Document in writing, or electronically, your privacy and security policies and procedures.
Specify why and where you have security measures in place, how you created them, and what you do to monitor them. Document everything, including all assessments, precautions, procedures, actions, findings, and processes covered in the 10 Step Plan. Organize your compliance documentation in central locations, so both paper and electronic records can be easily referenced.
Ask yourself if you are keeping records of:
-
Procedures for distributing privacy practice notices (which should include instructions on how to file complaints and report security concerns)
-
Security policies and procedures (including written records of required actions, activities, or assessments)
-
Complaint resolutions
-
Updates to policies and procedures
-
Sanctions against workforce members relating to privacy or security issues
-
Staff training
-
Business Associate Agreements
Be sure to keep privacy records for six years from creation of a document, or the last effective date. Also, periodically review and update documentation in response to changing conditions that affect the security of PHI.