Privacy, Confidentiality, and Information Security Procedures

Please see:UNMC Policy No. 6045, Privacy, Confidentiality, and Information Security, Privacy Incident Response Plan Procedures, and Information Security Incident Reporting and Response Procedures.

UNMC Responsibilities

General

  1. Records containing confidential information, in any form, are the property of UNMC
  2. UNMC is responsible for safeguarding confidential information against loss, tampering, and disclosure to unauthorized individuals
  3. UNMC faculty, staff, volunteers, trainees, students and independent contractors (“workforce” as defined in UNMC Policy No. 6045) have a duty to protect confidential information. (See UNMC Policy No. 6057, Use and Disclosure of Protected Health Information) Breach of this duty includes the following:
  4. Using another person’s user ID, password, or other security codes
  5. Assisting an unauthorized user to gain access to a secured information system
  6. Leaving confidential information unattended in a non-secure area
  7. Falsifying information
  8. Disclosing confidential information without proper authorization (See UNMC Policy No. 6045, Privacy, Confidentiality and Information Security)
  9. Improper disposal of confidential information (See UNMC Policy No. 6056, Retention and Destruction/Disposal of Private and Confidential Information)
  10. UNMC shall reasonably mitigate or reduce any harmful effects that may result from privacy or security breaches
  11. UNMC shall respond in a timely manner to all reports of suspected privacy or security breaches. UNMC shall make all efforts to resolve the suspected breach internally.
  12. Department administration will ensure that, in accordance with UNMC Policy No. 6045, all UNMC workforce sign the UNMC Privacy and Confidentiality Agreement annually.
  13. Sanctions will be imposed for substantial breaches. Sanctions for breach of privacy and confidentiality may include revocation of medical staff privileges and employee or student disciplinary action, up to and including termination. (See UNMC Policy No. 1098, Performance Management).
  14. Workforce members who suspect a breach of confidentiality regarding the general responsibilities listed above shall report the breach to Budget, Analysis and Financial Compliance or to the Human Resources Employee Relations Department.

HIPAA

  1. UNMC faculty, staff, volunteers, trainees, students and independent contractors (“workforce” as defined in UNMC Policy No. 6045, Privacy, Confidentiality and Information Security) have a duty to protect Protected Health Information (PHI). Breach of this duty includes the following:
  2. Accessing PHI information, in any form, without a “need to know” to perform assigned duties.Workforce members with medical information system access may view their own individual medical records. Workforce members may not print copies of their own records nor access records of family members (including children), relatives, friends and others, unless access is necessary to perform assigned duties. Workforce members may obtain a copy of their medical records from the Health Information Management Department
  3. Disclosing PHI information in the presence of individuals who do not have “need to know” to perform assigned duties
  4. Disclosing that a patient is receiving information (except for authorized directory purposes)
  5. Transferring confidential information in any form without both parties having a “need to know”
  6. Business Associate agreements/addenda shall be established with any individual or corporation who performs a function on behalf of UNMC involving the use or disclosure of PHI, other than as faculty, staff, house officer or student (See UNMC Policy No. 6060, Business Associate Agreements)
  7. Individuals have the following rights with respect to their PHI:
  8. Right to request access and obtain copies of their designated record set within a reasonable amount of time and to request amendment (See UNMC Policy No 6059, Access and Amendment to Designated Record Set)
  9. Right to request restrictions of how their PHI is used
  10. Right to request an accounting of disclosures (See UNMC Policy 6061, Accounting of Protected Health Information Disclosures)
  11. Right to receive a Notice of Privacy Practices (See UNMC Policy 6058, Notice of Privacy Practices)
  12. Right to file a complaint internally with the Patient Relations Department with response or with the Department of Health and Human Services in Washington DC (See UNMC Policy 6058, Notice of Privacy Practices and UNMC Policy No. 6062, Patient/Consumer Complaints)

Individuals shall not be asked to waive these rights as a condition of receiving treatment.

