Policies

** NOTE: If you are unable to access PolicyStat through UNC Health, please contact privacy@unchealth.unc.edu and a member of the Privacy team can assist with providing a PDF copy of the policy to you.

Governance: Privacy Policy Applicability Across the UNC Health and UNC School of Medicine

• UNC Health Covered Entity Explained and OHCA and ACE Designations
• Designation of UNC Health Chief Privacy Officer and Chief Security Officer

Protected Health Information (PHI)

• PHI and De-identification of PHI
• Minimum Necessary
• Limited Data Sets

Investigations, Sanctions, Breach Reporting and Whistleblower Protections

• Investigating and Responding to Privacy Incidents and Complaints
• Sanctions for Violations of Privacy Policies
• Duty to Report Suspected Incidents, Duty to Cooperate with Investigation and Duty to Mitigate Harm
• Breach Notification
• Investigation of Complaints by Secretary of the Department of Health and Human Services
• Whistleblowers and Anti-Retaliation Policy

Health Information, Patient Rights and Medical Records

• Personal Representatives
• Retention of the Designated Record Set, the Legal Health Record, and Financial Records
  • Designated Record Set (UNC MC)
• Patient Right of Access to Inspect and Obtain a Copy of PHI
• Physician Access of UNCHCS Medical Records of their Family Members, Friends, and Co-workers
• Right to Request Amendment to PHI
• Right to Accounting of Disclosure
• Right to Request Restrictions on Uses and Disclosures of PHI
• Right to Confidential Communications

• Rights Under the General Data Protection Regulation for EU Citizens Who are Patients of UNCHCS

• Copy Requests and Charges for PHI
• Disposal/Destruction of PHI
• Verificiation of Identity

Transportation of Paper PHI and Transmission of Electronic PHI

• Transportation of PHI on and Off-Site
• Fax Transmission of PHI

Uses and Disclosures of PHI

• Information Blocking
• Notice of Privacy Practices
• Uses and Disclosures of PHI Requiring Authorization
• Uses and Disclosures of PHI Not Requiring Patient Authorization
• Uses and Disclosures of PHI for Marketing
• Use and Disclosure of PHI of Deceased Individuals
• Release of PHI for Workers’ Compensation Purposes
• Use and Disclosure of PHI for Specialized Government Functions
• Public Health Activities – Disclosures of PHI
• Uses and Disclosures: Friends and Family
• Uses and Disclosures of PHI for Fundraising Purposes
• Uses and Disclosures of PHI for Facility Directory Purposes
• Use and Disclosure of Immunization Records
• Sale of PHI
• Verbal Release of PHI
• Verification of Identity

Training

• HIPAA Training for UNC Health Workforce

Business Associates

• Business Associates 

Safeguards

• Information Security
• Administrative, Physical and Technical Safeguards
• Physical Safeguards
• Electronic Patient Information Access and Auditing of Access

Administrative Policies

• Changes in Policies
• Documentation and Retention of Records
• Preemption of State Law