This is the site of official Stanford University HIPAA Privacy policies.
Please select the appropriate Stanford University policies to view. The policy statements and links to the full policies are below. SUHC means Stanford University HIPAA Components, SACE means Stanford Affiliated Covered Entity, and PHI means protected health information.
If you have questions about how to implement these policies or how to keep your department compliant, see Frequently Asked Questions.
Please note that a SUNet ID maybe required to view these pages from off-campus.
H-01: Definitions
Definitions of key terms that are frequently used in HIPAA policies.
H-02: Access by Individuals to Their PHI
SUHC will provide to an individual, on written request, access to inspect and/or copy their PHI in accordance with this policy as long as the PHI is maintained in a designated record set.
H-03: Accounting of Disclosures of PHI
SUHC will provide to an individual, on written request, an accounting of certain disclosures of their PHI.
H-04: Amendment and Addendum to PHI
SUHC will allow individuals to request to amend or add an addendum to their PHI and will respond to such requests in accordance with this policy, including amending the designated record set, denying a request to amend when such denial is permitted, and / or adding an addendum to the PHI.
H-05: Business Associates
When Stanford University enters into contracts on behalf of SUHC pursuant to which the contracting party will be provided with access or have access to PHI or electronic PHI (ePHI), Stanford University will enter into agreements with such persons (business associates agreements) intended to protect the privacy of the PHI and ePHI transmitted in connection with such relationship.
H-06: Communication with Family, Friends, and Others Involved in Care or Payment
SUHC may disclose limited PHI to those family members and other persons who are involved in the care of the individual or in the payment for the individual's care.
H-07: Complaint Handling
SUHC will provide a process for individuals to make a complaint concerning SUHC privacy practices or potential violations of the Privacy Rule.
H-08: Confidential Communications of PHI
An individual may request and SUHC will accommodate reasonable requests that meet the criteria of this policy to deliver a communication containing PHI to a location or by a means different than the standard delivery.
H-09: Education
SACE is committed to protecting the privacy of patients and research subjects, while carrying out its teaching mission. PHI may be used or disclosed for educational activities described in this policy only in accordance with this policy and applicable law.
H-10: Fundraising Communications
SACE is committed to protecting the privacy of patient and research subjects in accordance with applicable law. PHI may be used or disclosed for fundraising purposes only in accordance with this policy and applicable law.
H-11: Minimum Necessary Use and Disclosure of and Requests for PHI
When using or disclosing PHI, or when requesting PHI from an individual or other outside party, SUHC will make reasonable efforts to limit the amount of PHI to the minimum necessary to accomplish the intended purpose. This general expectation does not mean that health care providers should restrict exchanges of information necessary to treat patients quickly and effectively.
H-12: Notice of Privacy Practices
SUHC will maintain and provide to individuals a notice of privacy practices (Òprivacy noticeÓ) as required by the Privacy Rule. Each privacy notice will accurately describe how SUHC may use and disclose an individual's PHI and the rights of the individual with respect to his or her PHI.
H-13: Research and Patient Privacy
SACE is committed to protecting the privacy of patients and research subjects, while carrying out its research mission. The PHI of patients and subjects may be used (i.e., within SACE) or disclosed (i.e., to those outside SACE) for research purposes only in accordance with this policy and applicable law.
H-14: Use and Disclosure of PHI
SUHC will use or disclose PHI only with a valid authorization from the individual, or as permitted or required by law.
