HIPAA Privacy & Security Policy Updates

A comprehensive HIPAA policy review project began in 2025.  The initiative is ongoing and focuses on revising all HIPAA Privacy & Security policies, most of which have not been updated since 2020 or before.

In addition to ensuring regulatory compliance, the project aims to simplify language using plain-language principles, remove procedural content better suited for guidance documents, remove non-policy-specific boilerplate language, and consolidate policies to reduce redundancy and improve usability.

Please see below for a summary of substantive policy changes to date:

|

Jan 2025:

  • Inclusion of Environment Health & Safety (EHS) into the HCC
  • Removal of Administrative Information Management Services
  • Updated language to clarify those included in the HCC on a temporary basis

Oct 2025:

  • Revised rationale/purpose
  • Added new section I. Determination of Membership in HCC
  • Reorganized SMPH units alphabetically
  • Added new SMPH dept- Otolaryngology – Nead & Neck Surg
  • Added School of Ed Dept Kinesiology
  • Added McBurney as a central campus admin group
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

May 2025

  • Revised rationale/purpose, definitions, and scope sections
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

May 2026

  • Added EH&S to the list of units excluded from the UW ACE

Sep 2025

  • Revised rationale/purpose and definitions sections
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

Oct 2025

  • Revised rationale/purpose and definitions sections
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

July 2026

  • Restructured the policy to create a shorter, more logical and user friendly layout without significantly altering the substance of the policy

July 2026

  • Changed the policy title to reflect the updated policy’s focus on required validation of de-identified datasets in certain circumstances, rather than referring only to de-identification.
  • Created a definition for the term “Honest Broker”
  • Created a new section on validation of de-identification to address a compliance requirement that is often overlooked. The section makes clear under what circumstances an individual must obtain validation; adds a new sub-category for validation: “The data include free text information (such as free-text medical record entries and transcriptions of interviews or videos) unless the free text is limited to the name of a disease or condition”; expands the scope of individuals qualified to validate de-identification to include “a UW–Madison Honest Broker outside of SMPH that is approved by the HIPAA Privacy Officer”; and creates an obligation for unit grants and contracts staff to ensure validation has occurred prior to forwarding an agreement for signature.
  • Other language and formatting revisions for improved simplicity, clarity, and usability

July 2026

  • Added definitions for “Honest Broker” and “University of Wisconsin Affiliated Covered Entity (UW ACE)”
  • Created a new section on validation requirements for Limited Data Sets to address a compliance gap. As with de-identified data sets, LDSs have always required validation under certain circumstances before sharing outside the UW HCC/ACE. However, this requirement was not previously codified in UW-115 and only verbally and inconsistently communicated.
  • Created a new section to specifically address Signature Authority for DUAs.
  • Other language and formatting revisions for improved simplicity, clarity, and usability

Oct 2025

  • Updated title from “Managing Arrangements with Business Associates of the University of Wisconsin–Madison” to “Managing Business Associate Arrangements”
  • Consolidated UW-116 and UW-117 (retired UW-117, Managing Business Associate Arrangements When UW–Madison is the Business Associate)
  • Revised rationale/purpose and definitions sections
  • Eliminated consequences for noncompliance section
  • Removed text better suited for procedural guidance
  • Added reference to new “BAA tool”
  • Other language and formatting revisions for improved simplicity, clarity, and usability

Oct 2025

  • Updated title from “HIPAA Security Risk Management” to “HIPAA Security – Risk Assessment and Mitigation”
  • Revised rationale/purpose and definitions sections
  • Eliminated consequences for noncompliance section
  • Removed procedural content better suited for guidance documents
  • Removed content redundant with other campus policies and not strictly relevant to HIPAA requirements
  • Updated related documents/policies/resources sections
  • Other language and formatting revisions for improved simplicity, clarity, and usability

March 2026

  • Consolidated UW-125 and UW-141 (retired UW-141)
  • Updated title from “HIPAA Security Oversight” to “HIPAA Oversight: Officer and Coordinator Responsibilities”
  • Revised rationale/purpose and definitions sections
  • Removed duplicative content
  • Created a combined Section I. outlining the shared responsibilities of the HIPAA Privacy and Security Officers
  • Created a combined Section II. outlining the shared responsibilities of the HIPAA Privacy and Security Coordinators.
  • Eliminated consequences for noncompliance section
  • Other language and formatting revisions for improved simplicity, clarity, and usability

July 2026

  • Removed procedural content not suitable for policy
  • Where needed, updated sections to identify the person(s) or units responsible for the policy requirement
  • Other language and formatting revisions for improved simplicity, clarity, and usability
Report a HIPAA Incident