2. Does your organization electronically transmit or exchange
health information to carry out financial or administrative activities related
to one or more of the following transactions:
Health claims
Healthcare
payment and remittance advice
Coordination of benefits
Health claims status
Enrollment and disenrollment in a health plan
Eligibility for a health plan
Health plan premium payments
Referral certification and authorization
First report of injury
Health claims attachments
Medical Records transfer,
duplication or archival
Other activities involving individually identifiable
health information
Yes No Not
Sure
3. Is your organization a health plan (provides or pays the
cost of medical care) with less than 50 employees or annual receipts of $5 million
or less?
Yes No
Not
Sure
4. Does your organization receive individually identifiable
patient information from a health plan, healthcare clearinghouse or healthcare
provider or from a business partner of one of these entities?
Yes No
Not
Sure
5. Does your organization have a person specifically identified
to be in charge of health data privacy?
Yes No
Not
Sure
6. If your organization is a healthcare plan or healthcare
provider, does it give patients a written explanation (notice) of the uses and
disclosures of their individually identifiable health information?
Yes No
Not
Sure
7. If you answered Yes to the previous question, have you
reviewed your patient notification policies within the last six months?
Yes No
Not
Sure
8. If you are a health plan or healthcare provider, does your
organization use individually identifiable health information for any of the following
uses?
Marketing
Sell, rent or barter patient information, including
mailing lists
For health insurance underwriting purposes
Disclosure to
employers for employment determinations
Fundraising
Yes No
Not
Sure
9. If your organization maintains individually
identifiable patient information, does it allow individuals to access their records?
Yes No
Not
Sure
10. If you are a health plan or healthcare
provider, do you charge patients for copies of their medical records?
Yes No
Not
Sure
11. Does your organization have written procedures for safeguarding
the identity of the patient's (member's) protected health information?
Yes No
Not
Sure
12. Has your organization developed policies and procedures
to determine the minimum amount of protected health information necessary to accomplish
the intended use of the data?
Yes No
Not
Sure
13. If your organization maintains individually identifiable
patient information, does it provide individuals with an accounting of all disclosures
of protected information?
Yes No
Not
Sure
14. If your organization is a health plan or healthcare provider,
does it enable individuals to amend or correct their medical records?
Yes No
Not
Sure
15. Has your organization appointed someone to be in charge
of security?
Yes No
Not
Sure
16. If you answered yes to the previous question,
has that person developed an implementation team?
Yes No
Not
Sure
17. Does your organization have written data security policies
for workstation use?
Yes No
Not
Sure
18. If you answered Yes to the previous question, has your
organization reviewed these written workstation data security policies within
the last 6 months?
Yes No
Not
Sure
19. Does your organization have or plan to launch a publicly
accessible Web Site?
Yes No
Not
Sure
20. Does your organization have formal documented policies
for granting different levels of access to healthcare information?
Yes No
Not
Sure
21. If you answered Yes to the previous question,
has your organization reviewed its data access policies and procedures in that
last six months?
Yes No
Not
Sure
22. Does your organization have written policies
and procedures for ensuring the physical security of workstation locations?
Yes No
Not
Sure
23. Does your organization have written personnel security
procedures addressing access to health information?
Yes No
Not
Sure
24. Has your organization reviewed its personnel security
procedures in the last six months?
Yes No
Not
Sure
25. Does your organization have and follow policies and procedures
in the event of termination of an employee with access to identifiable health
information?
Yes No
Not
Sure
26. Does your organization use e-mail to transmit or receive
any patient information?
Yes No
Not
Sure
27. Does your organization allow employees to telecommunicate?
Yes No
Not
Sure
28. Does your organization have written policies governing
the receipt and removal of hardware/software, such as diskettes and tapes, into
and out of a facility?
Yes No
Not
Sure
29. If you answered Yes to the previous question, have you
reviewed your policies governing the removal of hardware/software into and out
of your facility within the last six months?
Yes No
Not
Sure
30. Does your organization have written policies that identify
and confirm the identity of a user when he or she tries to access health data?
Yes No
Not
Sure
31. If you answered Yes to the previous question, has your
organization reviewed its written policies that identify and confirm the identity
of users within the last six months ?
Yes No
Not
Sure
32. Does your organization have specific mechanisms for granting
access to protected health information on your computer systems and networks?
Yes No
Not
Sure
33. If your organization uses computer networks or the Internet
to transact business, does it have documented procedures, software and hardware
that assure the integrity of data, authenticate the message and verify the identity
of the sender and recipient?
Yes No
Not
Sure
34. If you answered Yes to the previous question, has your
organization evaluated the effectiveness of its systems that assure data integrity,
authenticate the message and verify the identity of the sender and recipient within
the last six months?
Yes No
Not
Sure
35. Does your organization use open networks to transmit or
receive health data?
Yes No
Not
Sure
36. Does your organization have specific mechanisms for authenticating
the sender and recipient of electronically transmitted data?
Yes No
Not
Sure
37. Does your organization use or plan to use digital signatures
within the next 12 months?
Yes No
Not
Sure
38. Does your organization have written procedures for reporting
and responding to computer security breaches?
Yes No
Not
Sure
39. If you answered Yes to the previous question, has your
organization reviewed its breach of security procedures in the last six months?
Yes No
Not
Sure
40. Does your organization plan to have an evaluation of your
security system and/or confidentiality practices performed by an outside entity
within the next 12 months?
Yes No
Not
Sure
41. In the last 12 months, has your organization conducted
a comprehensive risk assessment of its vulnerability to a security breach?
Yes No
Not
Sure
42. Has your organization reviewed or analyzed previously
undertaken Y2K activities in the last 12 months to create or change data security
and privacy practices?
Yes No
Not
Sure
43. Do you have a written detailed contingency plan to respond
to computer system emergencies?
Yes No
Not
Sure
44. If you answered Yes to the previous question, has your
organization reviewed its contingency plans within the last six months?
Yes No
Not
Sure
45. Does your organization have a comprehensive computer security
training program for all employees?
Yes No
Not
Sure
46. Has your organization conducted security awareness training
in the last six months?
Yes No
Not
Sure
47. Has your organization provided training to its employees, agents
and contractors regarding the confidentiality of health information?
Yes No
Not
Sure
48. Has your organization budgeted any resources to provide
for HIPAA compliance?
Yes No
Not
Sure
49. If you answered No to the previous question, does your
organization plan to add HIPAA compliance, training and education to the new budgetary
cycle?
Yes No
Not
Sure
50. Does your organization plan to handle HIPAA compliance
internally?
Yes No
Not
Sure
51. Does your organization establish or terminate insurance
coverage by transmitting subscriber enrollment information to a health plan?
Yes No
Not
Sure
52. If your organization is a health care provider or health
plan, does it transmit Remittance Advice and/or Explanation of Benefits?
Yes No
Not
Sure
53. Does your organization transmit encounter data for reporting
purposes, internally or between providers and plans (even though services are
prospectively paid by capitulation or other methods?
Yes No
Not
Sure
54. Does your organization transmit claim requests, or respond
to claim requests for payments and accompanying information either internally
or externally?
Yes No
Not
Sure
55. Does your organization transmit or receive authorizations
for health care or referral authorizations?
Yes No
Not
Sure
56. Does your organization inquire or respond to inquiries
regarding the status of a health care claim?
Yes No
Not
Sure
57. Does your organization use an outside
vendor's system for the collection, dissemination, transfer and archival of individually
identifiable health information?
Yes No
Not
Sure
58. If you answered Yes to the previous question, what is
the vendors time line for HIPAA compliance?
Yes No
Not
Sure
59. Has your organization reviewed its contracts with health
plans, healthcare clearinghouses, healthcare providers and/or employers from a
HIPAA compliance standpoint?
Yes No
Not
Sure
