Office of Compliance
University of Wisconsin-Madison

HIPAA Privacy & Security Policy Updates

A comprehensive HIPAA policy review project began in 2025.  The initiative is ongoing and focuses on revising all HIPAA Privacy & Security policies, most of which have not been updated since 2020 or before.

In addition to ensuring regulatory compliance, the project aims to simplify language using plain-language principles, remove procedural content better suited for guidance documents, remove non-policy-specific boilerplate language, and consolidate policies to reduce redundancy and improve usability.

Please see below for a summary of substantive policy changes to date:

This is an accordion element with a series of buttons that open and close related content panels.

UW-100: Designation of the UW-Madison Health Care Component (UW HCC)

Jan 2025:

  • Inclusion of Environment Health & Safety (EHS) into the HCC
  • Removal of Administrative Information Management Services
  • Updated language to clarify those included in the HCC on a temporary basis

Oct 2025:

  • Revised rationale/purpose
  • Added new section I. Determination of Membership in HCC
  • Reorganized SMPH units alphabetically
  • Added new SMPH dept- Otolaryngology – Nead & Neck Surg
  • Added School of Ed Dept Kinesiology
  • Added McBurney as a central campus admin group
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

UW-101: Designation of the University of Wisconsin Affiliated Covered Entity (UW ACE)

May 2025

  • Revised rationale/purpose, definitions, and scope sections
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

UW-106: Uses and Disclosures of Protected Health Information for Education and Training

Sep 2025

  • Revised rationale/purpose and definitions sections
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

UW-107: Uses and Disclosures of Protected Health Information for Marketing

Oct 2025

  • Revised rationale/purpose and definitions sections
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

UW-116: Manging Business Associate Arrangements

Oct 2025

  • Updated title from “Managing Arrangements with Business Associates of the University of Wisconsin-Madison” to “Managing Business Associate Arrangements”
  • Consolidated UW-116 and UW-117 (retired UW-117, Managing Business Associate Arrangements When UW–Madison is the Business Associate)
  • Revised rationale/purpose and definitions sections
  • Eliminated consequences for noncompliance section
  • Removed text better suited for procedural guidance
  • Added reference to new “BAA tool”
  • Other language and formatting revisions for improved simplicity, clarity, and usability

UW-124: HIPAA Security - Risk Assessment and Mitigation

Oct 2025

  • Updated title from “HIPAA Security Risk Management” to “HIPAA Security – Risk Assessment and Mitigation”
  • Revised rationale/purpose and definitions sections
  • Eliminated consequences for noncompliance section
  • Removed procedural content better suited for guidance documents
  • Removed content redundant with other campus policies and not strictly relevant to HIPAA requirements
  • Updated related documents/policies/resources sections
  • Other language and formatting revisions for improved simplicity, clarity, and usability

UW-125: HIPAA Oversight: Officer and Coordinator Responsibilities

March 2026

  • Consolidated UW-125 and UW-141 (retired UW-141)
  • Updated title from “HIPAA Security Oversight” to “HIPAA Oversight: Officer and Coordinator Responsibilities”
  • Revised rationale/purpose and definitions sections
  • Removed duplicative content
  • Created a combined Section I. outlining the shared responsibilities of the HIPAA Privacy and Security Officers
  • Created a combined Section II. outlining the shared responsibilities of the HIPAA Privacy and Security Coordinators.
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

Report a HIPAA Incident