Any valid Authorization signed by the Individual, in the event that the Callier Center may presently Use or Disclose the covered individual\u2019s PHI is reliant on such Authorization. An Authorization that has expired, been revoked, or otherwise been determined to be invalid shall be removed from the Individual\u2019s Designated Record Set.<\/p>\n\n\n\n
b. Determination to Treat a Person as a Personal Representative<\/strong><\/p>\n\n\n\n Documentation of any determination by the Privacy Officer to treat a person as the covered individual\u2019s personal representative in accordance with this Manual. Such documentation shall be removed from the individual\u2019s Designated Record Set in the event that the Privacy Officer determines that such person is no longer the Individual\u2019s Personal Representative.<\/p>\n\n\n\n c. Restrictions on Uses and Disclosures<\/strong><\/p>\n\n\n\n Any restriction on the Center\u2019s Use or Disclosure of the Individual\u2019s PHI to which the Individual has agreed. A restriction shall be removed from the Individual\u2019s Designated Record Set in the event that it ceases to be effective.<\/p>\n\n\n\n d. Confidential Communications<\/strong><\/p>\n\n\n\n Any request for confidential communications applicable to Disclosures of PHI to the Individual to which the Center has agreed, along with any other applicable documentation required by the Policy on such communications.<\/p>\n\n\n\n e. Data Use Agreements<\/strong><\/p>\n\n\n\n Any Data Use Agreement to which the Center has agreed in order to receive a Limited Data Set. A Data Use Agreement shall be removed from the Individual\u2019s Designated Record Set in the event that the Center no longer maintains the applicable Limited Data Set.<\/p>\n\n\n\n a. Accounted Disclosures of PHI<\/strong><\/p>\n\n\n\n Disclosures of the Patients PHI with descriptions that must be documented for an Accounting Disclosure shall be retained at least until the date that is 6 years after the date on which the Disclosure occurred.<\/p>\n\n\n\n b. Suspension of Disclosure\u2019s Inclusion in Accounting<\/strong><\/p>\n\n\n\n Any statements by a Health Oversight Agency or law enforcement official that result in the suspension of inclusion in an accounting of disclosures of a Disclosure of the individual\u2019s PHI. Such documentation shall be retained at least until the date that is 6 years after the expiration of the time period during which the applicable Disclosures would be excluded from any accountings requested.<\/p>\n\n\n\n c. Any Requests for a Patient\u2019s Entire Medical Record<\/strong><\/p>\n\n\n\n Such documentation shall be retained at least until the date that is 6 years after the date of the request.<\/p>\n\n\n\n d. Uses or Disclosures of Entire Medical Record<\/strong><\/p>\n\n\n\n Such documentation shall be retained at least until the date that is 6 years after the date of the Use or Disclosure.<\/p>\n\n\n\n e. Determinations of Personal Representatives<\/strong><\/p>\n\n\n\n Any determination regarding whether a person is the Individual\u2019s personal representative. Such documentation shall be retained at least until the date that is 6 years after the later of the determination date or, if the Privacy Officer determines the person is no longer the Personal Representative, the date on which such determination ceases to be effective.<\/p>\n\n\n\n f. Authorizations<\/strong><\/p>\n\n\n\n Any Authorization received for the Center\u2019s Use or Disclosure of the individual\u2019s PHI. Such documentation shall be retained at least until the date that is 6 years after the date on which the Authorization expires or is revoked.<\/p>\n\n\n\n g. Notification Disclosures<\/strong><\/p>\n\n\n\n If the Privacy Officer approves a Notification Disclosure concerning the individual the reasons for the determination that such Notification Disclosure is permissible. Such documentation shall be retained at least until the date that is 6 years after the date of disclosure.<\/p>\n\n\n\n h. Dates of Provision of a Notice<\/strong><\/p>\n\n\n\n A log of the dates on which an individual requests a copy of the notice of privacy practices and the dates on which s\/he receives a copy. Documentation of each date shall be retained at least until the date that is 6 years after the date documented.