HIPAA for Professionals

To improve the efficiency and effectiveness of the healthcare system, the Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, included Administrative Simplification provisions that required HHS to adopt national standards for electronic healthcare transactions and code sets, unique health identifiers, and security. At the same time, Congress recognized that advances in electronic technology could erode the privacy of health information. Consequently, Congress incorporated HIPAA provisions that mandated the adoption of Federal privacy protections for individually identifiable health information.

• HHS published a final Privacy Rule in December 2000, which was later modified in August 2002. This Rule set national standards for the protection of individually identifiable health information by three types of covered entities: health plans, healthcare clearinghouses, and healthcare providers who conduct standard healthcare transactions electronically.  Compliance with the Privacy Rule was required as of April 14, 2003 (April 14, 2004, for small health plans).

• HHS published a final Security Rule in February 2003. This Rule sets national standards for protecting the confidentiality, integrity, and availability of electronic protected health information. Compliance with the Security Rule was required as of April 20, 2005 (April 20, 2006, for small health plans).

• The Enforcement Rule provides standards for the enforcement of all the Administrative Simplification Rules.

• HHS enacted a final Omnibus rule that implements a number of provisions of the HITECH Act to strengthen the privacy and security protections for health information established under HIPAA, finalizing the Breach Notification Rule.

• View the Combined Regulation Text - PDF (as of March 2013). This is an unofficial version that presents all the HIPAA regulatory standards in one document. The official version of all federal regulations is published in the Code of Federal Regulations (CFR). View the official versions at 45 C.F.R. Part 160 - PDF, Part 162 - PDF, and Part 164 - PDF.

Other HIPAA Administrative Simplification Rules are administered and enforced by the Centers for Medicare & Medicaid Services and include:
Transactions and Code Sets Standards
Employer Identifier Standard
National Provider Identifier Standard

Want to learn more about the HIPAA Privacy & Security Rules?   Sign Up for the OCR Privacy & Security Listservs

OCR has established two listservs to inform the public about health information privacy and security FAQs, guidance, and technical assistance materials. We encourage you to sign up and stay informed!

Personal Information and Public Records

You may be asked or required to submit information that You consider Personal Information (including as defined below) as part of using a Site or using services available through a Site. For purposes of Your use of the Sites and services, we consider "Personal Information" to be information about a person that is readily identifiable to that individual, such as an individual's name, address, and telephone number. Personal information is collected when consistent with the intent of statute, state policies, and business needs. Personal Information may be exempt from disclosure if disclosure would constitute an unreasonable invasion of privacy under the circumstances. Most information collected by state government is assumed to be open to the public unless specifically exempted. ORS Chapter 192 contains the Oregon Public Records Law. Under this law, individuals are permitted to request that public officials not disclose a public record that contains their home address and telephone number under certain circumstances. ORS 192.445 specifies how to request non-disclosure.

Privacy Policy for Text Messages

We respect your privacy. Your phone number will be used exclusively to send you messages you opted to receive as per your consent. We do not sell or share your personal information to third parties. You can opt out of receiving these messages anytime by replying with "STOP" to any of our SMS communications.

Children’s Online Privacy Protection Act

The Sites and services are not designed for, or targeted to reach, children under 13. Children under the age of 13 are not eligible to use services that require submission of Personal Information and should not submit any personal information through a Site, which includes submitting Personal Information to a Site for a user or personalization profile. If You are a child under the age of 13, You can only set up user profiles or submit Personal Information together with your parent(s) or guardian(s). Please seek guidance from your parent(s) or guardian(s) if you are under the age of 13. If an Oregon agency opts to collect Personal Information from children under the age of 13 through a Site, the agency collecting the information will provide notice and follow processes in conformance with the Children’s Online Privacy Protection Act (COPPA). For more information on COPPA, please see: https://www.consumer.ftc.gov/articles/0031-protecting-your-childs-privacy-online.

