responsible for:

(1) Determining the appropriate security and privacy language in all contracts by collaborating with the facility Privacy Officer to ensure that privacy responsibilities are included (see VA Handbook 6500.6, Appendix C). Ensuring through the COR that contractors are aware of, and abide by, those privacy responsibilities as stated in contracts with VA and VHA.

(2) Ensuring through the COR that contractors are aware of, and abide by, those privacy responsibilities as stated in contracts with VA and VHA.

(3) Ensuring that Business Associate Agreements are enacted for all in which the contractor meets the definition of a business associate. The Business Associate Agreements should be a separate document from the contract.

(4) Ensuring that the contractors receive the appropriate privacy and if applicable security training upon initiation of the contract and annually thereafter.

(5) Ensuring that contract performance meets privacy requirements including mediating and/or terminating the contract if information privacy requirements are not being met.

i. Service Chiefs, Program Managers, Supervisors or designees. An example of a designee would be an Automated Data Processing Application Coordinator (ADPAC).

The personnel indicated above are responsible for:

(1) Identifying and protecting all III used by supervised personnel, including contractors and other workforce members.

(2) Ensuring that individuals are only provided access to III when authorized and the appropriate training has been completed such as in the case of volunteers. (Note: CWT, compensated work therapy, patients are prohibited to have access to PHI).

(3) Ensuring that III, whether computerized or printed, is secured when work areas under their supervision are unattended.

(4) Facilitate or provide training to new and existing personnel on roles and responsibilities for protecting III, to include the requirement that possible suspected privacy violations are reported to the Privacy Officer at the time of discovery.

(5) Identifying and assigning functional categories in accordance with the facility policy and ensuring that supervised personnel have only the minimum necessary access level required to carry out their authorized functions or assigned duties and that supervised personnel understand what their minimal level of access is and that access beyond the scope of their responsibilities will result in disciplinary action.

(6) Ensuring applicable personnel complete “Information Security and Privacy Awareness and Rules of Behavior” training. If access to protected health information (PHI), is required then “Privacy and HIPAA” training must be completed within 30 days of hire or before access to PHI is given. Training must be completed annually thereafter and documented using the Talent Management System (TMS). Workforce members must be enrolled in TMS either through self-enrollment (For example, contractors and volunteers) or automatic enrollment upon hire.

(7) Ensuring that media (paper, electronic, Compact Discs (CDs), disks, portable devices, etc.) with III is disposed of via approved means. Shredding is done by a contractor. They provide the containers as well as coordinate the shredding of the paper. Community Based Outpatient Clinics (CBOC) also use the same vendor for their shredding. Services will contact Environmental Management Services (EMS) when special arrangements need to be made regarding destruction of other media.

(8) Assisting the facility PO and Human Resource Management with the investigation and resolution of privacy incidents involving their employees and/or program(s). However, supervisors are not to access a record for investigation without express permission from the Privacy Officer.

(9) Provide all responsive documents to the FOIA Officer upon request in a timely manner and require cooperation from staff in response to all FOIA requests.

j. Quality, Safety and Value Manager. The Quality, Safety and Value Manager is responsible for coordinating with the facility PO, FOIA officer and ROI staff on requests for copies of or access to QM documents. The facility Privacy Officer serves as the final approval authority for determining which documents are classified as quality management documents in accordance with VHA Directive 2008-077, Quality Management (QM) and Patient Safety Activities That Can Generate Confidential Documents prior to disclosure. The facility Privacy Officer will work with the FOIA Officer concerning any exception to disclosure under FOIA.

k. Administrator on Duty (AOD). The AOD is responsible for resolving and responding to disclosure issues and incident reporting requirements consistent with VHA Directive 1605, VHA Handbooks 1605 series, VA Directive 6500 and VA Handbook 6500 series during non-business hours during the off tours.

l. All individuals who have access to sensitive information. All individuals who have access to sensitive information are responsible for:

(1) Accessing the minimum necessary data for which they have authorized privileges and, on a need, to-know basis in the performance of their official VA duties.

