Summary
HIPAA (Health Insurance Portability and Accountability Act) regulates the protection of health information at UofL. All faculty, staff and students who handle protected health information (PHI) must follow university policies and federal law to ensure confidentiality, integrity and availability of health data.
Body
Before You Begin
Ensure you have a valid UofL user account and login credentials.
Review UofL Information Security Policies and Procedures for HIPAA compliance. HIPAA is the Health Insurance Portability and Accountability Act of 1996.
Identify if your work involves PHI or regulated health data. PHI is Protected Health Information, which falls under the HIPAA act.
Instructions
Identify HIPAA Data
- Determine if your data includes PHI, such as patient records, medical billing or health research data.
- Review university policies for definitions and examples of HIPAA-regulated data.
Protect HIPAA Data
- Store PHI only on approved, secure systems and encrypted devices.
- Limit access to PHI to authorized personnel only.
- Do not share PHI via email, cloud storage or unapproved platforms.
- Use secure methods for transmitting PHI, such as encrypted email or secure portals.
Manage and Retain HIPAA Data
- Follow university retention schedules and HIPAA requirements for health data.
- Purge PHI securely when no longer needed, unless retention is required by law.
- Report any accidental or intentional exposure of PHI immediately.
Report Incidents and Get Help
- If you suspect unauthorized access, disclosure, or loss of PHI, report the incident to secureit@louisville.edu or the ITS HelpDesk.
- For questions about HIPAA compliance or data management, contact the Information Security Office.
Further Reading
https://www.hhs.gov/hipaa/for-professionals/privacy/index.html
Need Additional Help
• Please submit a ticket to Security Compliance Management.