the confidentiality of any and all information regarding the patients/cli ents cared for at the affiliated facility pursuant to the applicable affiliation agreement. Students shall comply with applicable HIPAA requirements and clinical- affiliate privacy policies whenever they have access to protected health information (PHI). Students may access PHI only when authorized and only to the extent necessary to perform their assigned educational or clinical responsibilities, and shall not access patient records
merely because they have the technical ability to do so. 6. Affiliation Agreement Notification Requirement
The parties to a clinical affiliation agreement will notify one another of any known breaches of confidentiality. Accordingly, a student who becomes aware of an actual or suspected breach involving patient, student, University, or clinical- affiliate confidential information must immediately notify the appropriate Program and/or clinical-site authority, and must not attempt to independently investigate, conceal, delete, alter, or destroy evidence related to a suspected breach. The Program will coordinate with the appropriate University and clinical- affiliate officials regarding required reporting, investigation, mitigation, and follow-up. 7. Business Associate Provisions Where the University or another educational institution is determined by the U.S. Department of Health and Human Services, Office for Civil Rights, or another authorized federal or state agency, court, or administrative tribunal to be a HIPAA Business Associate, NLU will comply with the applicable c onditions established through the affiliation agreement and applicable law, and students shall follow any additional privacy, security, documentation, or information-handling requirements communicated by NLU or the clinical affiliate. 8. Minimum Necessary Access Students shall use the minimum necessary information required to accomplish an authorized educational or clinical purpose: accessing only records they are authorized to access; reviewing only information relevant to their assigned responsibilities; avoiding access to records of family members, friends, acquaintances, themselves, or other individuals unless specifically authorized for an educational purpose; logging out of electronic health records when finished; protecting passwords and authenticatio n credentials; and never sharing usernames, passwords, access cards, tokens, or other credentials. 9. Classroom and Didactic Confidentiality
91
Powered by FlippingBook