Text Size: A+| A-| A   |   Text Only Site   |   Accessibility
Oregon Department of Human Services
 

Frequently asked questions

Physical Safeguards

ISO FAQ Index 




Client interviews

Q. In an open, integrated office environment with desk-side interviewing where a discussion of medical issues could occur, we plan on having staff offer the clients a choice of interview location. They could choose an enclosed room or remain in the cubicle. If the client gives verbal consent to continue the interview in a cubicle, are we HIPAA compliant?

A. If you give the client an option, and they choose to remain at the desk, then they have given their approval that their information may be orally shared. If you believe this might be an issue later, you should document your oral agreement in the client’s case file. The HIPAA rule does allow for “inadvertent verbal disclosures” if reasonable efforts have been made to limit such events.

 



Faxing

Q. Is there a standard confidentiality statement that we should use when we are faxing documents?

A. Yes. DHS has developed a fax template for your use which contains confidentiality language and other warning information. You can download this on the DHS HIPAA Web site.

 

File Cabinets

Q. In offices where access to confidential information is controlled by escorting non-DHS staff and all clients in and out of the work area and files are kept out of plain sight, will this meet HIPAA requirements?

A. If file cabinets are kept out of plain sight of the general public and you escort non-DHS staff and clients in and out of your work areas, your office in general should meet safeguard standards. However, please refer to DHS policy AS-100-005, Administrative, Technical, and Physical Safeguards. 

 

Records

Q. How long do we need to keep records once HIPAA is in effect?

A. The HIPAA Privacy Rule states that a covered entity, like DHS, must maintain its privacy policies and procedures, and any other documentation of an activity and action as a result of those policies, in written and electronic form for six years or more.

What this means is that DHS will need to retain any authorization or client rights forms for a minimum of six years. This time period would also be true for the Disclosures of Protected Health Information Log, DHS Form 2097 and any other related communication or action.

 



Tracking disclosures

Q. What is your paper or technical solution to tracking disclosures?

A. In light of the current budget situation, DHS is adopting an interim tracking solution. A disclosure-tracking log will reside in the client’s case files and we are beginning to work on developing processes for communicating that information across the department’s program areas. These documents should be kept secure as required in the physical safeguards policy.


Back to top

 
Page updated: May 27, 2009

Click here to go to the Oregon Dept. of Veterans' Affairs outreach contact form

Get Adobe Acrobat ReaderAdobe Reader is required to view PDF files. Click the "Get Adobe Reader" image to get a free download of the reader from Adobe.