Applies to the Administrative Requirements of the Health Insurance Portability and Accountability Act of 1996. 45 CFR Section 164.530(j)
The Employee Benefit Plan has implemented a record retention policy to ensure the required documents are maintained as specified in HIPAA’s Privacy Rules.
- The Employee Benefit Plan retains the required records and documentation for a period of six (6) years from the date it was created or was last in effect, whichever is later.
- The records or documentation are retained in written or electronic form.
- The following records or documentation are retained:
- Signed authorization forms,
- Copy of the Employee Benefit Plan’s Notice and any subsequent revisions,
- Business Associate Contracts,
- Plan Document Amendments,
- Plan Sponsor Certifications,
- Adequate Separation Documentation,
- Any restrictions on uses/disclosure of a participant’s PHI to which the Employee Benefit Plan has agreed,
- The designated record set to which participants have a right of access,
- The titles of persons or offices designated as responsible for receiving complaints; requests for access, amendment and an accounting of disclosures; and questions related to privacy concerns,
- Any written accounting of disclosures provided in response to requests by participants,
- Privacy policies and procedures and any revisions to them,
- Privacy training documentation that has been provided to workforce members,
- Sanctions that have been applied related to privacy violations, and
- All participant complaints received including disposition.
Effective Date: April 14, 2003