12-13 HIPAA Safeguards

1. Attachments are included in the PDF file.
2. Effective date of this revision: July 30, 2025
3. Contact for more information:  Office of HIPAA Compliance 989-774-2829, hipaa@cmich.edu

BACKGROUND

Central Michigan University (CMU) is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) law and regulations. CMU has designated itself as a hybrid entity as its business activities include both covered and non-covered functions. HIPAA requires that all CMU officers, employees and agents of units within the hybrid entity must preserve the confidentiality, integrity, and availability of Individually Identifiable Health Information (IIHI) pertaining to each patient, client, or participant in CMU’s self-funded health plan. This IIHI is considered Protected Health Information (PHI) and shall be safeguarded in compliance with the rules and standards established under HIPAA.  

For additional information on the measures Central Michigan University has implemented to comply with this legislation, visit CMU’s official HIPAA website at HIPAA.cmich.edu.

PURPOSE

In accordance with HIPAA Privacy and Security Rules, CMU has adopted this policy to fulfill its duty to protect the confidentiality, integrity, and availability of PHI and electronic PHI (ePHI). CMU is committed to safeguarding the  information sharing and transmission of health information required to provide and promote high quality health care, protecting the public’s health and well-being, fostering an innovative educational environment, and carrying out the necessary functions of the self-funded health plan, as required by law. This policy identifies how CMU will implement, assess, and monitor the physical, technical, and administrative safeguards in place to ensure PHI is safeguarded appropriately and to detect and prevent potential security risks.

DEFINITIONS

Confidentiality: PHI/ePHI is not available or disclosed to unauthorized persons.

Integrity: PHI/ePHI is not altered or destroyed in an unauthorized manner.

Availability: PHI/ePHI is accessible and usable on demand by an authorized person.

All other terms used in this policy have the same meaning as those terms in the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 and the regulations at 45 CFR Parts 160, 162, and 164.

POLICY

1. CMU will take reasonable precautions to prevent, detect, contain, and correct security violations. All workforce members and agents of CMU’s Hybrid Entity shall adhere to CMU policies and HIPAA rules to maintain reasonable and appropriate physical, technical, and administrative safeguards for protecting PHI and ePHI.
2. The HIPAA risk management program shall include a collaboration between the HIPAA Privacy Officer, HIPAA Security Officer, and Chief Information Security Officer to recommend and monitor the effectiveness of safeguards intended to reduce risks and vulnerability to a reasonable and appropriate level to:
   1. Ensure the confidentiality, integrity, and availability of all PHI/ePHI that is created, received, maintained, or transmitted.
   2. Identify and protect against reasonably anticipated threats to the security or integrity of the information.
   3. Protect against reasonably anticipated, impermissible uses or disclosures.
   4. Ensure compliance with HIPAA Rules and the CMU HIPAA policies.
3. The HIPAA Security Officer will identify and maintain an inventory of the information systems that house ePHI.  When a new system is implemented a security and privacy review will be conducted.
4. CMU will regularly perform review of information system activity (e.g., audit logs and trails, information system activity records, facility access records) for the purpose of detecting:
   1. Unauthorized access to PHI/ePHI.
   2. Unusual patterns of use or activity.
   3. Other potential security violations.
5. The HIPAA Privacy Officer and HIPAA Security Officer will collaborate with other HIPAA Security Incident Response Team (HSIRT) members to assure procedures are developed, implemented, and documented to:
   1. Identify possible security incidents.
   2. Respond to suspected or known security incidents.
   3. Mitigate, to the extent practical, harmful effects of known security incidents.
   4. Document and report security incidents and their outcomes.
6. Individuals who are allowed access to ePHI assume personal responsibility to maintain the integrity and security of the system and the network they use, by following established guidelines for personal login, password, and workstation controls.
7. Documentation of risk assessment and system activity reviews shall be retained for at least six years, in accordance with HIPAA documentation requirements.
8. All workforce members and agents of CMU’s Hybrid Entity are required to adhere to all CMU Policies, including HIPAA, OIT, and record retention policies which establish CMU’s physical, technical, and administrative safeguards.
   1. For certain safeguards to be effective, workforce members must do their part in ensuring appropriate use and application of available controls. Expectations of a workforce member’s duties, while not all encompassing, are outlined in Exhibit A. Additional expectations can be found in other CMU policies and the HIPAA Training Program.

Central Michigan University reserves the right to make exceptions to modify or eliminate this policy and or its content. This document supersedes all previous policies, procedures or guidelines related to this subject.