Iowa County/Region Policies and Procedures for Compliance with the Health Insurance Portability and Accountability Act of 1996 - HIPAA

Aug 30, 2026

HIPAA compliance policies and procedures template for Iowa counties and regions, outlining governance and operational requirements under the Health Insurance Portability and Accountability Act of 1996. Includes guidance for designating covered entities and roles, managing HIPAA records, and implementing a privacy manual covering permitted uses and disclosures of PHI, individual rights, authorizations, complaints, and data protections such as de-identified data and limited data sets. Provides breach notification tools, business associate requirements, and security manual controls spanning risk analysis, safeguards, workforce clearance, training, and security monitoring, updated through later amendments.

LanguageEnglish

CategoryForms

FormatDOCX

Pages262

Reading Time1 h 32 min

AccessFree to download

Workforce Designation

Hybrid Entity Designation

Affiliated Covered Entity Designation

HIPAA Record Retention Policy

HIPAA Privacy Manual

Overview: Handling Uses and Disclosures of PHI

Iowa Laws Requiring Greater Protections Policy

Accessing PHI Policy

Individual Request for PHI

Notice of Decision Regarding Individual Request for PHI

Documentation Policy

Accounting of Disclosures Policy

Amending PHI Policy

Authorizations Policy

Business Associate Assurances Policy

Complaints, Non-Retaliation and Waiver of Rights Policy

De-Identified Information and Re-Identification Policy

HIPAA Security Manual

General Security Compliance

Assigned Security Responsibility Policy

Risk Analysis Policy

Risk Management Policy

Training Policy

Information System Activity Review Policy

[COUNTY/REGION NAME]POLICIES AND PROCEDURESFORCOMPLIANCE WITH THE HEALTH INSURANCE PORTABILITYAND ACCOUNTABILITY ACT OF 1996“HIPAA” Amended December 2013 Amended June 2018 This HIPAA compliance manual was prepared for the benefit of the Iowa State Association of Counties in 2013. The manual was updated in 2018 to correct minor typographical errors and update the policy on Iowa law to include information about care coordination. No other amendments or updates have been made since that time to include any changes in the applicable laws or interpretations of the laws. and has not been updated or amended since that time to include any changes in the applicable laws or interpretations of the laws. This HIPAA compliance manual is not intended to be legal advice and should not be relied upon as a substitute for legal advice or professional services. Persons seeking legal advice regarding the application of this HIPAA compliance manual, or HIPAA, should consult with an attorney. TABLE OF CONTENTS Page TOC \t "Title,1,Title Appendix,2,Title TOC,1,Title 2,2" Workforce Designation PAGEREF _Toc522198791 \h 8 Hybrid Entity Designation PAGEREF _Toc522198792 \h 10 Affiliated Covered Entity Designation PAGEREF _Toc522198793 \h 11 HIPAA Record Retention Policy PAGEREF _Toc522198794 \h 12 HIPAA Privacy Manual PAGEREF _Toc522198795 \h 18 Overview: Handling Uses and Disclosures of PHI PAGEREF _Toc522198796 \h 19 Iowa Laws Requiring Greater Protections Policy PAGEREF _Toc522198797 \h 28 Accessing PHI Policy PAGEREF _Toc522198798 \h 35 Individual Request for PHI PAGEREF _Toc522198799 \h 41 Notice of Decision Regarding Individual Request for PHI PAGEREF _Toc522198800 \h 42 Documentation Policy PAGEREF _Toc522198801 \h 44 Accounting of Disclosures Policy PAGEREF _Toc522198802 \h 46 Accounting Disclosure Log PAGEREF _Toc522198803 \h 50 Request for Accounting of Disclosures PAGEREF _Toc522198804 \h 51 Amending PHI Policy PAGEREF _Toc522198805 \h 52 Individual’s Request for Amendment of PHI PAGEREF _Toc522198806 \h 56 Requests for Privacy Protection for PHI Policy PAGEREF _Toc522198807 \h 57 Request for Alternative Means or Location of Confidential Communications PAGEREF _Toc522198808 \h 60 Authorizations Policy PAGEREF _Toc522198809 \h 61 Authorization for Disclosure of PHI PAGEREF _Toc522198810 \h 68 Family, Friend Involvement/Personal Representatives and Deceased Individual Policy PAGEREF _Toc522198811 \h 70 Health Oversight Uses and Disclosures Policy PAGEREF _Toc522198812 \h 73 Judicial or Administrative Purposes Disclosures Policy PAGEREF _Toc522198813 \h 76 Law Enforcement Disclosures Policy PAGEREF _Toc522198814 \h 78 Required By Law Disclosures Policy PAGEREF _Toc522198815 \h 82 Research Uses and Disclosures Policy PAGEREF _Toc522198816 \h 84 Specialized Government Functions Disclosures Policy PAGEREF _Toc522198817 \h 88 Serious Threat to Health or Safety Disclosures Policy PAGEREF _Toc522198818 \h 91 Breach Notification Policy PAGEREF _Toc522198819 \h 93 Breach Notification Flowchart PAGEREF _Toc522198820 \h 99 Breach Risk Assessment Tool PAGEREF _Toc522198821 \h 103 Sample Breach Notification Letter PAGEREF _Toc522198822 \h 105 Business Associate Assurances Policy PAGEREF _Toc522198823 \h 106 Business Associate Agreement PAGEREF _Toc522198824 \h 110 Complaints, Non-Retaliation and Waiver of Rights Policy PAGEREF _Toc522198825 \h 122 Confidential Report of Concern PAGEREF _Toc522198826 \h 125 Compliance Report of Concern Investigation PAGEREF _Toc522198827 \h 126 Health Privacy Complaint Form PAGEREF _Toc522198828 \h 127 De-Identified Information and Re-Identification Policy PAGEREF _Toc522198829 \h 128 Limited Data Set Policy PAGEREF _Toc522198830 \h 131 Data Use Agreement PAGEREF _Toc522198831 \h 134 Group Health Plan Policy PAGEREF _Toc522198832 \h 139 HIPAA P

FAQs

What is the purpose of this HIPAA compliance manual for Iowa counties and regions?

It establishes policies and procedures to support compliance with HIPAA requirements, including privacy and security obligations for handling PHI.

What privacy topics are covered in the HIPAA privacy manual?

It covers permitted uses and disclosures of PHI, individual rights (access, requests, amendments), documentation and accounting, authorizations, confidentiality protections, breach notification, and related business associate responsibilities.

Which security areas are addressed in the HIPAA security manual?

It provides controls for general security compliance, assigned responsibilities, risk analysis and risk management, sanctions, workforce clearance, security training, and ongoing security activity review.

Aug 30, 2026

Upload by Ava Thompson