HomeMy WebLinkAbout3239 RESOLUTION NO. 3239
A RESOLUTION of the City Council of the City of
Bremerton, Washington, declaring the City as a Hybrid Entity;
designating the City's Health Care Components; designating
HIPAA Privacy Officer(s); directing and authorizing certain
officials and employees to carry out this resolution; and providing
an effective date.
WHEREAS, the Health Insurance Portability and Accountability Act of
1996 (HIPAA), and regulations promulgated thereunder, and the Health Information
Technology for Economic and Clinical Health Act(HITECH), and regulations
promulgated thereunder, require public and private entities that provide certain health
care services to comply with regulations related to the collection, use, disclosure, and
security of individually identifiable health information; and
WHEREAS, as a"covered entity" under HIPAA,the City strives to
protect the confidentiality, integrity and availability of protected health information (PHI)
by taking reasonable and appropriate steps to protect the security and privacy of PHI and
comply with all applicable laws and regulations relating to data privacy and security,
including,without limitation, HIPAA,HITECH,and RCW 70.02 "Uniform Health Care
Information Act"(UNCIA).
WHEREAS,because the City is a single legal entity with business activities that
include both covered and non-covered functions,the City may declare itself a Hybrid Entity as
defined by 45 C.F.R § 164.103 and in accordance with 45 C.F.R. § 164.105(a)(2)(iii)(C);
WHEREAS, the City Council has determined that the City can more effectively
and efficiently comply with HIPAA by declaring the City as a"Hybrid Entity" and formally
designating the City's health care components in accordance with 45 C.F.R. §
164.105(a)(2)(iii)(C);
WHEREAS, after an assessment of the City's divisions,programs and
departments for applicability of HIPAA, only certain portions of the City are components of the:
City that create, transmit, use or maintain health information and therefore should be designated
as Health Care Components;
WHEREAS, HIPAA regulations require the City to designate an individual or
individuals as the privacy officer(s)to be responsible for the development and implementation of
required privacy policies and procedures for the City and the Medical Officer-Captain,has
assumed those duties relative to HIPAA compliance for public safety functions as outlined
herein, and the Human Resources Manager has assumed those duties relative to HIPAA
compliance for administrative and health plans functions as outlined herein, and the Information
Services Manager has assumed those duties relative to HIPAA and HITECH compliance as
outlined herein;
1
HIPPA Privacy Compliance
WHEREAS, as a Hybrid Entity,the City has ongoing responsibilities to establish
and maintain ongoing policies,procedures and business practices to maintain compliance with
HIPAA requirements; Now therefore
THE CITY COUNCIL OF THE CITY OF BREMERTON, WASHINGTON,
DOES HEREBY RESOLVE AS FOLLOWS:
SECTION 1. The City Council of the City of Bremerton,hereby finds and
determines that the recitals set forth above are true and correct, and are hereby adopted and
incorporated.
SECTION 2. The City Council hereby designates the City as a"Hybrid Entity."
In accordance with 45 C.F.R. § 164.105(a)(2)(iii)(C), the following components are designated
as covered components of the Hybrid Entity:
• The Fire Department with respect to its provisions of emergency medical
services only;
• The Information Services Division of the Finance Department with respect to
its duties relating to providing technology services for the City's health care
benefit plans and the Fire Department's emergency medical services;
• The Finance Department with respect to its duties involving the billing,
payment, and administration of health insurance payments for medical plans
only;
• The Office of the City Clerk with regard to its duties relating to records
management for the City and as the Pension Board Secretary;
• Human Resources in its function administering the City's health insurance
benefits plans and processing of pension claims;
• The Internal Auditor with respect to its duties to audit other covered
components of the City; and
• Risk Management in its function administering the City's Risk Management
Program only. The worker's compensation program is exempted by 45 CFR
160.103(2)(c).
SECTION 3. The City Council affirms that all Covered Components are
required to protect the security and privacy of PHI and comply with all applicable laws and
regulations relating to data privacy and security, including without limitation, HIPAA,HITECH,
and UHCIA. To this end,the City Council directs and authorizes all Department Heads or
Officers, Commissions and Boards of the City that have been designated in this resolution as
"Covered Components"to take any and all action necessary to implement this Resolution and
ensure the following policy guidelines are followed:
• All employees, agents and volunteers are to comply with HIPAA, HITECH,
and UHCIA and those regulations that implement these laws;
• All employees, agents and volunteers are to comply with City policies and
procedures implementing HIPAA, HITECH, and UHCIA.
2
HIPPA Privacy Compliance
• All personnel are to ensure that access,use and disclosure of PHI is limited to
authorized personnel for only permitted uses;
• All personnel are to safeguard the confidentiality, integrity and availability of
PHI in accordance with City policies and the Security Regulations
promulgated pursuant to HIPAA;
• All personnel are to immediately document and notify the Privacy Officer of
any unauthorized disclosure;
• All personnel are to take steps to mitigate any damages caused by
unauthorized disclosure;
• All personnel are to ensure security of facilities and technological operations;
• Key personnel are to ensure that business associate agreements are executed
with contractors that perform duties involving PHI on behalf of the City; and
• All personnel are to be trained and updated on all new requirements on a
continuing basis.
SECTION 4. The City Council designates the Fire Department Medical Officer-
Captain, as the Privacy Officer responsible for development, implementation and oversight of the
City's HIPAA privacy and security policies and procedures in relation to the policies and
procedures applicable to the medical components related to health care which include the City of
Bremerton Fire Department.
SECTION S. The City Council designates the Information Services Manager as
the Privacy Officer responsible for City's HIPAA privacy and security policies and procedures in
relation to the policies and procedures applicable to the electronic security components related to
healthcare.
SECTION 6. The City Council designates the Human Resources Manager as the
City's Privacy Officer responsible for the development, implementation and oversight of the
City's HIPAA privacy and security policies and procedures in relation to the policies and
procedures applicable to the City's health plan which includes the Human Resources,the
Finance Department,the Internal Auditor, the City Clerk's Office, and the Risk Management
Office,to the extent those Departments are covered components as outlined in Section 2 herein.
SECTION 7. The City directs and authorizes the HIPAA Privacy Officers to
work in conjunction with the City Attorney to approve changes in the designation of
departments, divisions,units and/or programs as healthcare components to maintain compliance
with HIPAA, HITECH, and UHCIA.
SECTION 8. Severability. if any one or more sections, subsections, or sentences
of this Resolution are held to be unconstitutional or invalid, such decision shall not affect the
validity of the remaining portion of this Resolution and the same shall remain in full force and
effect.
SECTION 9. Effective Date. This Resolution shall take effect and be in force
immediately upon its passage.
PASSED by the City Council of the City of Bremerton,Washington this
day of , 2015.
3
HIPPA Privacy Compliance
�V
h��fi• , Council President
APPROVED AS TO FORM: ATTEST:
5R4E R A. L OVey SHANNON L. CORIN, Ity Clerk
R:\Human Rcsourccs\HR\Human Rcsourccs\2014 Agenda Itcros\HIPPA Privacy Compliance.res.doc
4
HIPPA Privacy Compliance