<\/p>\n\n\n\n i. Requests for Access<\/strong><\/p>\n\n\n\n All documents relating to a request for access shall be retained at least until the date that is 6 years after the date on which the last document attributable to the applicable request for access was created.<\/p>\n\n\n\n j. Requests for Amendment<\/strong><\/p>\n\n\n\n The documents relating to a Patients request for amendment of the Designated Record Set. All such documents shall be retained at least until the date that is 6 years after the date on which the last document attributable to the applicable request for amendment was created.<\/p>\n\n\n\n k. Requests for Accounting<\/strong><\/p>\n\n\n\n The documents relating to the Individual\u2019s request for accounting. All such documents shall be retained at least until the date that is 6 years after the date the applicable accounting is provided.<\/p>\n\n\n\n l. Requests for Restriction on Use or Disclosure of PHI<\/strong><\/p>\n\n\n\n The documents relating to the individual\u2019s request for restriction. All such documents, if attributable to a granted request, shall be retained at least until the date that is 6 years after the date on which the respective restriction is no longer effective. All such documents, if attributable to a denied request, shall be retained at least until the date that is 6 years after the date of denial.<\/p>\n\n\n\n m. Requests for Confidential Communications<\/strong><\/p>\n\n\n\n The documents described relating to an Individual\u2019s request for confidential communications. All such documents, if attributable to a granted request, shall be retained at least until the date that is 6 years after the date on which the alternate communications are no longer in effect. All such documents, if attributable to a denied request, shall be retained at least until the date that is 6 years after the notification of denial.<\/p>\n\n\n\n n. Notification of Complaint Disposition<\/strong><\/p>\n\n\n\n Any notification that is sent to a person regarding the disposition of a complaint made by that person. Such notification shall be retained at least until the date that is 6 years after the date on which it is given.<\/p>\n\n\n\n a. Policies and Procedures<\/strong><\/p>\n\n\n\n The current written policies and procedures set forth in this Manual and, any written policies and procedures that are no longer in effect. A superseded Section of the policies and procedures shall be retained at least until the date that is 6 years after the date it became superseded.<\/p>\n\n\n\n b. Notices of Privacy Practices<\/strong><\/p>\n\n\n\n The Callier Center\u2019s current version of the Notice of Privacy Practices and any former version that is no longer in effect. A former version shall be retained at least until the date that is 6 years after the date it was revised.<\/p>\n\n\n\n c. Business Associate Contract Provisions<\/strong><\/p>\n\n\n\n The provisions of contracts with a Business Associate. Documentation of such contractual provisions shall be retained at least until the date that is 6 years after the date on which the provisions cease to be effective.<\/p>\n\n\n\n e. Data Use Agreements<\/strong><\/p>\n\n\n\n Data Use Agreements shall be retained at least until the date that is 6 years after the date on which it ceases to be effective.<\/p>\n\n\n\n f. Designation of Privacy Officer<\/strong><\/p>\n\n\n\n Documents identifying Callier Center\u2019s Privacy Officer. Such documentation shall be retained at least until the date that is 6 years after the date on which the identified person or office ceases to be the Privacy Officer.<\/p>\n\n\n\n g. Disposition of Complaints<\/strong><\/p>\n\n\n\n Documentation of a complaint received and its disposition. Such documentation shall be retained at least until the date that is 6 years after the date on which it is created.<\/p>\n\n\n\n h. Secretary Investigations<\/strong><\/p>\n\n\n\n Any written communications with the Secretary regarding University\u2019s privacy policies and procedures. Each such document shall be retained at least until the date that is 6 years after the date on which it was created.<\/p>\n\n\n\n i. Mitigation Effort<\/strong><\/p>\n\n\n\n Documentation of the Center\u2019s efforts to mitigate the harmful effects of a privacy violation. Such documentation shall be retained at least until the date that is 6 years after the date on which it is created.