(2) Employees must exercise appropriate precautions and safeguards when discussing Veterans’ individually identifiable information (III) in public areas to prevent an unauthorized disclosure.

(3) Protecting an individual’s rights to privacy and ensuring proper use and disclosure of information. All workforce members will be held accountable for compliance with these policies, procedures, and applicable laws.

(4) Appropriately safeguarding printed and electronic III.

(5) Reporting complaints and/or violations of privacy policies or procedures to the facility PO, or designee immediately upon discovery. Co-operating with the facility Privacy Officer and/or the VHA Privacy Office throughout the complaint investigation process.

(6) Cooperating with the facility Privacy Officer and/or the VHA Privacy Office throughout the complaint investigation process.

(7) Obtaining appropriate approval in accordance with Public Affairs policy to speak to the news media. Employees are not authorized to disclose any III on a patient or Veteran during an interview without the prior signed, written authorization of the patient or Veteran. When an employee is asked to be interviewed by a third party, such as the news media, VA Form 10-3203a, Informed Consent and Authorization for Third Parties to Produce or Record Statements, Photographs, Digital Images, or Video or Audio Recordings must be completed.

(8) Consulting the PO and VHA Directive Handbook 1605.01 for guidance in privacy situations not addressed in this document.

4. PROCEDURES

a. Administrative Requirements.

(1) The facility and its workforce will comply with the contents of this policy, VHA Directive 1605.01, and all other applicable privacy laws, regulations, and VA/VHA policies.

(a) The facility and its workforce will comply with the contents of this policy, VHA Directive 1605.01, and all other applicable privacy laws, regulations, and VA policies.

(b) The PO, or designee, will monitor compliance with this policy through various means, including continuous assessment for privacy compliance.

(2) Documentation. This policy and any changes thereto, must be maintained in writing, either on paper or in electronic form, for a period of at least six years. When VHA Directive 1605.01 is updated (which necessitates alteration of facility policies and procedures), the local privacy policies and procedures will be revised without delay.

Medical Center Memorandums are reviewed yearly.

b. Complaint Process.

(1) All privacy complaints received by the facility are to be referred immediately to the PO or designee for review and processing.

(2) An individual has 3 years from the date of the complaint to request an investigation into the alleged complaint. Health and Human Services, Office of Civil Rights (HHS-OCR) uses this same time frame for their complaints.

(3) The PO, or designee, will enter all facility privacy complaints, regardless of validity, into the VA Privacy and Security Event Tracking System (PSETS). AOD will report to PO any off duty after hour incidents. All incidents must be reported within one hour of discovery, during both normal business hours, as well as off duty hours to the VA Network Security Operations Center (CSOC).

(4) Notice to Privacy Complainants: All individuals filing a privacy complaint will be provided a copy of the Notice to Privacy Complainants at the time of the complaint submission.

(5) Complaints Identified as Incidents: When the facility PO makes a determination during the investigation that a privacy complaint is a privacy violation/incident, the PSETS ticket classification will promptly be changed from a complaint to an incident.

(a) If the complaint is made verbally, the PO, or designee will obtain mailing information to send the Notice to the privacy complainant.

(b) The Notice will be mailed to the privacy complainant within 10 working days if the Notice is not given in person to the complainant. A complaint acknowledgement cover letter will be included when the Notice is mailed.

(6) The facility PO, or designee, is responsible for investigating all complaints regarding facility privacy practices regardless of validity.

(a) Cooperating with the VHA Privacy Office on all HHS-OCR complaints and all other privacy complaints submitted to VHA Privacy Office in VHA Central Office (VHACO), in addition to providing timely access to complaint investigation files.

(b) Acknowledging receipt of privacy complaint by providing IB 10-69, Notice to Privacy Complainants in compliance with VHA Directive 1605.01.

(c) Communicating with leadership, as appropriate (i.e., Director, VISN, VHA Privacy Office, Office of Inspector General, and Office of General Counsel).

(d) Determining whether a complaint is a privacy violation/incident and responding appropriately.

