System shall have a process by which an individual can make a complaint to the Privacy Officer regarding System’s compliance with the HIPAA Privacy Standards or any of the policies and procedures compiled in this Manual.
7.7(1) Responsibility for Receiving a Complaint
An Individual shall have the right to submit a complaint to System relating to System’s compliance with any of the policies and procedures compiled in this Manual and System’s compliance with the HIPAA Privacy Standards. The Privacy Officer or his/her designee shall be responsible for receiving and keeping a log of such complaints.
7.7(2) Filing a Complaint.
7.7(3) Investigation of Privacy Complaints.
7.7(4) Correction of Discovered Privacy Violation.
If it is determined that any provision of the policies and procedures compiled in this Manual violates the law or otherwise needs modification, this Manual shall be revised in accordance with Section 9.1 of this Manual. If it is determined that System has violated either this Manual or the HIPAA Privacy Standards, such violation shall be corrected in accordance with Section 8.4 of this Manual, and if the violation is continuing, it shall be stopped. If the Privacy Officer determines that Workforce Members or other employees have violated the Manual or other System policies, the Privacy Officer shall refer the matter for Sanctions in compliance with Section 8.5 of this Manual and/or disciplinary action in accordance with System policy, as applicable.
7.7(5) Notice of Resolution of Privacy Complaints.
The Privacy Officer, may provide the complaining person with written notice of the decision regarding the complaint that includes (i) the name of the person handling the complaint; (ii) the fact that an investigation has taken place or will take place; (iii) the date of completion or expected completion; and (iv) either the result of the investigation or notification that due to the confidential and privileged nature of the peer review/quality review process, the results of such proceedings may not be communicated to the person. A copy of any such notice shall be retained in accordance with Section 9.2 of this Manual.
7.7(6) Document Retention.
System shall retain documentation of any complaint, including misdirected complaints, received, and its disposition. Such documentation shall be retained in accordance with Section 9.2 of this Manual.
7.7(7) Misdirected Complaints
Upon receipt of any complaint received by the Privacy Officer that alleges a violation by an entity other than System, the complaint shall be returned to the individual filing the complaint advising them that the complaint cannot be considered by System as it does not involve action by or on behalf of the System Hybrid Entity.
45 C.F.R. § 164.530(a), (d)