massachusettsexecutiveofficeof.docVIP

Massachusetts Executive Office of Health and Human Services Department of Public Health Department of Public Health Confidentiality Procedures Revised October 1, 2012 MDPH Privacy Office 250 Washington St. Boston, MA 02108 Privacy.DPH@state.ma.us ( Page intentionally blank ) Table of contents Page Summary of Confidentiality Procedure Changes – Change 3 i Summary of Confidentiality Procedure Changes – Change 2 ii Summary of Confidentiality Procedure Changes – Change 1 iii Glossary v Procedure 1 Administrative Requirements 1 PART I. Purpose and Scope 1 PART II. Personnel Designations 1 PART III. Privacy and Confidentiality Training Requirements 1 PART IV. Safeguards for Confidential Information 3 PART V. Complaint Process 3 PART VI. Breaches 3 PART VII. Retaliation Prohibited 4 PART VIII. Required Policy and Procedures 4 PART IX. Employee Acknowledgement 5 Procedure 2 Breaches of Confidential Information 7 PART I. Purpose definitions 7 PART II. Reporting investigation protocols 9 PART III. Notification of Affected Individuals 13 PART IV. Sanctions 14 Procedure 3 Use and Disclosure of Confidential Information 15 PART I. Purpose Definitions 15 PART II. The Collection of Confidential Information 16 PART III. The Use of Confidential Information 16 PART IV. The Disclosure of Confidential Information 17 PART V. Minimum Necessary 19 PART VI. Role-based Access 19 PART VII. Bureau Data Liaison Responsibilities 20 Procedure 4 Authorizations for the Use and Disclosure of Confidential Information 23 PART I. Purpose and definitions 23 PART II. MDPH Authorization Forms: General Requirements 24 PART III. The Authorization Form 24 PART IV. Processing Requests for Confidential Information 25 PART V. Special Rules Governing Authorizations Authorization Forms 27 Procedure 5 Subpoenas or Court Orders 29 PART I. Purpose and Scope 29 PART II. Procedure for Responding to Subpoenas and Court Orders 29 PART III. Establishin