Third Party Registry - Revision history

Afaylor: /* Additional Information */ updated Health Insurance Portability and Accountability Act of 1996 (HIPAA) link - 2x

2025-09-29T21:25:45Z

Additional Information: updated Health Insurance Portability and Accountability Act of 1996 (HIPAA) link - 2x

← Older revision		Revision as of 16:25, September 29, 2025
Line 35:		Line 35:
	<big>'''Third Party Registry Selection Policy'''</big><br /><br />		<big>'''Third Party Registry Selection Policy'''</big><br /><br />
	==Basis for Policy ==		==Basis for Policy ==
	Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html~~#security-rule~~ HIPAA Security Rule] outline considerations for the access control family of security controls.		Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. [https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53] and the [https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule] outline considerations for the access control family of security controls.
	==Policy==		==Policy==
	The following serve as the guiding principles to follow when selecting a third-party vendor:		The following serve as the guiding principles to follow when selecting a third-party vendor:
Line 110:		Line 110:
	*[https://info.unmc.edu/its-security/policies/procedures/thirdparty.html Third Party Registry Form]		*[https://info.unmc.edu/its-security/policies/procedures/thirdparty.html Third Party Registry Form]
	*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]		*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]
	*[https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html Health Insurance Portability and Accountability Act of 1996] (HIPAA)		*[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html Health Insurance Portability and Accountability Act of 1996] (HIPAA)
	*[https://www.cdc.gov/phlp/~~publications~~/~~topic~~/hipaa.html~~#security-rule~~ HIPAA Security Rule]		*[https://www.cdc.gov/phlp/php/resources/health-insurance-portability-and-accountability-act-of-1996-hipaa.html HIPAA Security Rule]

	This page maintained by [mailto:dpanowic@unmc.edu dkp].		This page maintained by [mailto:dpanowic@unmc.edu dkp].

Mhurlocker: /* Additional Information */

2025-09-22T14:08:14Z

Additional Information

← Older revision		Revision as of 09:08, September 22, 2025
Line 108:		Line 108:
	*[https://info.unmc.edu/its-security/policies/procedures/thirdparty.html Third Party Registry Procedure]		*[https://info.unmc.edu/its-security/policies/procedures/thirdparty.html Third Party Registry Procedure]
	*[https://wiki.unmc.edu/index.php/Business_Associate_Agreements_and_Addendums_Procedures Business Associate Agreements and Addendums Procedures]		*[https://wiki.unmc.edu/index.php/Business_Associate_Agreements_and_Addendums_Procedures Business Associate Agreements and Addendums Procedures]
	*[https://~~app1~~.unmc.edu/~~forms~~/~~its~~/~~third_party_registry~~.~~cfm~~ Third Party Registry Form]		*[https://info.unmc.edu/its-security/policies/procedures/thirdparty.html Third Party Registry Form]
	*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]		*[https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final NIST Special Publication 800-53]
	*[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996] (HIPAA)		*[https://www.cdc.gov/phlp/publications/topic/hipaa.html Health Insurance Portability and Accountability Act of 1996] (HIPAA)

Mhurlocker: /* Policy */

2023-08-01T20:10:37Z

Policy

← Older revision		Revision as of 15:10, August 1, 2023
Line 44:		Line 44:
	##Quality Objective - Quantifiable benefits due to specified quality goals		##Quality Objective - Quantifiable benefits due to specified quality goals
	##Research Objective - Quantifiable benefits due to specified research goals		##Research Objective - Quantifiable benefits due to specified research goals
	#Data is ~~efficently~~ collected		#Data is efficiently collected.
	##Data quality		##Data quality
	###The third-party vendor will provide a quality assurance process to ensure that the collected data is accurate prior to submission.		###The third-party vendor will provide a quality assurance process to ensure that the collected data is accurate prior to submission.

Dpanowic: /* Affiliated Covered Entity (ACE) */

2022-09-26T17:13:36Z

Affiliated Covered Entity (ACE)

← Older revision		Revision as of 12:13, September 26, 2022
Line 77:		Line 77:
	==Definitions==		==Definitions==
	===Affiliated Covered Entity (ACE)===		===Affiliated Covered Entity (ACE)===
	Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. Access and amendment rights apply to designated record sets throughout the ACE.		Legally separate covered entities that are affiliated and designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. Access and amendment rights apply to designated record sets throughout the ACE.

	===Data Elements===		===Data Elements===
	The items collected by a third-party registry.		The items collected by a third-party registry.