Information collected while browsing Site web pages

If you browse or download information from a Site, HarlanMS collects the information below as the standard data collected by all web server software. That collected information is:

1. The Internet Protocol (IP) address of a user connection (but not an email address). The IP address is a numerical identifier assigned either to an internet service provider or directly to a user’s computer. The IP address is used to respond to a browser request. An IP Address is a numerical label, in the format xxx.xxx.xx.xx, used for network interface or location addressing.

2. The domain name is assigned to an IP address (if there is one). Example: somename.com

3. The type of browser and operating system used. Example: Mozilla/4.0 (compatible; MSIE 4.01; Windows NT; IE4WDUS-1998101501)

4. The date and time a user visited a Site

5. The web pages or services a user accessed at the Site

6. The website a user visited before coming to a Site. (Note: this is included so that summary analysis can be done on how visitors get to our site, i.e., from a search engine, from a link on another site, etc.)

Generally, Sites do not track individual user navigation choices, and the information listed above is summarized to determine:

1. What organizations are our most frequent users (item 2 above) to better target our content for the audience

2. What browsers are being used on our site to determine what techniques we should use to develop pages that will work with different browsers (item 3 above).

3. How often our pages are being visited (item 5 above)

4. The traffic from organization names such as search engines that direct people to the site (item 6 above)

Some Sites, however, may ask to collect information of an individual to provide services or conduct transactions. Please see Use of Personal Information. For information security purposes and to ensure Sites and services remain available to users, network traffic is monitored to identify unauthorized attempts to upload or change information, or otherwise cause damage. If security monitoring reveals evidence of possible abuse or criminal activity, system personnel may provide the results of such monitoring to appropriate officials. Except for investigations authorized by law, no attempts are made to identify individual users or their usage habits. Unauthorized attempts to upload information or change information on the Sites are strictly prohibited and may be punishable under state law and federal statutes, including the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure Protection Act of 1996.

Use of Personal Information

Some HarlanMS sites may collect Personal Information to deliver services or conduct transactions. You have the right to review your Personal Information collected by any of the Sites by contacting HarlanMS, who provided the service you requested. Personal Information collected during an online transaction is used for, but not limited to, the following purposes:

1. Create user accounts or complete online transactions, on a site hosted on harlanms.org.

2. Send an email or otherwise contact the individual to confirm a transaction or identify and resolve problems that occurred during the transaction; or

3. Provide information about services, or about HarlanMS to visitors who elect to receive this notification service.

4. Conduct occasional online surveys to improve Site operation or seek the opinions of users. These surveys are entirely voluntary and You may easily decline to participate.

Secure Transmission

This site uses the industry standard encryption software Secure Socket Layer (SSL) to enable secure transmission of data. The URL in your browser will change to "HTTPS" instead of "HTTP" when this security feature is invoked. Your browser may also display a lock or key symbol on its task bar to indicate invoked secure transmission. If these indicators are not present, information may be susceptible to interception by other parties. Most internet email communication is not considered secure. If you are communicating sensitive information, consider sending it by postal mail or contacting the agency by phone.

Cookies

A cookie is a small text file created by a web server and stored on your computer's hard drive. Cookies save unique information that the web server can access while you are browsing our website. Typically, cookies save information such as your site preferences, the date you last looked at a specific page, or a random number used to identify your particular web session. Cookies help us measure how many visitors come to our website and how many of these visitors are new or returning. Cookies placed on your computer by our web management tools are written so they can only be used by our web tools, and they only retrieve specific information. We do not gather information from you, from other cookie files, or access any other information on your computer. Most web browsers allow you to deny or accept the cookie feature (refer to your browser's help function for details). You can control the use of cookies on your computer, and even eliminate them. However, eliminating cookie use may interfere with the function of some HarlanMS.org website services.

Social Media Terms

Some HarlanMS agencies operate accounts on popular internet platforms intended for the sharing or creation of information or expression of opinions, for example: Facebook, Instagram, Twitter, or YouTube (“Social Media”). Agencies that operate Social Media accounts do so for various purposes, including but not limited to providing timely information about events or incidents of public interest, maintaining transparency about the agency’s operations, or sustaining public relations. These social media terms apply as the minimum standards for your engagement with a HarlanMS agency’s social media account, in addition to the policies or use terms that you agreed to with each social media platform. Please note that an agency may supplement these Social Media Terms with additional terms or may have their policies altogether which are not included here.

