Printable Version (HTML)

Table of Contents

Statement of Policy
Reason for Policy
Who Should Know This Policy
Related Documents
Contacts
Definitions
Procedures
Responsibilities

Statement of Policy

Purdue University endeavors to preserve the privacy and confidentiality of the protected health information and medical records maintained by its various schools and departments. It strives to fulfill this responsibility in accordance with state and federal statutes and regulations. Further, Purdue acknowledges its general obligations of trust and confidentiality reposed in its employees and students who are responsible for medical or mental health treatment at the University. As a hybrid entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Purdue will ensure that its designated “covered components” comply fully with the requirements of 45 C.F.R. Parts 160, 164, which are the HIPAA Privacy Regulations.

Declaration of Hybrid Entity Status and Designation of Covered Components

Purdue University is a hybrid entity under the HIPAA Privacy Regulations. Purdue’s primary purpose is education; however, Purdue does have departments and covered components that provide covered healthcare services, and Purdue has self-insured health plans. Purdue also has offices or departments that provide business support to the healthcare provider and health plan covered components, and these business support offices or departments have or may have access to protected medical and health information. Purdue University, therefore, has surveyed its departments to identify and designate its covered components. Designated covered components at the writing of this policy include the following:

Healthcare Provider Covered Components –

1. Purdue Student Health Center
2. Purdue Pharmacy
3. Purdue's School of Nursing Nursing Centers
4. Purdue's SLHS Audiology and Speech-Language Clinics
5. Lafayette Street Family Planning Clinic
6. IPFW Dental Hygiene Clinic
7. Lafayette Street Dental Clinic

Health Plan Covered Components –

1. Medical Benefits Plan(s)
2. Vision Plan
3. Pharmacy Plan(s)
4. Health Care Flexible Spending Account Plan
5. Employee Assistance Programs
6. Employee Wellness
7. WorkLife

Business Support Covered Components –

1. Accounts Receivable
2. E-Commerce & Credit Card Operations
3. Central Files
4. Internal Audit
5. Information Technology at Purdue (only the following areas):
   • Infrastructure Operations - Production Services
   • UNIX Platform Administration
   • Windows Platform Administration
   • Infrastructure Systems - Database Administration
   • Customer Relations - Desktop Computing Support
   • Enterprise Applications
   • Security & Privacy
   • ITap Customer Service Center
6. Public Records Office
7. Printing Services
8. School of Nursing Business Office
9. Insurance Services Enterprise
10. OnePurdue Initiative
11. Environmental Health
12. Pharmacy, Nursing and Health Sciences Technical Services
13. IPFW School of Health Sciences Business Office
14. Student Services Workstation Technology
15. Business Services Computing
16. IPFW Information Technology Services
17. Calumet Computing Technology and Information Services
18. North Central Information Services
19. North Central Accounting
20. RCHE-Health Outcomes and Policy Research Center
21. SLHS Business and Main Offices
22. SLHS Electronics and Technical Support
    

The full list of covered components at Purdue University may be found at the following Web site:  www.purdue.edu/hipaa. 

Reason for Policy

Effective April 14, 2003, Purdue University’s covered components are required to comply with the HIPAA Privacy Regulations. Purdue University adopts this policy to ensure such compliance.

Who Should Know This Policy

• Notice(s) of Privacy Practices for Purdue's healthcare provider covered components
  and related business support covered components
• Notice of Privacy Practices for Purdue's health plan covered components and related business support covered components
• Notice of Privacy Practices for Purdue's School of Nursing Nursing Centers
• Notice of Privacy Practices for Purdue's Lafayette Street Family Planning Clinic
• Notice of Privacy Practices for Purdue Fort Wayne Dental Clinics
• Privacy Complaint Form (PDF)

Contacts

Definitions

Procedures

Notices of Privacy Practices

Notices of Privacy Practices will specify how Purdue uses and discloses protected health information. The notices will be revised as needed.

Each covered component will distribute the applicable Notice of Privacy Practices to all of its affected patients and employees. Notices will also be posted on the Purdue University Web site and at each primary entrance or area of each applicable covered component. Staff of each covered component will be familiar with the applicable notice(s) and will comply with the practices described in the notice(s).

Designation of Additional Covered Components

Additional covered components may be designated by the privacy officer after the effective date of this policy, depending upon the services they provide and how they transact business and transmit information. The privacy officer will monitor the activities of the various departments and campuses and will update or modify the list of designated covered components as needed. An updated list of covered components shall be reflected in the Notice(s) of Privacy Practices and shall also be posted on the Purdue web site and available upon request from the privacy officer.

Addressing and Resolving Privacy Complaints

The privacy officer will develop and distribute a Privacy Complaint Form. All covered components will use the form for purposes of receiving complaints regarding Purdue’s privacy practices and compliance with the HIPAA Privacy Regulations. The form will direct the user to submit the completed form to the privacy officer at the location provided on the form. The form will also provide information about how the user may file a complaint directly with the Department of Health and Human Services.

Upon receipt of a completed Privacy Complaint Form, the privacy officer will immediately forward a copy of the form to the appropriate personnel in the affected covered component and request an investigation. The privacy officer or his or her designee will work with the affected covered component to fully investigate and respond to the complaint.

Responsibilities

Covered Components

Each covered component will develop and implement procedures to ensure the security and privacy of protected health information and to ensure compliance with this policy and the HIPAA Privacy Regulations. Each covered component will work with the privacy officer to develop appropriate procedures and train its personnel regarding the procedures. The department head or director of each covered component and the privacy officer must approve all procedures prior to implementation.

Privacy Officer

The privacy officer will develop and implement policies and procedures to ensure the University complies with the HIPAA Privacy Regulations. The privacy officer will ensure that all affected employees and students are trained and will receive, investigate, and resolve any privacy complaints received by Purdue University.

The privacy officer will oversee the development of Notice(s) of Privacy Practices for Purdue’s covered components that provide healthcare services and for Purdue’s covered health plans. The privacy officer will develop a Privacy Complaint Form for University-wide use.

In addition, the privacy officer, in consultation with legal counsel as needed, will develop and distribute other appropriate forms required by the HIPAA Privacy Regulations. These include, but are not limited to, individual authorizations, appropriate business associate agreements, employee and student confidentiality agreements, limited data set agreements, chain of trust agreements, and research authorizations.

The privacy officer may assign other persons to assist with any of these responsibilities and may designate someone to act as privacy officer at the regional campuses or in the absence or unavailability of the privacy officer.