Oklahoma State University Center for Health Sciences
OSU-CHS Centernet

Privacy Policies & Procedures

Section 14 - Transition Provisions

 

Title: Effect of Prior Authorizations Policy: PRV-14.01
Category: HIPAA Compliance Authority: 45 CFR §
HIPAA Section:
164.532(a)
Standard: Effect of Prior Authorizations Responsibility: Health Care Components
Effective Date: 04/14/2003
Download a printable PDF of this policy
Approved by: OSU Legal Counsel Revised: 7/1/2013
Purpose

To establish the effect of prior authorizations.

Policy
  1. Notwithstanding §§164.508 and 164.512(i), OSU may use or disclose protected health information, consistent with paragraphs (2) and (3) of this policy, pursuant to an authorization or other express legal permission obtained from an individual permitting the use or disclosure of protected health information, informed consent of the individual to participate in research, a waiver of informed consent by an IRB, or a waiver of authorization in accordance with § 164.512(i)(1)(i).  §164.532(a)
  2. Effect of Prior Authorization for Purposes Other Than Research - Notwithstanding any provisions in §164.508, OSU may use or disclose protected health information that it created or received prior to the applicable compliance date of the Privacy Rule, April 14, 2003 pursuant to an authorization or other express legal permission obtained from an individual prior to the applicable compliance date of the Privacy Rule, provided that the authorization or other express legal permission specifically permits such use or disclosure and there is no agreed-to restriction in accordance with §164.522(a).  §164.532(b)
  3. Effect of Prior Permission for Research - Notwithstanding any provisions in §§ 164.508 and 164.512(i), OSU may, to the extent allowed by one of the following permissions, use or disclose, for research, protected health information that it created or received either before or after the applicable compliance date of the Privacy Rule, provided that there is no agreed-to restriction in accordance with § 164.522(a), and OSU has obtained, prior to the applicable compliance date, either:  §164.532(c)
    1. An authorization or other express legal permission from an individual to use or disclose protected health information for the research;  §164.532(c)(1)
    2. The informed consent of the individual to participate in the research;  §164.532(c)(2)
    3. A waiver, by an IRB, of informed consent for the research, in accordance with 7 CFR 1c.116(d), 10 CFR 745.116(d), 14 CFR 1230.116(d), 15 CFR 27.116(d), 16 CFR 1028.116(d), 21 CFR 50.24, 22 CFR 225.116(d), 24 CFR 60.116(d), 28 CFR 46.116(d), 32 CFR 219.116(d), 34 CFR 97.116(d), 38 CFR 16.116(d), 40 CFR 26.116(d), 45 CFR 46.116(d), 45 CFR 690.116(d), or 49 CFR 11.116(d), provided that OSU must obtain authorization in accordance with § 164.508 if, after the compliance date, informed consent is sought from an individual participating in the research; or  §164.532(c)(3)
    4. A waiver of authorization in accordance with § 164.512(i)(1)(i).  §164.532(c)(4)
Procedure
  1. OSU shall have authorization as stated in the policy above.
  2. Any authorizations in place before the effective date of April 14, 2003 shall still be valid and carry over.
  3. Any new authorizations since April 14, 2003 shall adhere to all HIPAA standards as outlined in all of OSU’s policies and procedures.

top of page top

 

Title: Effect of Prior Contracts or Other Arrangements with Business Associates Policy: PRV-14.02
Category: HIPAA Compliance Authority: 45 CFR §
HIPAA Section:
164.532(d)
Standard: Effect of Prior Contracts or Other Arrangements with Business Associates Responsibility: Health Care Components
Effective Date: 04/14/2003
Download a printable PDF of this policy
Approved by: OSU Legal Counsel Revised: 7/1/2013
Purpose

To establish the effect of prior contracts with Business Associates before the compliance date.

Policy
  1. Effect of prior contracts or other arrangements with business associates. Notwithstanding any other provisions of this part, OSU, or business associate with respect to a subcontractor, may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf pursuant to a written contract or other written arrangement with such business associate that does not comply with §§ 164.308(b), 164.314(a), 164.502(e), and 164.504(e), only in accordance with paragraph (2) of this policy.  §164.532(d)
  2. Deemed Compliance –   §164.532(e)
    1. Qualification - Notwithstanding other sections of this part, a covered entity, or business associate with respect to a subcontractor, is deemed to be in compliance with the documentation and contract requirements of §§ 164.308(b), 164.314(a), 164.502(e), and 164.504(e), with respect to a particular business associate relationship, for the time period set forth in paragraph (2)(b) of this policy, if:  §164.532(e)(1)
      1. Prior to January 25, 2013, OSU, or business associate with respect to a subcontractor, has entered into and is operating pursuant to a written contract or other written arrangement with the business associate that complies with the applicable provisions of §§ 164.314(a) or 164.504(e) that were in effect on such date; and  §164.532(e)(1)(i)
      2. The contract or other arrangement is not renewed or modified from March 26, 2013, until September 23, 2013.  §164.532(e)(1)(ii)
    1. Limited Deemed Compliance Period - A prior contract or other arrangement that meets the qualification requirements in paragraph (2) of this policy shall be deemed compliant until the earlier of:  §164.532(e)(2)
      1. The date such contract or other arrangement is renewed or modified on or after September 23, 2013; or  §164.532(e)(2)(i)
      2. September 22, 2014.  §164.532(e)(2)(ii)
  1. Covered Entity Responsibilities - Nothing in this section shall alter the requirements of OSU to comply with part 160, subpart C Compliance and Investigations §§ 164.524, 164.526, 164.528, and 164.530(f) with respect to protected health information held by a business associate.  §164.532(e)(3)
  2. Effect of Prior Data Use Agreements - If, prior to January 25, 2013, OSU has entered into and is operating pursuant to a data use agreement with a recipient of a limited data set that complies with § 164.514(e), notwithstanding § 164.502(a)(5)(ii), OSU may continue to disclose a limited data set pursuant to such agreement in exchange for remuneration from or on behalf of the recipient of the protected health information until the earlier of:  §164.532(f)
    1. The date such agreement is renewed or modified on or after September 23, 2013; or  §164.532(f)(1)
    2. September 22, 2014.  §164.532(f)(2)
Procedure
  1. OSU will keep all of its Business Associate Agreements and other contracts or arrangements up to date and within the time frame specified in the policy above.

top of page top

 

OSU-CHS on Facebook OSU-CHS on Twitter OSU Medicine on You Tube