  1. Retention of the designated record set or other protected health information shall be in accordance with federal, state, and local laws, and regulatory association guidelines. Documents required to demonstrate HIPAA compliance shall be retained for a period of six years. (See UNMC Policy No. 6056, Retention and Destruction/Disposal of Private and Confidential Information)
  2. The UNMC Privacy and Information Security Officers shall be designated in writing and shall be responsible for coordinating the development and implementation of UNMC policy and procedures necessary to comply with HIPAA
  3. All UNMC workforce shall receive training on privacy and security of confidential information upon hire, and when policies and procedures relevant to their individual position change. UNMC students shall receive similar training at a time designated by UNMC Student Services.
  4. Compliance with these procedures will be assessed through periodic audits of access to confidential information, physical inspection of work areas, analysis of privacy-related complaints, and other monitoring
  5. Workforce members who suspect a breach of confidentiality regarding Protected Health Information (PHI) shall report the breach to the Human Resources Employee Relations Department. Those who wish to remain anonymous may report the suspected breach of HIPAA compliance requirements to The Nebraska Medical Center Compliance Hotline at 800-822-8310. Medical Staff shall report breaches to the Medical Records Director at 402/559-4891
  6. A full investigation of the breach shall be conducted, in coordination with the UNMC/The Nebraska Medical Center Security and Privacy Officers, the Human ResourcesEmployee Relations Department, and The Nebraska Medical Center Patient Relations Department as appropriate
  7. Civil and criminal fines and penalties can also be sanctioned under HIPAA.

Business Information

  1. UNMC faculty, staff, volunteers, trainees, students and independent contractors (“workforce” as defined in UNMC Policy No. 6045, Privacy, Confidentiality and Information Security) have a duty to protect proprietary business information. Breach of this duty includes, but may not be limited to, the following:
  2. Disclosure of confidential financial statement information
  3. Disclosure of confidential contract/agreement information
  4. Disclosure of confidential business plans
  5. Disclosure of University of Nebraska Foundation (a private entity) transaction information
  6. Disclosure of credit card information received in the course of business by the University, whether or not such credit card information is covered by the Gramm-Leach-Bliley Act (GLBA).

Executive Memoranda No. 26 provides a model contract for Service Providers who maintain or regularly access covered data and information, which includes credit card information. Contact Student Services for additional information aboutService Provider contracts and contract addenda.

  1. Workforce members who suspect a breach of confidentiality regarding proprietary business information shall report the breach to Budget, Analysis and Financial Compliance or the Human Resources Employee Relations Department.
  2. A full investigation of the breach shall be conducted byBudget, Analysis and Financial Complianceand the Human Resources Employee Relations Department, as appropriate.

Student Information

  1. UNMC faculty, staff, volunteers, trainees, students and independent contractors (“workforce” as defined in UNMC Policy No. 6045, Privacy, Confidentiality and Information Security) have a duty to maintain the confidentiality of student education records. Breach of this duty includes, but is not limited to, release of student information that is not considered “directory information” under the guidelines of the Family Educational Rights and Privacy (FERPA) listed in the Student Handbook. It also includes, but is not limited to, protection of confidential student financial information protected under the Gramm-Leach-Bliley Act (GLBA).

Executive Memoranda No. 26 defines “Student Financial Information” as:

That information that the university has obtained from a student in the process of offering a financial product or service, or such information provided to the University by another financial institution. Offering a financial product or service includes offering student loans to students, receiving income tax information from a student’s parent when offering a financial aid package, and other miscellaneous financial services as defined in 12 C.F.R §225.28. Examples of student financial information include addresses, phone numbers, bank and credit card account numbers, income and credit histories and Social Security number, in both paper and electronic format.

Executive Memoranda No. 26 also provides a model contract for Service Providers who maintain or regularly access covered data and information. Contact Student Services for additional information about contracts and contract addenda.

