A look at organization, policies, documentation

The organizational requirements of HIPAA address two matters - standards for business associates and standards for group health plans. Only the standard for business associates needs to be implemented at the pharmacy. As with the privacy standards, if the pharmacy learns of a pattern of activity or practice of the business associate that constitutes a material breach or violation of the business associate's obligations under the contract, the pharmacy must take reasonable steps to cure the breach or end the violation. Extensive information and guidance are available in the HIPAA Security Handbook published by NCPA.