(e) Responding as soon as possible (or no later than 60 working days), in writing, to the complainant when the complaint does not result in an incident.

(f) Appropriately notating the privacy complaint/incident in PSETS.

(g) Documenting outcomes of the investigation and provide findings to the supervisor in coordination with other stakeholders (i.e., Human Resources for sanctions or disciplinary actions, union representatives, Service Chiefs, Program Managers).

(h) Mailing the response letter to the complainant’s address.

(i) Maintaining an administrative file for all complaints by PSETS ticket number or by date.

(j) Trending the types of privacy complaints identified and reports these trends to the facility leadership bi-annually and VHA Privacy Office, upon request.

(7) Complaints Identified as Incidents: When the facility PO makes a determination during the investigation that a privacy complaint is a privacy violation/incident, the PSETS ticket classification will promptly be changed from a complaint to an incident.

(a) When a privacy complaint is made regarding access to a health record and the facility PO cannot prove that the access is likely or not likely authorized, the access must be presumed to be unauthorized and will be reported as a privacy violation/incident in PSETS.

(b) All determinations as to whether a privacy incident warrants credit monitoring protection services or a notification only letter will be made by the VA Data Breach Resolution Service (DBRS) and the Data Breach Core Team (DBCT).

(c) The DBRS and DBCT will notify the facility PO in accordance with VA Handbook 6500.2, Appendix C.

(d) When required the notification letter or credit-monitoring letter will be mailed no later than 60 calendar days from when the incident was reported by the PO.

(8) Administrative Record Keeping: A privacy complaint file containing all the documentation of the privacy complaint and investigation will be retained by the facility PO in accordance with the Record Control Schedule (RCS) 10-1, item number 1006.19, Privacy Complaint File. Documentation in the complaint file will consist of the following:

(a) Initial written complainant’s concern or a Report of Contact by the PO, if the complaint is made orally.

(b) Written documentation of all interviews or statements.

(c) All written correspondence, including emails.

(9) All complaints (privacy and/or security related) received from the Department of Health and Human Services (HHS)-Office for Civil Rights (OCR) will be encrypted and forwarded immediately to VHA Privacy Office mail group VHAPrivIssues@va.gov for appropriate processing. The facility does not have authority to respond to HHS-OCR complaints.

(a) If an investigation arises because of an HHS-OCR complaint, this facility and its business associates must permit the Secretary of HHS access to information, during normal business hours, after coordinating with the VHA Privacy Office.

(b) If the facility PO receives an HHS-OCR notification letter, this notification letter should be forwarded via encrypted email to the: VHAPrivacyIssues@va.gov Outlook mail group.

(c) When addressing complaints, the facility PO should reference resources available on the VHA Privacy Officer SharePoint site. When Human Resources is contemplating employee disciplinary action, they should refer to VA Directive 5021 and VA Handbook 5021, Employee/Management Relations.

(10) The facility may not require an individual to waive any right under these provisions as a condition for obtaining treatment, payment, and enrollment or benefits eligibility.

(11) The facility may not retaliate against a person for exercising rights provided by the HIPAA Privacy Rule, for assisting in an investigation by HHS-OCR or another appropriate authority, or for opposing an act or practice that the person believes in good faith violates these provisions.

c. Reasonable Safeguards.

(1) All facility workforce members shall ensure that appropriate administrative, technical, and physical safeguards are used to maintain the security and confidentiality of III, including protected health information (PHI), and to protect against any anticipated threats or hazards to their security or integrity. The facility’s workforce shall make reasonable efforts to limit III to the minimum necessary to accomplish the intended purpose of any use, disclosure, or request. This does not pertain to the treatment provision under the HIPAA Privacy Rule.

(2) All personnel may access and use information contained in VHA records as required for their official duties related to treatment, payment, and healthcare operations purposes. Service Chiefs, or designees, will assure that employees have access to the information that is necessary to perform their duties. Supervisors will work with the PO/ISSO when necessary for any clarification.