User Content

Depending on the Social Media platform, an agency may, at its sole discretion, permit the submission of comments, opinions, files, images, materials, pictures, or other content (“User Content”) by You to the agency’s Social Media account page for display or other purposes. Submission of User Content to an agency’s Social Media account page is subject to the following:

1. You represent and warrant: (1) You have the rights necessary in the User Content to allow the agency to display, post, or otherwise use the User Content, and (2) The User Content is not subject to any obligation of confidentiality,

2. You grant non-exclusive, royalty-free, worldwide rights for the display or any other uses of the User Content to HarlanMS and its agencies, including for purposes, uses, or displays different from the context or intent of the initial submission on a Social Media platform.

3. You agree that allowing the display of User Content is not an endorsement by either HarlanMS or its agencies of that User Content or the opinions expressed in the User Content;

4. You acknowledge and agree that neither HarlanMS nor its agencies are required to moderate User Content whether submitted by you or other users, and that neither HarlanMS nor its agencies assume any liability for the User Content under any legal theory of any jurisdiction.

5. You further acknowledge and agree that within the functional capabilities of the Social Media platform and subject to Oregon public records requirements, HarlanMS has the sole discretion to (1) delete User Content with language HarlanMS or the Agency deems offensive, abusive, derogatory, or threatening harm to other people or property, (2) block users who are or have submitted such User Content, and (3) to conduct such removal without prior notice.

Disclaimers and Other Legal Notices

Links to other sites

The Sites may have links to third-party websites operated by other agencies, nonprofit organizations, private businesses, and other entities. When you use and follow one of these links, you are no longer on a HarlanMS Site and these terms and Conditions will not apply and your use of those third-party sites is subject to their privacy policy, terms and conditions, or terms of use. All links to third-party websites are provided for Your convenience. Neither HarlanMS nor any of its agencies, officers, or employees of Harlan Medical Services LLC warrant or represent the accuracy, reliability, or timeliness of any information published by these third-party sites, nor do they endorse any content, viewpoints, products, or services linked from these systems, and therefore cannot be held liable for any losses caused by reliance on the accuracy, reliability or timeliness of the information on these third-party sites. Portions of such information may be incorrect or not current and any person or entity that relies on any information obtained from these third-party sites does so at their own risk.

Advertising on Top Level Domain “HarlanMS.org”

Advertising by private entities is prohibited on websites hosted on the top-level domain “harlanms.org”. Neither HarlanMS nor its agencies endorse or sponsor the products, services or information appearing in advertisements on privately owned websites.

Trademarks

HarlanMS-Owned Trademarks – Some of the content on harlanms.org and other Sites include trademarks owned by Harlan Medical Services LLC or its agencies.

Third-Party Trademarks - Some of the content on harlanms.org and other Sites may include names, tradenames, or trademarks owned by third parties which are the property of their respective owners. The appearance or inclusion of these third-party trademarks is not an endorsement by HarlanMS or its agencies of the products or services sold under those third-party trademarks. Nothing in these Terms and Conditions grants you any rights in those trademarks.

Digital Millennium Copyright Act (DMCA) Notice

If you believe there is content appearing on HarlanMS.org or any of the Sites that infringes your copyright, you may send a copy of your claim to office@harlanms.org. To be an effective notice, however, your claim must be in writing and contain the following information:

• Physical or electronic signature of a person authorized to act on behalf of the owner of an exclusive right that is allegedly infringed;

• Identification of the copyrighted work claimed to have been infringed and that is sought to be removed or have access disabled.

• This identification must be specific enough to permit location of the material;

• Contact information at which the owner of the material (and owner’s agent for the complaint, if applicable) may be contacted;

• A statement that the complaining party has a good faith belief that use of the material in the manner complained of is not authorized by the copyright owner, its agent, or the law; and

• A statement, made under penalty of perjury, that the information in the notification is accurate and that the complaining party is authorized to act on behalf of the owner of an exclusive right that is allegedly infringed.​