The Office of Privacy

The Office of Privacy values and respects individuals’ privacy and actively seeks to preserve the privacy rights of those who share their information with us. Our office serves as the first point of contact for issues with faculty/staff related to privacy standards at the University of Colorado Denver | Anschutz, including sites where our faculty practice such as the University of Colorado Health and Children’s Hospital Colorado.

The Health Insurance Portability and Privacy Act: HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) is a U.S. law designed to provide privacy standards to protect patients’ medical records and other health information provided to health plans, billing/coding companies, doctors, hospitals, and other health care providers (known as Covered Entities)

The HIPAA Privacy Rule regulates the use and disclosure of individually identifiable health information and gives individuals the right to determine and restrict access to certain health information. Compliance with HIPAA’s privacy regulations became required on April 14, 2003, and is managed by the HIPAA Privacy Officer. Noncompliance with HIPAA regulations can result in substantial penalties, both civil and criminal.

The HIPAA Security Rule requires that reasonable and appropriate administrative, physical and technical safeguards be taken with electronic individually identifiable health information. Specifically, we must ensure the confidentiality, integrity and availability of all electronic protected health information (ePHI) we create, receive, maintain or transmit. Compliance with HIPAA’s security regulations became required on April 21, 2005, and is managed by the Office of Information Technology’s IT Security and Compliance team.

Covered Entities are health plans, health care providers and health care clearinghouses (entities that process nonstandard information they receive from another entity into a standard format or data content, or vice versa) who electronically transmit any health information in connection with transactions for which the US Department of Health & Human Services (HHS) has adopted standards.

The University is considered a “Hybrid Entity” under HIPAA, which means that some parts of the University are subject to HIPAA and others are not. The University’s health plans, its health care provider services and those that may access Protected Health Information (PHI) to support the plans or health care provider services are subject to HIPAA.

Healthcare Components covered under HIPAA include all University departments EXCEPT the following departments:

University Programs Not Included in HIPAA

Alumni Relations Office

Biochemistry and Molecular Genetics

Cellular and Structural Biology

Center for Lab Animal Care

Continuing Medical Education

Facilities Operations

Immunology

Institutional Animal Care and Use Committee

Microbiology

Office of Finance and Administration

Pharmacology

Physiology and Biophysics

Tools for Safeguarding Data and Patient Privacy

About PHI

Fact Sheet

Incident Reporting

Data Sharing Portal

Code of Conduct

IS/IT Compliance

Contact Our Privacy Officers

Our office serves as a partner to all through research, medical advancement and ethical and legal concerns related to the protection of data use and the privacy of individuals. Our office reviews protocols using protected information to prevent breaches as well as handles compliance issues arising when breaches occur.

Office of the Vice Chancellor for Research

CU Anschutz

Fitzsimons Building

13001 East 17th Place

Mail Stop F520

Aurora, CO 80045

Associate Vice Chancellor for Research and Chief Research Officer, Philip De Leon, PhD

Tools & Resources

Schools & Colleges

CU Denver

CU Anschutz

CU Campuses

Privacy | HIPAA

Regulatory Compliance

The Office of Privacy

The Health Insurance Portability and Privacy Act: HIPAA

Tools for Safeguarding Data and Patient Privacy

Contact Our Privacy Officers

Office of the Vice Chancellor for Research