<\/p>\n\n\n\n j. Breach Notification Rule Compliance<\/strong><\/p>\n\n\n\n All documents and records pertaining to any Breach requiring a notification, including samples of all notices provided to Individuals and all reports made to the Secretary.<\/p>\n\n\n\n a. Privacy Training<\/strong><\/p>\n\n\n\n Documentation of privacy training received by all Workforce members and any signed PHI confidentiality agreements. Such documentation shall be retained at least until the date that is 6 years after the person\u2019s date of termination of employment or, if not an employee, any other involvement with the University as a Workforce Member.<\/p>\n\n\n\n b. Sanctions<\/strong><\/p>\n\n\n\n Description of any sanctions considered against an employee or Workforce member in accordance with this Manual, whether or not imposed. Information that identifies the Individual whose privacy rights were violated shall be removed to the extent practicable. All such documents shall be retained at least until the date that is 6 years after the date on which they were created.<\/p>\n\n\n\n The Callier Center shall promptly revise the policies and procedures in this Manual as necessary and appropriate to comply with changes to the HIPAA Privacy Standards or any other applicable law. The Center may at any time make any revision to the policies and procedures set forth in this Manual, as desirable to improve confidentiality practices, that does not violate the HIPAA Privacy Standards or any other applicable law.<\/p>\n\n\n\n a. The Center shall implement any change to these privacy policies and procedures as of the designated effective date of such change. A change\u2019s effective date cannot occur until (i) the change has been incorporated into the particular policies and procedures in this Manual; and (ii) if the change affects the content of UT Dallas\u2019 Notice of Privacy Practices, the notice has been revised to incorporate such change.<\/p>\n\n\n\n b. If a change to the Center\u2019s privacy policies and procedures is required by law, University shall make a reasonable effort to implement such change by the compliance date of such law. To this end, the Center shall incorporate such change into the particular policies and procedures in this Manual.<\/p>\n\n\n\n Following any material revision of the policies and procedures set forth in this Manual, the Center shall comply with any training obligation applicable under this Manual.<\/p>\n\n\n\n Following a revision to any policies and procedures in this Manual, the Center shall retain a copy of the applicable pre-revision terms of the applicable policies and procedures, including the date on which such terms were superseded. Such documentation shall be retained in accordance with this Section.<\/p>\n\n\n\n HIPAA Regulatory Citations:\u00a0 45 CFR \u00a7 164.316(b), \u00a7 164.310(d) Effective: 04\/14\/2003 Heather Zimmerman, HIPAA Privacy Officer Section 30: Record Keeping and Documentation The Callier Center shall maintain records, either in written or electronic form, of its activities that are conducted in accordance with this Manual. The Center will maintain accurate and complete documentation of Protected Health Information (PHI). Designated Record Set to Be Maintained for Each Patient A Designated Record Set…<\/p>\n","protected":false},"featured_media":0,"parent":0,"menu_order":29,"template":"","meta":{"schema":"","fname":"","lname":"","position":"","credentials":"","placeID":"","no_match":false,"name":"","company":"","review":"","address":"","city":"","state":"","zip":"","lat":"","lng":"","phone1":"","phone2":"","fax":"","mon1":"","mon2":"","tue1":"","tue2":"","wed1":"","wed2":"","thu1":"","thu2":"","fri1":"","fri2":"","sat1":"","sat2":"","sun1":"","sun2":"","hours-note":"","footnotes":""},"doc_category":[50],"yoast_head":"\nCompliance Records: Maintained for Patient<\/h2>\n\n\n\n
Compliance Records: General Files<\/h2>\n\n\n\n
Records Relating to Personnel<\/h2>\n\n\n\n
Revisions to this Manual<\/h2>\n\n\n\n
Effective Date of Changes to Privacy Policies and Procedures<\/h2>\n\n\n\n
Communication of Changes to the Callier Center Privacy Policies and Procedures<\/h2>\n\n\n\n
Documentation of Revisions to this Manual<\/h2>\n\n\n\n
Revised: 04\/13\/2013
Reviewed: 10\/21\/2022, 03\/30\/2021, 12\/08\/2015<\/p>\n\n\n\n![\"\"](\"https:\/\/calliercenter.utdallas.edu\/wp-content\/uploads\/2022\/10\/zimmerman.png\")
<\/figure>\n\n\n\n
UT Dallas Callier Center<\/p>\n","protected":false},"excerpt":{"rendered":"