Division of Human Resources

HIPAA Privacy and Security

As sponsor of the group health plans and flexible spending accounts offered to state employees, DPA is subject to the privacy and security regulations of the Health Insurance Portability and Accountability Act (HIPAA) (45 CFR Parts 160 and 164). These regulations are better known as the Privacy Rule (45 CFR 164 subpart E) and the Security Rule (45 CFR 164 subpart C). The requirements placed upon DPA by the Privacy and Security Rules include the following.

• Protecting the privacy of health information.

• Issuing a Notice of Privacy Practices. There is also a separate CSEAP Notice of Privacy Practices.

• Implementing policies and procedures designed to comply with HIPAA regulations.

• Providing HIPAA training to all members of the workforce involved in plan administration

• Allowing individuals to exercise their rights under HIPAA

For more information about HIPAA privacy or security contact DPA’s HIPAA Compliance Officer.

Email comments to: DPA HIPAA Compliance

These documents may be presented in PDF format, which requires the Adobe® Reader. To search DHR, go to the right-hand corner at the top of this page.