For payment, treatment, and health care operations; create a consent form containing all required elements
For all other uses or disclosures; create an authorization form; must contain all information specified in the regulation

Identify your business associates
Enter into a contract with each business associates (this includes accreditation agencies such as JCAHO) that complies with the requirements of the regulation

Ensure that you have a notice written in plain language that contains all the required elements
Place the notice on a Website, or send by e-mail, but also make available in paper copy
Ensure that the notice remains current; if material changes are made, inform patients
Understand that the notice has the effect of a contract with respect to the covered entry's policies and practices
Regarding the use and disclosure of protected health information

Write and implement policies and procedures for "minimum necessary" disclosures
Write and implement policies and procedures about who had access to protected health information, and the conditions that apply to such access. The policy must discuss access to information by any trainees ( residents, medical students, and other students)

Restrict access to their protected health information
Receive an accounting of all disclosures of protected health information for the past six years
Allow inspection and copying of protected health information
Amend protected health information
Permit the individual to receive communications of protected health information in an alternative way

If the research relates to treatment, obtain consent; consent may be combined with a research authorization
Rely on pre-existing consent for protected health information created or received prior to the compliance date of this regulation (2/23/02)
Decide whether an IRB and/ or a PB will be given authority to grant a waiver of authorization for research
Ensure that the IRB and/ or PB is properly constituted
When a waiver of authorization is granted, ensure that all necessary elements
have been considered and documented
Establish policies and procedures for the use and disclosure of protected health information for reviews preparatory to research.
If an individual's right to access to protected health information is restricted during the trial, ensure that such restrictions are lifted once the trial is complete.

Patient directory, limit information to that allowed by rule; let patients opt-out of the directory
Marketing; face-to-face, or in compliance with rule
Fundraising; limited to general appeals without authorization