Policies
UW–Madison’s HIPAA policies are regularly updated to reflect regulatory and organizational changes. See our Privacy and Security Policy Updates page for a summary of the latest changes.
|
UW–Madison’s policies are under review and continue to be updated as to Security Rule provisions. Please check back periodically for updates.
- 1.1 (UW-100) Designation of the UW–Madison Health Care Component (UW HCC)
- 1.2 (UW-101) Designation of the University of Wisconsin Affiliated Covered Entity (UW ACE)
- 2.1 (UW-102) Notice of Privacy Practices (NPP) Distribution and Acknowledgement
Related Form: Acknowledgement of Receipt of Notice of Privacy Practices - 3.2 (UW-103) Uses and Disclosures of Protected Health Information That Require Patient Authorization
Related Form: Authorization for Disclosure of Medical Information (General Purpose) - 3.3 (UW-104) Uses and Disclosures of PHI Not Requiring Patient Authorization
- 3.4 (UW-105) Uses and Disclosures of PHI That Require Providing Patient with an Opportunity to Agree or Object
- 3.5 (UW-106) Uses and Disclosures of Protected Health Information for Education and Training
Related Form: Authorization for Disclosure of Medical Information for Publication - 3.6 (UW-107) Uses and Disclosures of Protected Health Information for Marketing
- 3.7 (UW-108) Uses and Disclosures of Protected Health Information for Fundraising
Related Form: Authorization for Use/Disclosure of Medical Info for Marketing or Fundraising - 3.8 (UW-109) The Minimum Necessary Standard
- 3.9 (UW-110) Verifying Identity and Authority of Persons Seeking Disclosure of a Patient’s PHI
- 3.10 (UW-111) Designated Record Set
- 3.11 (UW-112) Sale of Protected Health Information Generally Prohibited
- 4.1 (UW-113) Designation of IRBs as Privacy Boards
- 5.1 (UW-114) De-identification of Protected Health Information Under the HIPAA Privacy Rule
- 5.2 (UW-115) Creation of a Limited Data Set Under the HIPAA Privacy Rule
- 6.1 (UW-116) Managing Business Associate Arrangements
- 6.2 (UW-117) Managing Business Associate Arrangements When the University of Wisconsin–Madison is the BA
Related Form: Business Associate Agreement
Related Form: Certification that PHI Destroyed or Destruction Infeasible
Related Form: Checklist for UW–Madison Business Associates - 6.3 (UW-118) Use of and Safeguards for PHI by UW–Madison Internal Business Support Personnel
- 7.1 (UW-119) Requests by Patients for an Accounting of Certain Disclosures
- 7.2 (UW-120) Requests by Patients to Amend Protected Health Information
- 7.3 (UW-121) Requests by Patients for Alternative Confidential Communications
- 7.4 (UW-122) Requests by Patients for Access to Inspect and Obtain a Copy of Protected Health Information
- 7.5 (UW-123) Requests by Patients for Restrictions on Uses and Disclosures of Protected Health Information
- 8.1 (UW-124) HIPAA Security – Risk Assessment and Mitigation
- 8.2 (UW-125) HIPAA Oversight: Officer and Coordinator Responsibilities
- 8.3 (UW-126) HIPAA Security Auditing
- 8.4 (UW-127) HIPAA Security Contingency Planning
- 8.5 (UW-128) Security of Faxed, Printed, and Copied Documents Containing Protected Health Information
- 8.6 (UW-129) Email Communications Involving Protected Health Information
- 8.7 (UW-130) Destruction/Disposal of Protected Health Information
- 8.8 (UW-131) Reporting of HIPAA Incidents and Notifications in the Case of Breaches of Unsecured PHI
- 8.9 (UW-132) HIPAA Security System Access
- 8.10 (UW-133) HIPAA Security – Remote Access to Protected Health Information
- 8.11 (UW-134) HIPAA Security Data Management and Backup
- 8.12 (UW-135) HIPAA Security Facilities Management
- 8.13 (UW-136) HIPAA Security – Workstation and Mobile Device Use and Security Configuration
- 9.1 (UW-137) HIPAA Privacy and Security Training
- 9.2 (UW-138) Responding to Employee Noncompliance with Policies and Procedures Relating to HIPAA Privacy and Security Rules
- 9.3 (UW-139) Responding to Student Noncompliance with Policies and Procedures Relating to HIPAA Privacy and Security Rules
- 10.1 (UW-140) Complaints Under the HIPAA Privacy Rule
Related Form: Patient Privacy Complaint - 10.2 (UW-141) Designation of Unit Privacy and Security Coordinators
UW–Madison faculty and staff may be subject to discipline, up to and including termination, for violations of HIPAA regulations and/or applicable rules and policies relating to HIPAA. Disciplinary procedures differ among the various classes of employees at UW–Madison. Please see below:
- Faculty Policies and Procedures (See FPP Chapter 9)
- Academic Staff Policies and Procedures (See ASPP Chapter 6)
- Classified Staff Policies and Procedures (See Chapter 18)