Yale University HIPAA Security Policy & Guidelines

ATTENTION:

HIPAA Security Updates and Reminders, Effective Immediately

Yale has updated its HIPAA Policies and Guidelines. All faculty and staff members, trainees, students and others in Yale University HIPAA Covered Components (Yale School of Medicine (excluding the School of  Public Health, the Animal Resources Center, and the basic science departments: Cell Biology, Cellular and Molecular Physiology, Comparative Medicine, History of Medicine, Immunobiology, Microbial Pathogenesis, MolecularBiophysics & Biochemistry, Neurobiology, and Pharmacology), Yale School of Nursing, University Health Services, Department of Psychology Clinics and the Group Health Plan component) must comply with all University HIPAA policies including these updates.

Please review and familiarize yourself with these updates.

Federal law now requires that information security breaches ¹ involving protected health information be reported to the affected patients, the federal government, and, in some cases, the media.

Notify Yale IMMEDIATELY of all events that might be potential breaches!

Call 203-627-4665 if you believe ePHI/PHI might have been lost, stolen, compromised, misdirected, etc. Yale HIPAA professionals will work with you to determine the next steps, and whether the event requires notification.

Anyone else wishing to report a HIPAA concern should call 203-432-5919. 

Safe Harbor: It won‘t apply to most

If an environment has established ‘Safe Harbor,’ notification is not required. Safe Harbor is defined by the HITECH Act as either:

• Securely removing all PHI from personal computing devices including hard drives, storage media, portable devices and Email
  OR
• Encrypting all stored and transmitted PHI

HIPAA Security Policy & Guidelines

Yale University is committed to providing the highest quality health care, which includes respecting patients’ and clinical research subjects’ rights to maintain the privacy of their health information. The standards for protecting patient health information are described in the federal law known as the Health Insurance Portability and Accountability Act (HIPAA). Yale’s HIPAA policies are designed to ensure the appropriate security of all patient health information across the University, in compliance with the law.

Yale’s HIPAA policies apply to all faculty, staff, trainees, students and others in Yale University HIPAA Covered Components: the Schools of Medicine (excluding the School of  Public Health, the Animal Resources Center, and the basic science departments: Cell Biology, Cellular and Molecular Physiology, Comparative Medicine, History of Medicine, Immunobiology, Microbial Pathogenesis, MolecularBiophysics & Biochemistry, Neurobiology, and Pharmacology) and Nursing, University Health Services, Department of Psychology clinics and the Group Health Plan Component.

You are responsible for complying with these policies.

¹In general, a “breach” is an unauthorized acquisition, use, or disclosure of protected health information that poses a significant risk of financial, reputational, or other harm to the affected individual..

Image: Detail from Port on a stormy day, George Chambers, 1835, Oil on canvas, Yale Center for British Art, Paul Mellon Collection