(3) When disclosing VHA information, all applicable laws and regulations are reviewed and applied to the request to assure utilization of the most stringent provisions for all uses and/or disclosures of data in order to provide the greatest rights to the individual and the minimum necessary of III. III disclosure is mandatory with a valid written authorization, signed by the individual but disclosure must be limited to only the information necessary to satisfy the purpose of the request.

(4) Disposal of documents: Staff disposes of paper documents that contain III by ensuring all such documents are immediately placed in “locked” shredding collection receptacles located throughout VHSO facilities. Data that is not destroyed at the site of production, such as transported for contracted shredding, must be secured in locked containers or in locked areas until it is removed for destruction. CBOCs utilize the same shredding vendor. Facility follows processes as outlined in VA Directive 6371. Final destruction method meets the requirements of directive.

(5) Disposal of Electronic Media: Electronic media and electronic media storage devices such as CD and portable thumb drives containing III will be destroyed in accordance with Office of Information Technology (OI&T) Standard Operating Procedure.

(6) Non-paper items containing III (For example, wristbands, IV bag labels, labels/stickers) will be disposed of in the same manner as the paper process at VHSO.

Labels/stickers will be removed form containers prior to placement in “locked” shredding collection receptacles.

(7) Maintaining auditory privacy: Staff only discusses patient care issues in appropriate areas, which allow the maintenance of auditory privacy. Facility staff does not discuss patient information in areas not conducive to confidentiality (For example, canteen, elevators, or hallways). Signs must be posted alerting Veterans to auditory privacy concerns in the waiting areas. VHA health care providers and staff must refrain from discussing patient information within hearing range of anyone who is not on the patient's treatment team or does not have a need to know the specific patient information unless an emergent condition arises whereby auditory privacy cannot be maintained. Administrative staff should follow the same guidance in any discussion involving individually identifiable sensitive information (i.e. employee health or disciplinary actions). Appropriate safeguards include training all staff on auditory privacy to include:

(a) Using the Veterans Health Identification Card (VHIC) for identification upon check-in, if available.

(b) Using an appropriate tone of voice when speaking with the Veteran in a public area or during check-in.

(c) Only discussing the information necessary to accomplish the function (For example, not asking for the full SSN when the last four of the SSN is enough).

(d) Asking other Veterans in line for clinical check-in to wait a short distance away from the desk to allow a zone of audible privacy as opposed to being right behind the Veteran being assisted.

(e) Only calling Veterans back to an exam room, pharmacy window or other treatment area by name.

(f) Going behind closed doors to have discussions pertaining to the personal information of the Veteran.

(8) Use of facsimile (fax): When using fax technology, facility staff adheres to VA Handbook 6500. Information Security Program, VHA Handbook 1907.01, Health Information Management and Health Records; and VHA Directive 1605.01, Privacy and Release of Information.

(a) III is only transmitted via fax when necessary. Any disclosure of faxed information containing or requesting individually identifiable patient information must be accounted for in the ROI Plus software or on a manual spreadsheet.

(b) Any staff member utilizing facsimile as a means of transferring III must take the following steps to ensure that III is sent to the appropriate destination and not to a machine accessible to the general public:

(c) Verify the fax number prior to sending the fax and, to prevent misdialing, do not use pre-programmed numbers unless the number is tested prior to faxing. Periodically verify the fax numbers of frequent recipients. Ask those frequent recipients to notify the facility of any fax number changes.

(d) Use a fax cover sheet with an appropriate confidentiality statement, instructing the recipient of the transmission to notify the facility if received in error, must be sent with all outgoing faxes. PHI should never be placed within the fax cover sheet as this negates the confidentiality statement on the fax coversheet.

(e) Notify the recipient before sending the fax in order to ensure that someone is present to receive the information or that the fax machine is in a secure location, such as a locked room.

(f) Review the fax confirmation slip to verify that the confidential information went to the proper destination number. If there has been an error, immediately contact the incorrect recipient and request return or destruction of the fax.