  1. The social security number of a student is considered confidential information and must not be used to identify a student.
  1. Information Technology Services (ITS) shall be available to assist in identifying alternatives to use of social security number. Alternatives which should be considered, include but are not limited to:
  1. Student Number
  1. Use of a student’s social security number in databases is prohibited unless legally required. If it must be used, the use of the student’s social security number must comply with ITS Database Security Procedures..
  1. Workforce members who suspect a breach of confidentiality regarding Student Education Records shall report the breach to Budget, Analysis and Financial Compliance orthe Human Resources Employee Relations Department.
  2. The student can file a complaint with the Family Policy Compliance Office, U.S. Department of Education, 400 Maryland Ave SW, Washington, DC 20202-4605.
  3. A full investigation of the breach shall be conducted by Budget, Analysis and Financial Compliance, Human ResourcesEmployee Relations Department and the Vice Chancellor for Academic Affairs, as appropriate.

Employee Information

  1. Because UNMC is a public body, its records are available for public inspection. However, UNMC employment records are confidential and will not be made available, except upon written authorization signed by the individual to whom the records pertain or in response to a legal mandate. In this context, employment records are those of persons who are employees of UNMC, and persons who are or have been either applicants or nominees for employment at UNMC. Such records include the entire employment process beginning with application or nomination for appointment, search committee evaluation, and appointing authority evaluation, through appointment and employment, and ending with separation from employment.
  2. The social security number of an employee is considered confidential information and should not be used to identify an employee unless legally mandated.
  1. ITS shall be available to assist in identifying alternatives to use of social security number. Alternatives which should be considered, include but are not limited to:
  1. Personnel (SAP) Number
  2. Last four digits of social security number
  1. In cases where the employee social security number must be stored in a database, the database use must comply with ITS Database Security Procedures.
  1. The following are not confidential and are considered by UNMC as directory information:
  2. Employee’s Name
  3. Gross salary
  4. Dates of hire and separation
  5. Type of appointment(s) held and term of each appointment
  6. Title or academic rank
  7. UNMC employment address
  8. Post secondary education degrees earned
  9. Awards or honors
  10. Information other than directory information is accessible only to the employee, the department administrative personnel, UNMC Human Resources, and other University offices with a need to know. Non-directory information should be released to others only with signed authorization from the employee or in response to a legal mandate.
  11. Departments have three options for responding to requests for reference checks:
  12. Refer to Human Resources – Records
  13. Provide directory information only
  14. With a signed release, respond to questions and provide information based only on what is documented in the employment file
  15. UNMC faculty, staff, volunteers, trainees, students and independent contractors (“workforce” as defined in UNMC Policy No. 6045, Privacy, Confidentiality and Information Security) have a duty to protect confidential information. Breach of this duty includes but is not limited to the following:
  16. Disclosure of social security number
  17. Disclosure of Family Medical Leave information
  18. Workforce members who suspect a breach of confidentiality regarding Employment Records shall report the breach to Budget, Analysis and Financial Compliance or the Human Resources Employee Relations Department.
  19. A full investigation of the breach shall be conducted by the Human ResourcesEmployee Relations Department.
  20. For more information about responding to reference checks, inquire at UNMC Human Resources – Records at 402/559-8962.

Research Information

  1. UNMC faculty, staff, volunteers, trainees, students and independent contractors (“workforce” as defined in UNMC Policy No. 6045, Privacy, Confidentiality and Information Security) have a duty to protect confidential information produced while performing research. Breach of this duty includes the following:
  2. Disclosure of PHI to unauthorized persons or entities not included in the HIPAA authorization
  3. Disclosure of research results linked to human subjects to persons or entities not authorized in the Institutional Review Board (IRB) approved protocol
  4. Workforce members who suspect a breach of confidentiality regarding Research information shall report the breach to the IRB, the Office of the Vice Chancellor for Research or to the Human ResourcesEmployee Relations Department.
  5. A full investigation of the breach shall be conducted, in coordination with Budget, Analysis and Financial Compliance, the IRB, the Office of the Vice Chancellor for Research and the Human ResourcesEmployee Relations Department, as appropriate

For more information, see UNMC Policy 6045, Privacy, Confidentiality and Information Security or contact the Security Officer.