Laserfiche WebLink
E. Documentation Requirements <br />Virtru must maintain the required policies and procedures in written or electronic form, <br />and must maintain written or electronic copies of all communications, actions, activities <br />or designations as are required to be documented hereunder, or otherwise under the <br />Privacy Rules, for a period of six (6) years from the later of the date of creation or the last <br />effective date. <br />F. Enforcement <br />Any employee found to have violated this policy shall be subject to disciplinary action, up <br />to and including termination of employment. In the case where inappropriate access, use <br />or disclosure of Personally -Identifiable Information was or may have been involved, such <br />individuals may additionally be reported to the appropriate enforcement agencies. <br />IV. Minimum Necessary Standard <br />A. Overview <br />The Privacy Rules place certain restrictions on the receipt, use and disclosure of <br />Personally -Identifiable Information in regards to the amount reasonably necessary to <br />accomplish the task being performed. However, the Privacy Rules also allow <br />Personally -Identifiable Information to be disclosed for business appropriate needs. <br />The policies developed by Virtru will follow this business appropriate philosophy as well <br />as that of administrative simplification, which is the subsection of the HIPAA law under <br />which the Privacy Rule was developed. Virtru shall use standard data formats for <br />information acquisition or disclosure and tailor these formats to contain a business <br />reasonable minimum necessary amount of Personally -Identifiable Information. The <br />Company's policies establish the minimum necessary use provisions for <br />Personally -Identifiable Information in the custody of Virtru employees. <br />B. Purpose <br />To issue instructions regarding Virtru's obligations relating to the Privacy Rules to <br />obtain, use and disclose only the minimum amount of Personally -Identifiable Information <br />(PHI) necessary to accomplish the intended purpose. <br />C. Applicability <br />This policy applies to all Virtru employees, which is defined for the purposes of this <br />document to be employees of all current and future subsidiaries of the Company. <br />D. Policy <br />Virtru will make reasonable efforts to ensure that the Minimum Necessary amount of <br />Personally -Identifiable Information is disclosed, used, or requested to accomplish the <br />intended purpose. Exceptions to the Minimum Necessary Standard include disclosures: <br />1. To the individual who is the subject of the information; <br />11 <br />Rev.2015.8.25 <br />