(9) Email and information messaging applications and systems are used as outlined in VA policy VA Handbook 6500. These types of messages never should contain III, unless the authentication mechanisms have been secured appropriately (see VA Handbook 6500). Responding to a patient via email which contains protected health information should only be done through MyHealtheVet Secure Messaging.

(10) Mailing of Sensitive Information: Mailing of Veteran’s correspondence such as copies of records, appointment letters may be done using the United States Postal Service (USPS). Envelopes, parcels, packaging, or boxes containing sensitive information must be secured in a manner that prevents unauthorized access, tampering, or accidental loss of contents. Window envelopes must show the recipients’ names and addresses, but no other information. (See VHA Directive 6609).

d. Mitigation. To the extent practical, this facility mitigates any harmful effect known to have resulted from an improper use or disclosure of III. Mitigation may include but is not limited to operational and procedural corrective measures; re-training, reprimanding, or disciplining workforce members; addressing problems with any involved business associates; incorporating the chosen mitigation solution(s) into facility procedures. All known or suspected breaches of patient privacy must be immediately reported to the facility PO or designee.

e. Sanctions.

(1) All individuals who use or gain access to VA information systems or sensitive information must sign and adhere to the Rules of Behavior, which bind them to the legal and moral responsibility of preventing unauthorized disclosure. (See VA Handbook 6500, Information Security Program) This facility has established sanctions, which are applied against members of its workforce as appropriate, for failures to comply with privacy policies and procedures and Rules of Behavior.

(2) This facility has established a set of rules that describes the information privacy operations of the facility and clearly delineates the responsibilities and expected behaviors of all workforce members. These rules address all significant aspects of using III and the consequences of inconsistent behavior or non-compliance. The entire workforce of this facility will have access to a copy of these rules for purposes of review.

A signed (manually or electronically) acknowledgement of these rules is necessary for each workforce member.

(3) The facility PO will determine information privacy violations and provide evidence thereof. The employee’s supervisor will determine appropriate actions and may, in conjunction with human resources, take necessary steps and apply appropriate sanctions for any employees who are non-compliant with privacy policies and procedures. Penalties will be assessed against any individual(s) who knowingly and/or willfully use, disclose, or obtain information without the patients written authorization or not.

(4) Appropriate sanctions must be taken in accordance with VA Directive 5021.

(5) Adverse actions may include, but are not limited to, progressive discipline. The facility will follow processes and procedures outlined in VA Handbook 5021 for adverse actions in compliance with the stated Table of Penalties.

f. Access to Sensitive Information and Restricted Areas.

(1) All Individuals who have access to sensitive information are responsible for the following:

(a) Accessing the minimum necessary data for which they have authorized privileges and, on a need-to-know basis in the performance of their official VA duties.

(b) Protecting an individual’s rights to privacy and ensuring proper use and disclosure of information. All workforce members will be held accountable for compliance with these policies, procedures, and applicable laws.

(c) Appropriately safeguarding printed and electronic individually identifiable information.

(d) Reporting complaints and/or violations of privacy policies or procedures to the facility Privacy Officer immediately upon discovery.

(e) Consulting the facility Privacy Officer and VHA Handbook 1605.1 for guidance in privacy situations not addressed in this document.

(f) All employees/visitors entering any area which has been designated as a restricted access area, will check-in at the door of the designated area, and inform staff of the reason for their visit.

(g) Following validation, the visitor will be asked to wait outside the designated area and wait to be escorted. Under no circumstances will any visitors be allowed to enter the restricted area without being escorted.

(h) All employees must pay particular attention to all access doors leading to restricted access areas and may only allow access when there is a valid business purpose.

(i) Employees must pay close attention when entering restricted areas, to ensure that no individuals are attempting to gain access by “tagging along” behind them.

(j) If an employee notices an individual that they do not recognize as being “authorized,” the employee should immediately “challenge” the individual and ascertain his/her reason for being in the area.

(k) If a valid reason cannot be determined, the employee should first ask the employee to wait outside of the restricted area, then contact facility management/supervision immediately and advise them of the situation.

(l) If the individual departs the area, a complete description of the individual should be provided to management/supervision and/or to VA Police/law enforcement if warranted.

