Domain L: Direct Privacy Rule Obligations of a Covered Entity
A covered entity's own direct Privacy Rule duties to patients, notice, access, amendment, and accounting, that a Business Associate never carries itself.
This domain applies only to HIPAA Covered Entities (health care providers, health plans, and clearinghouses). A Business Associate has its own, narrower duty to support these obligations, not to carry them out directly. Not sure which one you are? Our onboarding wizard figures it out from a few factual questions rather than asking you to guess.
Every item here comes from the HIPAA Privacy Rule, not the Security Rule the other domains cover.
Notice of Privacy Practices developed, provided at first service delivery (or as otherwise required), and posted; good-faith effort made to obtain written acknowledgment of receipt for a direct treatment relationship
45 C.F.R. §164.520 · Source: www.ecfr.gov/current/title-45/section-164.520
Minimum-necessary standard applied as the covered entity's own comprehensive policy governing routine and non-routine PHI uses, disclosures, and requests -- broader than the narrow business-associate duty in Domain I
45 C.F.R. §164.502(b); 164.514(d) · Source: www.ecfr.gov/current/title-45/section-164.502
Written, HIPAA-compliant authorization obtained before any use or disclosure of PHI not otherwise permitted for treatment, payment, health care operations, or another Privacy Rule exception
45 C.F.R. §164.508 · Source: www.ecfr.gov/current/title-45/section-164.508
Process to receive, verify the requester's identity for, and respond to an individual's request to access, inspect, or obtain a copy of their PHI within the required timeframe
45 C.F.R. §164.524 · Source: www.ecfr.gov/current/title-45/section-164.524
Process to receive and act on an individual's request to amend their PHI, including a timely acceptance or denial and the required documentation
45 C.F.R. §164.526 · Source: www.ecfr.gov/current/title-45/section-164.526
Process to track disclosures of PHI and produce an accounting of disclosures on an individual's request
45 C.F.R. §164.528 · Source: www.ecfr.gov/current/title-45/section-164.528
Privacy Official designated as responsible for privacy policies and procedures, and a contact person named to receive complaints and questions about the Notice, both documented
45 C.F.R. §164.530(a) · Source: www.ecfr.gov/current/title-45/section-164.530
Every workforce member trained on the privacy policies and procedures relevant to their role: new members within a reasonable period after joining, all affected members after a material change, with completion documented
45 C.F.R. §164.530(b) · Source: www.ecfr.gov/current/title-45/section-164.530
Complaint process available to individuals and described in the Notice; complaints and their disposition documented; no intimidation, retaliation, or waiver of rights as a condition of treatment, payment, enrollment, or eligibility
45 C.F.R. §164.530(d); 164.530(g); 164.530(h) · Source: www.ecfr.gov/current/title-45/section-164.530
Requests to restrict uses or disclosures considered and documented, the restriction on disclosure to a health plan for a service paid in full out of pocket always granted, and reasonable requests for confidential communications accommodated
45 C.F.R. §164.522 · Source: www.ecfr.gov/current/title-45/section-164.522
Harmful effects of a known use or disclosure in violation of policy or the Privacy Rule mitigated to the extent practicable, and privacy documentation retained for six years
45 C.F.R. §164.530(f); 164.530(j) · Source: www.ecfr.gov/current/title-45/section-164.530