Privacy Laws & Regulatory Compliance

Personally identifiable info (PII)

Any data containing unique identifier that can be used to ID individual.

PII Best Practices

a.     Train employees to recognize non-PII data can become PII whenever additional info is made publicly available.

b.     Require all employees & contractors to complete privacy training yearly, within set time after employment.

Personal Health Information (PHI)

Applies to specific orgs that create & collect health info, as covered under Privacy Rule of Health Insurance Portability & Accountability Act (HIPAA).

Privacy Rule of HIPAA

Regulates use & disclosure of PHI for orgs.

1.   Orgs must disclose PHI to individuals within 30 days.

2.   Notify individuals of their PHI

3.   Written authorization required before disclosing PHI for treatment / payment.

4.   Ensure confidentiality of comm w. individuals

5.   Disclose minimal info to achieve purpose.

6.   Track PHI disclosures & document privacy & policy procedures.

Privacy Policy requirements

a.     List of PII categories operator collects

b.     List of 3^rd party categories with which operator might share PII

c.     Process by which consumers can review & request changes to their PII

d.     Process by which operator notifies consumers of changes to privacy policy.