Dpanowic at 16:30, September 22, 2022

2022-09-22T16:30:08Z

← Older revision		Revision as of 11:30, September 22, 2022
Line 26:		Line 26:
	</table>		</table>
	<br />		<br />
	[[Identification Card]] \| [[Secure Area Card Access]] \| [[Privacy/Confidentiality]] \| [[Computer Use/Electronic Information]] \| [[Retention and Destruction/Disposal of Private and Confidential Information]] \| [[Use and Disclosure of Protected Health Information]] \| [[Notice of Privacy Practices]] \| [[Access to Designated Record Set]] \| [[Accounting of PHI Disclosures]] \| [[Patient/Consumer Complaints]] \| [[Vendors]] \| [[Fax Transmissions]] \| [[Psychotherapy Notes]] \| [[Facility Security]] \| [[Conditions of Treatment Form]] \| [[Informed Consent for UNMC Media]] \| [[Transporting Protected Health Information]] \| [[Honest Broker]] \| [[Social Security Number]] \| [[Third Party Registry]] \| [[Information Security Awareness and Training]]		[[Identification Card]] \| [[Secure Area Card Access]] \| [[Privacy/Confidentiality]] \| [[Computer Use/Electronic Information]] \| [[Retention and Destruction/Disposal of Private and Confidential Information]] \| [[Use and Disclosure of Protected Health Information]] \| [[Notice of Privacy Practices]] \| [[Access to Designated Record Set]] \| [[Accounting of PHI Disclosures]] \| [[Patient/Consumer Complaints]] \| [[Vendors]] \| [[Fax Transmissions]] \| [[Psychotherapy Notes]] \| [[Facility Security]] \| [[Conditions of Treatment Form]] \| [[Informed Consent for UNMC Media]] \| [[Transporting Protected Health Information]] \| [[Honest Broker]] \| [[Social Security Number]] \| [[Third Party Registry]] \| [[Information Security Awareness and Training]] \| [[Patient Privacy Investigations and Levels of Violation]] \| [[Use and Disclosure of PHI for Training Health Care Professionals]] \| [[Disclosures of PHI as Permitted or Required by Law]] \| [[Disclosure of PHI for Law Enforcement Purposes]]
	<br /><br />		<br /><br />
	Policy No.: '''6300'''<br />		Policy No.: '''6300'''<br />

Dpanowic at 21:42, September 20, 2022

2022-09-20T21:42:43Z

← Older revision		Revision as of 16:42, September 20, 2022
Line 38:		Line 38:
	==Policy==		==Policy==
	The following serve as the guiding principles to follow when selecting a third-party vendor:		The following serve as the guiding principles to follow when selecting a third-party vendor:
	#Organizational Goals - the envisioned goals of the submission shall be clearly documented and communicated to assess the benefits versus risks to form a recommendation on why the submission ~~shall~~ proceed.		#Organizational Goals - the envisioned goals of the submission shall be clearly documented and communicated to assess the benefits versus risks to form a recommendation on why the submission should proceed.
	##Incentive Bonus - The amount the payer will increase payment if organization participates in the registry and the date required to submit to achieve.		##Incentive Bonus - The amount the payer will increase payment if organization participates in the registry and the date required to submit to achieve.
	##Penalty Avoidance - The amount payer will decrease payment if organization does not participate in the registry and date required to submit to avoid penalty.		##Penalty Avoidance - The amount payer will decrease payment if organization does not participate in the registry and date required to submit to avoid penalty.

Dpanowic at 21:41, September 20, 2022

2022-09-20T21:41:43Z

Dpanowic at 21:38, September 20, 2022

2022-09-20T21:38:48Z

Show changes

Afaylor at 18:08, August 2, 2019

2019-08-02T18:08:23Z

← Older revision		Revision as of 13:08, August 2, 2019
Line 27:		Line 27:
	<br />		<br />
	[[Identification Card]] \| [[Secure Area Card Access]] \| [[Privacy/Confidentiality]] \| [[Computer Use/Electronic Information]] \| [[Retention and Destruction/Disposal of Private and Confidential Information]] \| [[Use and Disclosure of Protected Health Information]] \| [[Notice of Privacy Practices]] \| [[Access to Designated Record Set]] \| [[Accounting of PHI Disclosures]] \| [[Patient/Consumer Complaints]] \| [[Vendors]] \| [[Fax Transmissions]] \| [[Psychotherapy Notes]] \| [[Facility Security]] \| [[Conditions of Treatment Form]] \| [[Informed Consent for UNMC Media]] \| [[Transporting Protected Health Information]] \| [[Honest Broker]] \| [[Social Security Number]] \| [[Third Party Registry]] \| [[Information Security Awareness and Training]]		[[Identification Card]] \| [[Secure Area Card Access]] \| [[Privacy/Confidentiality]] \| [[Computer Use/Electronic Information]] \| [[Retention and Destruction/Disposal of Private and Confidential Information]] \| [[Use and Disclosure of Protected Health Information]] \| [[Notice of Privacy Practices]] \| [[Access to Designated Record Set]] \| [[Accounting of PHI Disclosures]] \| [[Patient/Consumer Complaints]] \| [[Vendors]] \| [[Fax Transmissions]] \| [[Psychotherapy Notes]] \| [[Facility Security]] \| [[Conditions of Treatment Form]] \| [[Informed Consent for UNMC Media]] \| [[Transporting Protected Health Information]] \| [[Honest Broker]] \| [[Social Security Number]] \| [[Third Party Registry]] \| [[Information Security Awareness and Training]]

	<br /><br />		<br /><br />
	Policy No.: '''6300'''<br />		Policy No.: '''6300'''<br />

Afaylor: add Faculty tab

2019-08-02T18:07:30Z

add Faculty tab

← Older revision		Revision as of 13:07, August 2, 2019
Line 20:		Line 20:
	<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"		<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
	width="20">[[Intellectual Property]]</td>		width="20">[[Intellectual Property]]</td>
			<td style="border-bottom:2px solid #A3B1BF" width="3"> </td>
			<td style="padding:0.5em; background-color:#e5e5e5; font-size:90%; line-height:0.95em; border:1px solid #A3B1BF; border-bottom:solid 2px #A3B1BF"
			width="20">[[Faculty]]</td>
	</tr>		</tr>
	</table>		</table>

← Older revision		Revision as of 16:41, September 20, 2022
Line 38:		Line 38:
	==Policy==		==Policy==
	The following serve as the guiding principles to follow when selecting a third-party vendor:		The following serve as the guiding principles to follow when selecting a third-party vendor:
	#Organizational Goals - the envisioned goals of the submission ~~should~~ be clearly documented and communicated to assess the benefits versus risks to form a recommendation on why the submission ~~should~~ proceed.		#Organizational Goals - the envisioned goals of the submission shall be clearly documented and communicated to assess the benefits versus risks to form a recommendation on why the submission shall proceed.
	##Incentive Bonus - The amount the payer will increase payment if organization participates in the registry and the date required to submit to achieve.		##Incentive Bonus - The amount the payer will increase payment if organization participates in the registry and the date required to submit to achieve.
	##Penalty Avoidance - The amount payer will decrease payment if organization does not participate in the registry and date required to submit to avoid penalty.		##Penalty Avoidance - The amount payer will decrease payment if organization does not participate in the registry and date required to submit to avoid penalty.
Line 57:		Line 57:
	###Must comply with File Transfer of Confidential Information Guidelines		###Must comply with File Transfer of Confidential Information Guidelines
	##Access to the system needs to use user authentication through integration with Active Directory or LDAP		##Access to the system needs to use user authentication through integration with Active Directory or LDAP
	##Transferred and stored data shall not be portable and there ~~should~~ be restrictions on the usage of portable storage methods like USB drives or exports to flat files		##Transferred and stored data shall not be portable and there shall be restrictions on the usage of portable storage methods like USB drives or exports to flat files
	##The vendor shall provide appropriate cyber liability coverage that covers the Organization in the event of a security or privacy breach and shall provide coverage for the following scenarios:		##The vendor shall provide appropriate cyber liability coverage that covers the Organization in the event of a security or privacy breach and shall provide coverage for the following scenarios:
	###Allowing, or failing to prevent, unauthorized access to the system		###Allowing, or failing to prevent, unauthorized access to the system
Line 69:		Line 69:
	###Compliance with section 164.514(a) of the HIPAA Privacy Rule which provides the standard for de-identification of protected health information by usage of either the “Expert Determination” method or the “Safe Harbor” method		###Compliance with section 164.514(a) of the HIPAA Privacy Rule which provides the standard for de-identification of protected health information by usage of either the “Expert Determination” method or the “Safe Harbor” method
	####The system shall apply the standard for de-identification method to both discrete and non-discrete data sets (e.g. narrative notes).		####The system shall apply the standard for de-identification method to both discrete and non-discrete data sets (e.g. narrative notes).
	###Upon the event of terminating the relationship with a third party, all PHI data ~~should~~ be removed from the system.		###Upon the event of terminating the relationship with a third party, all PHI data shall be removed from the system.
	###The third party does not have the right to use PHI data in any manner outside the explicit purpose of the submission (e.g. cannot re-sell PHI data to another party).		###The third party does not have the right to use PHI data in any manner outside the explicit purpose of the submission (e.g. cannot re-sell PHI data to another party).
	###The system shall be able to remove a patient’s PHI data in the event the patient wants to be excluded from the registry after we begin submitting data to the third party.		###The system shall be able to remove a patient’s PHI data in the event the patient wants to be excluded from the registry after we begin submitting data to the third party.