CORA...Our Company

How do you assure that CORA is HIPAA compliant?
What is the process to assure that the laboratory sends us deidentified data?
Who establishes the coding system?
How does CORA keep an arms length transaction from the laboratory on patient specific identifiers?
Is patient disclosure required?

How do you assure HIPAA compliance with CORA?

All patient information within CORA meets the de-identification provisions of HIPAA at 45 C.F.R. § 164.514.
Validation occurs when files are uploaded and processed. Any violations within the file of the HIPAA de-identification provisions are immediately flagged with the following actions:

CORA rejects all data specific to the violation within the file
and does not process

Clinic / User is notified via email of the specific violations and
the disposition of the data not processed

What is the process to assure that the laboratory sends to CORA de-identified data?

All the major laboratories involved in the Amgen Partners Information Program (PIP) are familiar with de-identification and have a defined process to ensure that the privacy provisions of HIPAA are maintained. Please contact your laboratory provider for more specific information.

Who establishes the coding system?

Your laboratory provider establishes the de-identification processes and coding system. For further information, please contact your provider (also, see Q2 above.).

How does CORA keep an arms length transaction from the laboratory on patient specific identifiers?

Your current laboratory services agreement should address all patient privacy & HIPAA concerns. You initiate the request that de-identified information be sent to CORA. CORA does not have access to the processes followed or the coding systems used.

Is patient disclosure required?

CORA's data use agreement defines a limited data set (LDS.) An LDS agreement is very similar to a Business Associates agreement in that it specifies what the data can be used for and assures recipients will only use data for those purposes specified in the LDS agreement etc. There is no need for patient permission or notice for data being used, as the LDS agreement will protect the rights of the patients and the use of their Personal Health Information (PHI.)

All patient information within CORA meets the de-identification provisions of HIPAA at 45 C.F.R. § 164.514.

Validation occurs when files are uploaded and processed. Any violations within the file of the HIPAA de-identification provisions are immediately flagged with the following actions:

All the major laboratories involved in the Amgen Partners Information Program (PIP) are familiar with de-identification and have a defined process to ensure that the privacy provisions of HIPAA are maintained. Please contact your laboratory provider for more specific information.

Your laboratory provider establishes the de-identification processes and coding system. For further information, please contact your provider (also, see Q2 above.).

Your current laboratory services agreement should address all patient privacy & HIPAA concerns. You initiate the request that de-identified information be sent to CORA. CORA does not have access to the processes followed or the coding systems used.