Page 58 - Privacy_Program

Director of Information DP120A.6d (d) a statement that the covered entity is required to abide by the terms of the
Technology, Privacy and notice that is currently in effect;
Data Security
Director of Information DP120A.6e (e) a statement indicating that, for PHI that it created or received prior to issuing
Technology, Privacy and a revised notice, the organization reserves the right to change the terms of its
Data Security notice and to make the new notice provisions effective for all privacy restricted
information that it maintains;
Director of Information DP120A.6f (f) a statement that the organization will promptly revise and distribute its
Technology, Privacy and notice whenever there is a material change to the uses or disclosures, the
Data Security individual’s rights, the covered entity’s legal duties, or other privacy practices
stated in the notice, and how it will provide individuals with the revised notice;
Director of Information DP120A.6g (g) a statement that individuals may complain to the organization and to the
Technology, Privacy and Department of Health and Human Services if they believe their privacy rights
Data Security have been violated;
Director of Information DP120A.6h (h) a brief description of how an individual may file a complaint with the
Technology, Privacy and organization;
Data Security
Director of Information DP120A.6i (i) a statement that the organization will not retaliate against the individual for
Technology, Privacy and filing a complaint;
Data Security
Director of Information DP120A.6j (j) the name, or title, and telephone number of a person or office within the
Technology, Privacy and organization to contact for further information concerning the Notice of Privacy
Data Security Practices;
Director of Information DP120A.6k (k) the date on which the notice is first in effect, which is not to be earlier than
Technology, Privacy and the date on which the notice is printed or otherwise published.
Data Security
Director of Information DP120A.7 If applicable, the description in the notice of the types of uses and disclosures
Technology, Privacy and that the organization is permitted to make for purposes of treatment, payment,
Data Security and health care operations must also include a separate statement indicating
that:
Director of Information DP120A.7a (a) the organization may contact the individual to raise funds for the covered
Technology, Privacy and entity
Data Security
Director of Information DP120A.7b (b) the organization may contact the individual to provide appointment
Technology, Privacy and reminders or information about treatment alternatives or other health‐related
Data Security benefits and services that may be of interest to the individual.
Director of Information DP120A.8 If the organization chooses to apply and describe more limited uses or disclosure
Technology, Privacy and in its notice than required under 45 C.F.R. Part 164, then it will ensure that it does
Data Security not include in the notice a limitation affecting its right to make a use or disclosure
that is required by law or permitted to avert a serious threat to health and safety.
Director of Information DP120A.9 The organization will promptly revise and redistribute its notice whenever there
Technology, Privacy and is a material change to the uses or disclosures, the individual’s rights, the
Data Security organization’ legal duties, or other privacy practices stated in the notice.
Director of Information DP120A.10 The organization will not implement a change to any term of the notice that
Technology, Privacy and would materially reduce the privacy protections of covered individuals prior to
Data Security the effective date of the notice in which such material change is reflected, except
when required by law.
Employees and others DP120A.11 Knowledge of a violation or potential violation of this policy must be reported
with Access to PHI directly to the Director of Information Technology, Privacy and Data Security.

GES CONFIDENTIAL 54