Laserfiche WebLink
2. Made pursuant to an authorization provided by the individual; <br />3. To healthcare providers for treatment purposes; <br />4. Required for compliance with the standardized HIPAA transactions; <br />5. Made to the Secretary of HHS or his agent pursuant to a privacy investigation; <br />6. Otherwise required by the Privacy Rules or other law. <br />Employees shall be trained on the policies and procedures developed to apply these <br />principles to the use or disclosure of, or requests for Personally -Identifiable Information. <br />E. Procedures <br />The following procedures will be implemented to ensure that this policy is enforced <br />effectively across all parts of Virtru. <br />1. Each user of a system which accesses Personally -Identifiable Information shall <br />be identified and the classes or types of PII to which access is needed and any <br />conditions appropriate to such access will be established. It will be the <br />responsibility of the Privacy Officer to maintain this information using the <br />Employee Access Request Form [Forms for Employees] and System Access Log <br />[Change Control Logs for Security]. <br />2. Reasonable efforts will be taken to limit the access of each user of <br />Personally -Identifiable Information to the amount needed to carry out the <br />individual's duties. These efforts will include internal use of PII. <br />3. For situations where Personally -Identifiable Information disclosure occurs on a <br />routine and recurring basis, the PII disclosed will be limited to the amount of <br />information reasonably necessary to achieve the purpose of the disclosure. <br />4. Requests for disclosures that are not routine and recurring and thereby <br />covered by Virtru standard procedures (other than to the individual, the <br />Secretary of HHS or his agent, or where required by law) shall be reviewed by <br />the Privacy Officer to determine that the Minimum Necessary Standard is <br />applied to the extent reasonable. <br />S. Questions regarding these procedures should be directed to the Virtru Privacy <br />Officer, Will Ackerly, willackerly@virtru.com, or (202) 577-3683. <br />F. Enforcement <br />An employee found to have violated this policy shall be subject to disciplinary action, up <br />to and including termination of employment. In the case where inappropriate access or <br />use or disclosure of Personally -Identifiable Information was or may have been involved, <br />such individuals may additionally be reported to the appropriate enforcement agencies. <br />Rev.2015.8.25 <br />12 <br />