(m) Employees must wear their PIV badge on the outside of their clothing, above the waist at all times unless it presents a safety hazard when performing their official duties.

g. Privacy Training and Education.

(1) The facility PO will conduct privacy training at all facility New Employee Orientation (NEO) programs.

(2) Employees are responsible for annual completion of their mandatory privacy training requirement prior to or on their anniversary date of privacy training the following year. Monthly, the PO reviews the delinquent HIPAA and Privacy training report generated by TMS. The PO emails the supervisor of the employee that is delinquent for follow through and completion.

(3) The facility Privacy Officer, in coordination with the facility Education Office, Service Chiefs, Program Managers, and supervisors, and their respective designees, assist in the process of compiling annual training records to report the facility privacy training completion status to the VHA Privacy Office and to the MCD upon request.

(a) The annual training records of completion of privacy training must be kept for all employees, volunteers, students, and contractors for reporting of facility privacy training completion numbers by each group.

(b) The MCD will certify annual training completion to the VHA Privacy Office for all work force members based on the reports generated by the Education Office upon request.

(4) The facility PO shall conduct other activities within the facility to enhance awareness of privacy and that have a positive impact on the overall privacy culture and posture of the facility. These activities shall include, but are not limited to, participation in VA’s annual Privacy Week activities, posting privacy posters and announcements throughout the facility, and conducting one-on-one training with personnel who have been observed displaying negative privacy culture behaviors.

h. Privacy Threshold Analysis

(1) The Privacy Threshold Analysis (PTA) is an internal document used by the Privacy Officers, information system owners and the Information System Security Officers (ISSOs). Based on the information in the PTA, Privacy Impact Assessment (PIA) support determines if a PIA is required under the E-Government Act of 2002.

(2) PTAs identify programs and systems that are privacy-sensitive and contain PII.

PTAs create an annual record of major system changes and standardize the privacy compliance process. PTAs strengthen the understanding of VA systems, programs, and projects. PTAs are written so that individuals who don’t have a technical background can understand what’s being stated.

(3) PTAs are to be completed and submitted to the VA Privacy Service PIA support mail group PIAsupport@va.gov on an annual basis unless there is a major change to an IT system prior to the annual review.

(4) PTAs are not publicly posted. To obtain a copy of an approved PTA, you may contact PIA Support at piasupport@va.gov.

i. Privacy Impact Assessment

(1) Privacy Impact Assessments (PIA) outline the risks and effects of collecting, maintaining, and disseminating PII. They mitigate potential privacy risks by evaluating protections, such as security and privacy controls. They can also introduce alternative processes for handling information.

(2) PIAs help identify the overall privacy risk level of a system, program, or project.

PIA’s inform leadership, program offices, and Veterans about how VA is implementing privacy and mitigating risks associated with PII collection, use, and maintenance.

(3) PIAs are to be completed and submitted to the VA Privacy Services PIA support mail group at PIAsupport@va.gov every three years unless there is a major change to the IT system prior to the three-year period.

(4) PIAs inform the public what PII VA is collecting, why the PII is being collected and how the PII will be collected, used, accessed, shared, safeguarded and stored.

j. Personally Identifiable-Information Database Inventory

(1) The facility Privacy Officer, in coordination with the facility Area Manager, ISSO, Records Manager and facility IT staff, shall maintain a process for identifying databases which collect or maintain PII/PHI.

(2) The PO ensures databases identified with PII/PHI are accounted for in existing PTA and PIA.

(3) If the databases identified are not accounted for, then the PO, in collaboration with the Area Manager and ISSO, updates the PTA and PIA documents accordingly.

(4) Database inventories are done on an annual basis.

k. Individual Rights.

(1) Verification of Identity:

(a) In order to receive or view information from his or her VHA record, an individual must present staff with adequate information for verification of identity, as outlined in VHA Directive 1605.01. Individuals may not verify identity by email.

(b) A VHIC, passport, driver’s license, or employee identification card may be used to identify an individual who appears in person.