Hamilton County adopts HIPAA policies, schedules compliance working group

Hamilton County’s commission moved to adopt a formal set of HIPAA policies and procedures that county staff said are aimed at standardizing privacy practices across general government functions.

The county attorney explained the policies grew out of a March re‑designation making the county a ‘‘hybrid entity’’ for HIPAA purposes and said the compliance department and the county attorney’s office have spent months formalizing the document. "With doing that and with the creation of the compliance department under our office...we have taken months to formalize our HIPAA policies and procedures," the attorney said.

The attorney told commissioners the policies will enable a new Notice of Privacy Practices, allow the county to expand internal training and compliance work, and establish a working group to help implement the policies. The resolution states the working group will meet at least quarterly; the attorney said the goal is to have initial arrangements in place by about Aug. 1.

Commissioner Sharp and others asked whether the policies address committee composition and how commissioners will be kept informed about potential violations. The attorney said the policies set substance and procedures but do not themselves change committee makeup (which is set by separate resolution). For breach reporting, the attorney identified policy number 114 as the county’s breach and breach‑notification policy and pointed members to that section in the packet.

Why it matters: Adopting the policies centralizes privacy rules and creates formal reporting and implementation channels at a time when county staff said they will expand internal HIPAA safeguards and public notices.

Next steps: The commission adopted the policies on the agenda; staff said they will stand up the working group and return with follow‑up items as needed.