The Health Insurance Portability and Accountability Act of 1996 (HIPAA) grants individuals the right to receive notice of the uses and disclosures of their protected health information that may be made by the district and sets forth the individual’s rights and the district’s legal obligations with respect to protected health information. The purpose of this policy is to assist the district in complying with the HIPAA privacy standards, to ensure that individuals receive adequate notice of the district’s practices with regard to the dissemination and use of protected health information, and to protect the confidentiality and integrity of protected health information.
The board of trustees has determined that it meets the definition of a hybrid of covered entities under HIPAA since the district offers health-care provider programs and services that include electronic billing for the reimbursement of services under Idaho Medicaid programs, or contracts with another entity to provide such services. Accordingly, the district is subject to HIPAA. In all electronic transactions involving student education records, the district will adhere to the transaction requirements of HIPAA and the confidentiality requirements of the Family Educational Rights and Privacy Act (FERPA).
DEFINITIONS
“Privacy Officer” means the superintendent or the superintendent’s designee.
“HHS Privacy Regulations” or “Privacy Rule” means the Standards for Privacy of Individually Identifiable Health Informationas defined at 45 C.F.R. Parts 160 and 164, Subparts A and E.
“Protected Health Information” or “PHI” has the same meaning as the term “protected health information” as defined in 45 U.S.C. §164.501 but is limited to any such information created or received by Business Associate from or on behalf of Covered Entity.
“Business Associate” means a person or organization not a part of the district’s work force that performs certain functions or activities, such as, but not limited to, claims processing, data analysis, and billing, on behalf of the district that involves the use or disclosure of individually identifiable health information.
“Covered Entity” means a district that acts as a “health plan,” including an employer-sponsored group health plan. Exceptions to this definition are those health plans with less than fifty (50) participants that are administered solely by the employer.
CONFIDENTIALITY OF INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION
All officers, employees and agents of the district shall preserve the confidentiality and integrity of individually identifiable health information pertaining to any individual. Individually identifiable health information is protected health information and shall be safeguarded to the extent possible in compliance with the requirements of the security and privacy rules and standards established by HIPAA. The district and its officers, employees, and agents will not use or disclose an individual’s protected health information for any purpose without the properly documented consent or authorization of the individual or his/her authorized representative unless required or authorized to do so under state or federal law or this policy, unless an emergency exists, or unless the information has been sufficiently de-identified that the recipient of the information would be unable to link the information to the specific individual.
All officers, employees, and agents of the district are expected to comply with and cooperate fully with the administration of this policy. The district will not tolerate any violation of the HIPAA privacy or security standards of state and federal law and this policy. Any such violation shall constitute grounds for disciplinary action up to and including termination of employment.
NOTICE AND COMPLAINT PROCEDURES
The superintendent may designate an individual responsible for responding to HIPAA inquiries, complaints, and for providing adequate notice of employee rights and district duties under the health plan provisions of HIPAA. Notice will include the privacy provisions of the law and uses of employee protected health information and disclosures that may be made by the district.
Individuals who believe their privacy rights have been violated may file a complaint in accordance with established district procedures. Employee complaints may also be filed directly with the U.S. Secretary of Health and Human Services. All complaints received will be promptly investigated and documented, including their final disposition. The district will not tolerate or permit reprisals or retaliation against any employee who reports a breach to the integrity or confidentiality of protected health information. Any employee involved in retaliatory behavior or reprisals against another individual for reporting an infraction of this policy will be subject to disciplinary action up to and including termination of employment.
TRAINING
Training will be provided to all current staff and new employees determined by the district to have access to the protected health information of employees and student education records. Training will be provided within a reasonable period of time after the individual’s hiring, and to those employees when their duties may be impacted by a change in the district’s policy and/or procedures.
BUSINESS ASSOCIATE AGREEMENTS
The superintendent will ensure that satisfactory assurance has been obtained from any business associate performing HIPAA-covered activities or functions on behalf of the district that the protected health information it receives from the district will be protected. Such assurance will be in the form of a written agreement or may be included as a part of the district’s contract with the business associate. All business associate agreements will include a provision that the business associate is obligated to notify the district’s superintendent or designee when unauthorized uses and/or disclosures of protected health information have occurred in the business associate’s organization. The superintendent or designee will take appropriate action to address the violation up to and including termination of the business associate agreement.
SUPERINTENDENT AUTHORITY
The superintendent is directed to ensure an assessment of district operations is conducted to determine the extent of the district’s responsibilities as a covered entity under HIPAA and to develop internal controls and procedures necessary to implement this policy and meet the requirements of the law. Such procedures shall include provisions for record keeping, documentation of the district’s compliance efforts and appropriate administrative, technical, and physical safeguards to protect the privacy of student education records and employee protected health information and to ensure that any request is limited to information reasonably necessary to accomplish the purpose for which the request is made.
POLICY REVIEW AND DOCUMENTATION
In the event of a change in the law that may impact this policy or established district procedures, the superintendent shall ensure appropriate revisions are recommended for board approval, necessary changes are implemented, and notification is made to staff and others, as appropriate. Documentation shall be required in support of the policies and procedures of the district and all other parts of the HIPAA privacy regulations that directly require documentation, including but not limited to, all authorizations and revocations of authorizations and complaints and disposition of complaints. All documentation shall be kept in written or electronic form for a period of six (6) years from the date of creation or from the date when it was last in effect, whichever is later.
HEALTH INFORMATION FOR EMPLOYMENT PURPOSES
Health information regarding employees provided to the district as the employer for a specific employment purpose is not PHI and will be kept in the employee’s personnel record. PHI will not be made part of an employee’s personnel record without the signed authorization of the employee or personal representative, as required by the Privacy Rule.
PRIVACY OFFICER
The superintendent or designee is appointed as the Privacy Officer for the district. All complaints should be addressed to:
Superintendent of Schools
Aberdeen School District No. 58
Aberdeen, ID 83210
Phone: (208) 397-4113
Fax: (208) 397-4114
♦ ♦ ♦ ♦ ♦ ♦ ♦
LEGAL REFERENCES:
20 U.S.C. §1232g – Family Educational Rights and Privacy Act
42 USC Section 1320d-2(d) – Health Insurance Portability and Accountability Act
45 CFR §164-316b – Implementing HIPAA
34 CFR Part 99 – Implementing FERPA
ADOPTED: September 09, 2026
AMENDED: