University of Florida Privacy Office

Transcription

1 University of Florida Privacy Office OUR MISSION To ensure institutional compliance with federal and state privacy regulations, as well as industry standards, for restricted information collected, used, or stored by the University. To provide centralized resources, oversight and enforcement for privacy-related activities along with consultative services to assure privacy protections are well understood and established at the University of Florida. OUR CORE RESPONSIBILITIES 1. Develop, implement, and maintain University privacy-focused policies, procedures and guidelines that comply with statutory mandates and industry regulations. 2. Deliver privacy-related training and oversee privacy program monitoring, auditing, and enforcement as required by privacy statutes and standards. 3. Serve as the central contact and investigation authority for privacy complaints, incidents, and breaches. To coordinate the privacy breach notifications when required. Maintain the University s Identity Theft Prevention Program. 4. Evaluate opportunities to reduce privacy risks and to execute program modifications that advance overall privacy compliance. Inform senior leadership about status of privacy compliance initiatives. 5. Establish university business processes for privacy compliance efficacy. Maintain campus service agreements that protect restricted information. 6. Coordinate University medical records management and to provide consultation as University clinics transition to electronic medical record systems. 7. Partner with internal and external organizations to offer privacy best practices, and consulting services that serve the global interests of the University.

2 THE SCOPE OF PRIVACY REGULATION AT UF Federal Statutes: Communications-related Statutes Children s Online Privacy Protection Act (COPPA) Cable Communications Policy Act Electronic Communications Privacy Act Family Education Rights and Privacy Act (FERPA) Federal Privacy Act of 1974 Finance-related Statutes Fair Credit Reporting Act (FCRA) Financial Services Regulatory Relief Act of 2006 Graham-Leach-Bliley Act (GLBA) Right to Financial Privacy Act Health-related Statutes Americans with Disabilities Act (ADA) Federal Substance Abuse Record Confidentiality Health Insurance Portability & Accountability Act (HIPAA) for University and Affiliated Covered Entities medical components: Faculty Practice Plans (e.g. FGP, UFJP/JHI, etc.); Health Science Center Colleges (, Dentistry, Medicine, Nursing, Pharmacy, Public Health & Health Professions, Veterinary Medicine); College of Liberal Arts & Sciences (Speech & Audiology); Institute for Food & Agricultural Sciences (Dietetics); Student Health Care Center; Institutional Review Boards, Benefit and Disability Plans, and the UF Foundation. Organized Health Care Arrangement: Shands Health Care System Veterans Administration Medical Center Business Associates Patriot Act

3 Florida Statutes: Chapter 90: Evidence Chapter 390: Mental Health Chapter 395: Health Care Organizations Chapter 397: Substance Abuse Chapter 440: Worker s Compensation Chapter 456: Medical Records Chapter 458: Board of Medicine Chapter 501: Consumer Protection Chapter 817: Privacy Breach Notification Chapter 1002: Student Records Chapter 1006: Student Records International Regulations Canada: Personal Information Protection & Electronic Documents Act (PIPEDA) Council of Europe Convention for the Protection of Human Rights and Fundamental Freedom; European Union Data Protection Directive, Articles 1-33 US Department of Commerce s Safe Harbor Privacy Principles Additional regulations in Argentina, Australia, Hungary, Iceland, Ireland, Japan, the Netherlands, and elsewhere. Industry Standards Payment Credit Industry Data Security Standards (PCIDSS)

4 OUR PERSONNEL Susan Blair, MSJ, MBA, CIPP, CCEP, CIA: Chief Privacy Officer, University of Florida. Vacant: Privacy Manager, Jacksonville. Mary Anne Norris, MIB, CIA: Privacy Auditor. Everall Peele, MPH, RHIA, LHRM, CCS: Privacy Training Coordinator. Caroel DeBose, MBA: The NPI Project Coordinator/Privacy Analyst. Lisa Van Nocker: Privacy Program Administrative Assistant.

5 PRIVACY OFFICE BUDGET SUBMISSION FOR RCM SYSTEM Scope: All campus privacy-related activities for University of Florida and its affiliate organizations; dominant service locations are Gainesville and Jacksonville Budget Assumptions o Labor: Gainesville staff: 5 FTEs including Chief Privacy Officer, 3 staff positions, and 1 administrative assistant. These positions provide campus support as well as serve the Health Science Colleges, the Student Health Center, and the numerous UF institutes. Because the Gainesville staff did not receive compensation changes with scope expansion in 2007, Special Payment Increases (SPIs) were prepared and submitted in December 2009 and January 2010 following evaluation of revised job descriptions. Budget add: $78,000, which is recurring baseline expense. Jacksonville: 1FTE. This position is transferring from the Jacksonville COM Faculty Practice Group to the Privacy Office, effective January 4, This position will serve all UF employees in Jacksonville, the two Jacksonville faculty practice groups, and the Proton Therapy Institute. Budget add: $70,000, which will be billed as special payment to College of Medicine, Jacksonville. o Non-labor: Adjusted for one-time expense to replace HIPAA mandated Disclosure Tracking System; HITECH regulations (effective June 2010) will expand disclosure tracking to authorized and unauthorized disclosures causing expanded tracking requirements. Current system cannot manage doubling of entries for disclosure tracking. Budget add: $25,000. Adjusted for inclusion of Jacksonville staff/location oversight and operational expenses, for remote site audits (travel), and CEUs to maintain professional credentials. Budget add: $3,000. Budget History FY08 FY09 FY10 Budget 520, , ,907 Actual 511, , ,874 (1Q,2Q) Recommendations for Special Payments or Direct Assessments o Jacksonville billed for Jacksonville staff position $70,000 o Organizations pay for direct expenses associated with breach activity: Reproduction Services, Postage, and Call Center coverage. Contracted vendors to offer discounted pricing. o Special consulting services, i.e. out-of-state training, to include travel, lodging, and other relevant specialty training program expenses.

6 FY 2011 Projected Annual Uses of Funds Statement College/Office Name: Department Name: DeptID (Level 4) Person Completing Form: Phone Number: Senior Vice-President for Administration Privacy Office 2701 S. Blair FY 2011 Proposed FY 2010 Budget FY 2009 Actual FY 2008 Actual FTE Salaries & Benefits $628,796 $480,796 $450,113 $450,333 Other Personal Services $0 $0 $0 Total Salaries & Benefits $628,796 $480,796 $450,113 $450,333 Contractual Services $25,000 $2,000 $6,807 $175 Repairs & Maintenance $500 $500 $1,815 $0 Data Processing $0 $0 $20,000 Office Supplies / Software / Materials / Pubs $5,500 $2,000 $2,604 $3,089 Rent $0 $0 $0 Printing & Reproduction $400 $1,000 $67 $1,401 Insurance $0 $0 $0 Telephone $1,200 $1,245 $1,090 Postage & Freight $100 $1,160 $92 $117 Educational Supplies $0 $0 $0 Food $500 $97 $284 Advertising $150 $0 $0 Travel $6,000 $5,000 $12,774 $19,901 Dues & Subscriptions $1,500 $1,500 $1,499 $2,437 Miscellaneous Other/ Contingencies $1,000 $101 $0 $0 Total Operating Expenses $40,000 $15,111 $27,000 $48,496 Equipment $0 $0 $0 Library Resources $0 $0 $0 Financial Aid $0 $0 $0 Debt-Service $0 $0 $0 Total Other $0 $0 $0 $0 Administrative Overhead $0 $0 $0 Other Transfers Out $0 $23,514 $1,000 Net Transfers $0 $0 $23,514 $1,000 Total Expenditures $668,796 $495,907 $500,627 $499,828 Explanations: (Complete as necessary) 2 FTE paid from Fund 185; 3 FTE paid from Fund 102

7 Privacy Office Functions* Privacy Policy Development, Maintenance & Enforcement Privacy Education, Training & Communications Privacy Violation & Breach Investigations UF Privacy Organizational Chart Senior Vice President for Administration Chief Privacy Officer Administrative Assistant Privacy Monitoring & Auditing Restricted Data Physical Security Business Associate Agreements Privacy Training & HIM Coordinator Privacy Analyst Privacy Auditor Jacksonville Privacy Manager Health Information and Record Coordination FERPA Privacy Oversight SSN Safeguards Other Privacy Oversight: IRB s, HITECH, PCIDSS, GINA, GLBA, etc. *Required by law.