To Privacy Rule requires a covered entity to address HIPAA training, a complaint process, a mitigation process, sanctions for noncompliance and business associate agreements.  Specifically, these are elements of Accountability in HIPAA.

Administrative Requirements

The Privacy Rule holds a covered entity accountable to comply with rules that safeguard protected health information or PHI. What’s more, this is made clear through its administrative requirements that apply to covered entities, and to business associates.

Some administrative requirements apply to the business associate contractually through a business associate contract or agreement with a covered entity and others apply to it directly.
The Security Rule standards and implementation specifications apply directly to business associates. As a result, these Rules safeguard electronic protected health information (EPHI).

Training and Sanctions:

Firstly, a covered entity must train workforce members on its policies and procedures, as appropriate for the workforce members to perform their job functions involving PHI.

Secondly, a covered entity also must have and apply appropriate sanctions for workforce members who violate the Privacy Rule or the entity’s own privacy policies and procedures.

Finally, if a covered entity’s privacy practices change, the entity’s training and sanction policies may need to address these changes. Consequently, they must consider the responsibility for accessing, using, and disclosing PHI, the types of noncompliance that may arise in an electronic environment, and the appropriate sanctions for such noncompliance.

Complaint Process :

The Privacy Rule requires a covered entity to develop and implement procedures which allow individuals to make complaints about its compliance with the Privacy Rule, as well as its own privacy policies and procedures.

Mitigation:

A covered entity must mitigate, to the extent practicable, any harmful effects that are known to the covered entity and that result from a use or disclosure of PHI in violation of its own privacy policies and procedures or the Privacy Rule by the covered entity or its business associates.

Liability for Violations of the HIPAA Privacy Rule:

Covered entities who violate the Privacy Rule, are liable for civil monetary penalties.

Business Associate Contracts or Agreements:

A covered entity must include information in its business associate contracts or Agreements on the requirement for the business associate to report impermissible uses and disclosures or breaches of PHI to the covered entity and the way it should do so.