$1.$ The Privacy and Security Rules require the development and use of sanction

policies to encourage compliance with established policies and procedures.

$2.$ A breach is defined as an unauthorized acquisition, access, use or disclosure of

unsecured PHI $($that compromises the security or privacy of such information$)$ by a

member of the practice$$s workforce, person working under the authority of the

practice, or a business associate of the practice.

$3.$ Protected health information includes demographic information, such as the

individual$$s age, sex, and ethnicity, and billing information.

$4.$ Your password may be shared with another person as long as he$/$she is an

employee of the practice.

$5.$ Protected health information may be emailed without encryption if requested by

the patient and, after being informed of the risk that the transmission may be

intercepted, the patient accepts the risk.

$6.$ Patients have the right to receive a copy of your Notice of Privacy Practices upon

first visit or contact with the practice.

$7.$ You may bring in outside media from home and connect it to your

workstation$/$network as long as you believe it is free of viruses.

$8.$ As an employee, you may be asked to sign a confidentiality agreement, which will

outline your responsibilities with regard to safeguarding PHI.

$9.$ Disclosure, under HIPAA, is defined as the sharing, employment, application,

utilization, examination, or analysis of individually identifiable information within an

entity that maintains the information.

$10.$ When leaving voice messages, limit the information to a brief identification of the

office and a number to call, or a brief reminder of an appointment date and time,

but do not disclose the reason for the appointment, or test results, etc., because

other persons may have access to the voicemail$/$answering machine.