Steve --

I didn't even pay attention to what your organization was when I replied originally. Having checked -- looks like HPOPS.ORG website is for Houston Police Officers Pension System (or similar) -- I have a few more comments.

First of all, HIPAA may not apply to you at all. HIPAA applies to medical service providers, and through them, contractually, to their "business associates." For example, we pass some of our HIPAA liability onto our paper shredding vendor contractually, to the extent it has our stuff it its possession. It took us some time to determine with certainty that our HR division was a provider for HIPAA purposes (we partially self insure and manage our employee medical insurance). Records Management Services is not a healthcare agency, but we act as agent for -- essentially an employee of -- the six County healthcare agencies we serve, when we provide access to client charts and other "protected health information." RM staffers must take the same HIPAA training that our healthcare employees who access client medical records take. However, IT support staffers, who have only limited, partial and transitory access to PHI, take a lesser level training. How HIPAA applies is not always clear. Seek legal advice.

If HIPAA does apply to you, then as an entity of the State of Texas, HPOPS may have access to State HIPAA compliance resources that may help. Kansas and many other states provided support to all the state and county health, aging, mental health, EMS and other public medical service agencies for HIPAA compliance -- model policies, sample contracts, training, forms, disclosures, etc. Even if HIPAA does not apply to HPOPS, the same sources may be helpful in complying with Texas laws that regulate medical records.

HIPAA is complicated. One size does not fit all. We had support from State sources, two attorneys assigned by the County Counselor's Office, reps from our six healthcare agencies, a team leader from the County Manager's Office and me. It took us many months to work it out, and it's still evolving. And that was just for the Privacy Rule. The related, but distinct, Security Rule has overlapping players and concerns, but is a different animal.

// Douglas K. King, Records Manager / Freedom of Information Officer
|| Sedgwick County DIO/IT-Records Management Services
|| Sedgwick County Courthouse / 525 N. Main /  Wichita KS 67203
|| 316.660.9846   FAX 316.660.3274   mailto:[log in to unmask]
\\  www.sedgwickcounty.org   "Sedgwick County ... working for you"

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance