text:
Welcome to our website! In the following, we want to detail which data we process when and to what purpose and on which legal basis. This is to explain how the services we offer work and how the protection of your personal data is guaranteed in doing so.
According to article 4(1) of the General Data Protection Regulation (GDPR), personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly. For more information see GDPR art. 4(1), among others.
To view, save and print this Data Privacy Statement at any time go to https://www.munich-business-school.de/en/legal/privacy-policy.html.
In each chapter, we will specifically refer to the right of objection again (e.g. by stating: “You have the right of objection”), provided there is such a right. There, you will also find additional information with regard to exercising your right of objection.
to object at any time to the processing of your personal data. When this happens, we will cease processing your personal data for the purpose of direct marketing or any profiling related to such direct marketing.
Neither will we process your personal data for any other purposes after your objection unless we can demonstrate compelling legitimate grounds for such processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims (see e.g. GDPR art. 21(1), the so-called “limited right of objection”). In this case you will have to state reasons for the objection on grounds relating to your particular situation.
Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to GDPR art. 89(1), you have the right to object to processing of your personal data on grounds relating to your particular situation unless such processing is necessary for the performance of a task carried out for reasons of public interest (see GDPR art. 21(6)).
In order to help clarify the following Data Privacy Statement, we will include various links to information and data protection notes on external websites (see also chapter titled “Social Networks & External Links” in this Data Privacy Statement). We aim to diligently update the links included in this Data Privacy Statement as necessary. Nevertheless, it is possible that links might not work properly due to periodic updating of the cited websites. If you encounter a dead or broken link, we ask that you inform us so we can replace it with an updated link.
We process this data in order to enable your device to access our website and enable the correct display of our website on your device and in your browser. In addition, the data serves to optimize our website and to ensure the security of our systems. Interpretation of these data is not used for the purpose of marketing.
The legal basis for our processing of this data is GDPR art. 6(1)(f). We have a legitimate interest in providing you a website, which is optimized for your browser, and in allowing communication between our server and your terminal device. For the latter, the processing of your IP address is necessary in particular.
The processed information will be stored only as long as this is necessary for the intended purpose or as is required by law.
The recipient of the data is our server host which operates on our behalf in the context of a commissioned data processing agreement.
You have the right of objection. You can send or inform us about your objection at any time (e.g. by emailing your objection to datenschutz(at)eso.de).
Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our website at all or to the full extent possible.
Cookies which contain a randomly generated specific identification number which will make you and/or your device identifiable during your visit to our website. These cookies will be deleted automatically at the end of your visit.
Cookies which contain a randomly generated specific identification number which will make you and/or your device identifiable on our website. These cookies track whether a user came through Google AdWords. This information is sent to the CRM forms. These cookies will be deleted automatically after 30 days.
Purpose of this data processing is to facilitate the use of our website for you, to allow you to save settings, and to improve the customization of educational offerings & products to the specific requirements of customers.
The legal basis for our processing of this data is GDPR art. 6(1)(f). We have a legitimate interest in providing you a website which remembers your personal settings and facilitates your visit.
You have the right of objection.
In your browser settings, you can restrict or completely disable the creation of cookies. You can also set that cookies are automatically deleted when you close your browser window.
Other services we use also employ cookies. We will indicate to you when any of these services is using cookies.
On our website, we use several services provided by Google Inc. (“Google”), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
In the following text of the Data Privacy Statement, you will find more information about each specific service provided by Google which we use on our website.
By integrating these Google Services, Google may under certain conditions collect and process information (this includes personal data). In doing so, it cannot be ruled out that Google may transfer this information to a server in a third country.
As described in Google’s Privacy Shield certification (see https://www.privacyshield.gov/list and enter the search term “Google“), Google complies with the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework regarding the collection, use and retention of personal data from European Union member countries and Switzerland respectively. Google, including Google LLC and its wholly-owned US subsidiaries, has certified that it adheres to the Privacy Shield Principles. For more information please go to https://www.google.de/policies/privacy/frameworks/.
You can prevent this data from being added directly by logging out of your Google account or by changing the corresponding settings in your Google account. Furthermore, you can prevent the installation of cookies – as far as Google creates them – by changing the corresponding settings in your browser; however, it is important to note that if you do so, you may not be able to use all features of this website to their full extent.
On our website, we use Google Analytics, a web analytics tool provided by Google LLC (“Google”), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Google Analytics uses so-called “cookies”, text files which are stored on your device and permit an analysis of your use of the websites you visited. Google Analytics can also use so-called Web Beacons (invisible graphics). Web Beacons are used to analyze information such as traffic on websites. Information created by cookies and Web Beacons about the use of our website (including the users’ IP addresses) is transferred to and stored on a server operated by Google which may be located in the USA or other third countries. This information may be passed on by Google to their contract partners.
For information on Google’s present Privacy Shield Certification and other relevant details about data processing by Google when using Google Services, see chapter “6) Information on Google Services“ of this Data Privacy Statement.
For additional, more detailed information about the processed data, see “Information we collect as you use our services” at https://www.google.com/intl/de/policies/privacy/#infocollect as well as https://privacy.google.com/businesses/adsservices/.
We employ Google Analytics only with “anonymize IP” activated. In this setting, Google shortens your IP address in the member states of the European Union or other contractual states of the Treaty of the European Economic Area. Only in exceptional cases will Google send the complete IP address to one of their servers in the USA to shorten it there.
Furthermore, we concluded a contract with Google Analytics about the use of Google Analytics for the processing of data on our behalf (GDPR art. 28). Google processes the data on our behalf in order to analyze your use of our website, create reports about activities on our website, and render further services with regard to the use of our website and the Internet. Google may transfer this information to third parties if it is required by law or if such third parties process data on Google’s behalf.
We integrate Google Analytics for the purpose of analyzing user behavior on our website and allowing us to respond to this behavior. This enables us to constantly improve the services we offer.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest required to do so is justified by the great benefit that the features described above provide in terms of the scope of our services. The statistical evaluation of user behavior allows us in particular to respond in a way that takes into account the users’ interests and to optimize the scope of our services.
Furthermore, you can prevent the installation of cookies by changing the corresponding settings in your browser; however, it is important to note that if you do so, you may not be able to use all features of this website to their full extent.
The processed information is stored for 38 of months and will be deleted automatically after expiration of this retention period.
We use the Google Tag Manager on our website. The Google Tag Manager is a service provided by Google LLC ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The Google Tag Manager helps us to integrate various codes and services on our website in a neat and simplified way. The Google Tag Manager implements the tags and “triggers” the integrated tags. When tags are triggered, Google may collect and process information (including personal data). In this regard, it cannot be ruled out that Google may transfer the information to a server in a third country.
https://www.google.de/tagmanager/use-policy.html and “Information we collect as you use our services” at https://www.google.com/intl/de/policies/privacy/index.html.
Furthermore, we concluded a contract with Google about the use of the Google Tag Manager for the processing of data on our behalf (GDPR art. 28). Google processes the data on our behalf in order to trigger the stored tags and display the services on our website. Google may transfer this information to third parties if it is required by law or if such third parties process data on Google’s behalf.
If you have disabled individual tracking services (e.g. by having an opt-out cookie created), every relevant tracking tag integrated through the Google Tag Manager remains disabled.
We implemented the Google Tag Manager for the purpose of integrating various services in a neat and simplified way. In addition, integrating the Google Tag Manager optimizes the loading times of the various services.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest required to do so is justified by the great benefit gained from integrating various services through the Google Tag Manager. Integrating the Google Tag Manager reduces the time and effort required for maintenance and loading the website as well as the server load and the traffic load. In addition, Google has a legitimate interest in the collected (personal) data to improve its own services.
You have the right of objection. You have the option to prevent the Google Tag Manager from sending any tags. In order to do so you only have to click on this opt-out link and create a Google Tag Manager disable cookie on your browser.
However, please note that such disabling could under certain conditions result in you being unable to use our website at all or to the full extent possible.
We use external fonts, so-called Google Fonts, on our website. Google Fonts is a service provided by Google LLC ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Integrating the Web Fonts is done through an interface (“API”) to the Google services. By integrating Web Fonts, Google may collect and process information (including personal data). In this regard, it cannot be ruled out that Google may transfer the information to a server in a third country.
We ourselves do not collect any data as part of providing Google Fonts.
We integrated Google Fonts for the purpose of being able to display standardized fonts on your device.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest required to do so is justified by the great benefit gained from a standardized display of fonts. Being able to provide a standardized display, we minimize the time and effort spent on designing, which would be considerably higher if we had to create our own graphically adapted websites in order to respond to each and every font standard from the various operating systems or browsers. In addition, Google has a legitimate interest in the collected (personal) data to improve its own services, among other things.
Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, the failure to provide such data could under certain conditions result in your being unable to use our website at all or to the full extent possible, and the display of the website may also differ.
We use videos from YouTube and YouTube plug-ins on our website. YouTube is a service provided by YouTube LLC (“YouTube“), 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Inc. ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
YouTube is integrated by embedding the service on our website through so-called “iFrames”. When loading such an iFrame, YouTube or Google may collect and process information (including personal data). In this regard, it cannot be ruled out that YouTube or Google may also transfer the information to a server in a third country.
We ourselves do not collect any data when you watch a YouTube video on our website.
We integrate YouTube for the purpose of being able to present various videos on our website so that you can view these videos directly on our website.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest required to do so is justified by the great benefit gained from YouTube. The integration of external videos reduces the load on our servers and allows us to use the relevant resources for other purposes. This can increase the stability of our servers among other things. In addition, YouTube and Google have a legitimate interest in the collected (personal) data in order to improve their own services.
This website uses Google AdWords and, within the scope of Google AdWords, Conversion Tracking, an online marketing service by Google LLC (“Google“), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google AdWords and Google Conversion Tracking are analytic services provided by Google. When clicking on an advertisement placed by Google, a so-called “cookie”, a text file, is stored on your device permitting an analysis of your use of the websites you visit. Information created by the cookie about your use of this website (including your IP address) is transferred to and stored on a server operated by Google which may be located in the USA or other third countries. These cookies lose their validity after 30 days. When you visit some of our sites while the stored cookie has not expired, Google and ourselves can recognize that somebody clicked on the advertisement and was redirected to our website. Each AdWords customer gets a different cookie. In this way, cookies can be tracked across the websites of AdWords customers.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). The potential to evaluate the success of individual offers allows us to respond specifically to market behavior and place our offers in the best position for interested users. In addition, Google has a legitimate interest in the collected (personal) data to improve its own services, among other things.
You can disable the settings for personalized advertising at https://support.google.com/ads/answer/2662922?hl=de. Furthermore, you can prevent the installation of cookies by changing the corresponding settings in your browser; however, it is important to note that if you do so, you may not be able to use all features of this website to their full extent.
Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use this feature of our website at all or to the full extent possible.?
We use the service Google Remarketing provided by Google LLC ("Google"), 1600 Amphitheatre Pkwy, Mountain View, CA 94043-1351, USA. Google Remarketing creates a cookie on your computer. This cookie allows Google to recognize you when you access other sites within the Google advertising network. This makes it possible to recognize your device on other websites of the Google advertising network and to show you personalized advertisements. In the context of this process, information (including personal data) is transferred to Google. This may also mean transferring data to states outside the EC, especially to the USA. In some circumstances, Google may share information with third parties.
The collected information is used by Google in particular to show you advertisements within the Google advertising network which are aimed at your interests. We will not receive any information which allows to draw conclusions about you as a person at any time.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). The potential to evaluate the success of individual offers allows us to respond specifically to market behavior and to place our offers in the best position for interested users. In addition, Google has a legitimate interest in the collected (personal) data in order to market personalized advertisements and to improve its own services.
You can disable the settings for personalized advertising at https://support.google.com/ads/answer/2662922?hl=de.
Further, you can prevent the installation of cookies by changing the corresponding settings in your browser; however, it is important to note that if you do so, you may not be able to use all features of this website to their full extent.
We use Google Maps on our website. Google Maps is a service provided by Google LLC ("Google"), 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
The Google Maps plug-in is integrated by embedding the service on our website through so-called “iFrames”. When loading such an iFrame, Google may collect and process information (including personal data). In this regard, it cannot be ruled out that Google may transfer the information to a server in a third country.
We ourselves do not collect any data when you use Google Maps on our website.
We integrate Google Maps for the purpose of showing you our address and providing additional information for your journey to us. In addition, the integration of Google Maps allows us to show you places without limiting you to single map sections and enables you to research distances and other information on your own.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest required to do so is justified by the great benefit gained from Google Maps. The integration makes it unnecessary to illustrate the routes to each location on individual directions sketches or similar graphics, while allowing every user to plan his or her journey independently. In addition, Google has a legitimate interest in the collected (personal) data to improve its own services.
On our website you will find a form which you can use to request information material about training, studies and / or further education. When you contact us using this form, we process the data you enter in the input fields.
The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to the best of our knowledge, and to guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.
your confirmation that you are at least sixteen years old.
The purpose of processing your personal data is to deal with your request for information material, answer your inquiry or other queries, contact the inquirer, provide professional and consistent advice during the decision-making process, invite you to information sessions, for example to an Open House, study taster, or the like, or to prepare customized offers.
Legal basis for processing the personal data you have provided us with in the context of requesting information is our legitimate interest according to GDPR art. 6(1)(f). It is in our legitimate interest to enable you to request brochures and other information about training, studies, and/or further education in order to get a general idea about the training, studies, and/or further education we offer as well as to get sound advice and support when selecting a suitable educational opportunity.
Additional personal data processed when sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent with regard to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.
The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent with regard to and/or have seen the Data Privacy Statement as well as proof that you are at least sixteen years old.
If you have given your consent with regard to promotional activities, we will also process the data for this purpose. The legal basis for processing this data is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of your request for brochures in order to send you information about our products and services.
The processed data will be stored only as long as this is necessary for the intended purpose or as is required by law.
The additional data collected when the form was sent will be deleted after a maximum of 14 days.
The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing as well as the server host which operates on our behalf in the context of a commissioned data processing agreement.
Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your personal data, you have the right to object.
Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to use our contact form.
On our website you will find a contact form which you can use to contact us electronically. When you contact us using this form, we process the data you enter in the input fields.
Please note that the amount of personal data collected in the context of the contact form also depends on the details you provide in the message part of the contact form.
The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to the best of our knowledge, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.
The purpose of processing your personal data, in terms of the required as well as the voluntary details, is to deal with contact inquiries and to enable us to contact the inquirer in order to answer his or her queries. All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your inquiries.
Additional personal data processed when sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.
The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent to and/or have seen the Data Privacy Statement as well as in documenting the proof that you are at least sixteen years old.
If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this data processing is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the contact form in order to send you information about our products and services.
On our website you will find a form which you can use to contact us electronically in order to make an appointment for a no-obligation consultation about our educational offers. When you contact us using this consultation form, we process the data you enter in the input fields.
Please note that the amount of personal data collected in the context of the consultation form also depends on the details you reveal in the message of the consultation form.
The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, answer inquiries to our best knowledge, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.?
your confirmation that you are at least sixteen years old or have the consent of a parent or legal guardian.
The purpose of processing your personal data in terms of the required as well as the voluntary details, is to deal with consultation inquiries and to enable us to contact the inquirer in order to answer his or her queries. All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time in order to make an appointment for a consultation so that we can answer your queries.
The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent and/or have seen the Data Privacy Statement as well as in documenting the proof that you are at least sixteen years old.
If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this data processing is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the consultation form in order to send you information about our products and services.
Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your personal data, you have the right to object.?
On our website you will find a form which you can use to contact us electronically in order to submit your application for the training, studies or further education offered.
When you contact us using this contact form, we will process the data you enter in the input fields.
The required details are necessary to enable us, within the bounds of our internal routing, to assign the inquirer to the right persons in charge, process the application in its entirety, and guarantee a direct customer service approach. We use a central CRM system which forwards the inquiries directly to the appropriate educational institution and the corresponding advisor based on the above compulsory details.
Please note that the amount of personal data collected in the context of the application form also depends on the details you reveal in the message included in the form or in the application documents.
The purpose of processing your personal data is to process the application and to enable us to contact the inquirer in order to answer his or her queries. The purpose of processing your personal data resulting from the application documents is to identify suitable applicants.
All other personal data processed when the message is sent (IP address, date and time of sending) serves to prevent misuse of our contact form.
The legal basis for our processing of your master data is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your queries. The legal basis for our processing of your personal data resulting from the application is GDPR art. 6(1)(b) and art. 88(1) as well as §26(1) of the new Federal Data Protection Act.
Additional personal data processed at the time of sending the form (IP address, date and time of sending) helps us to prevent misuse of our contact form and to document that – and whether – you have given your consent with regard to and/or have seen the Data Privacy Statement and that you are at least sixteen years old.
The legal basis for this is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in preventing misuse of our form and/or to establish proof of such misuse. In addition, we have a legitimate interest in recording that you have given your consent and/or have seen the Data Privacy Statement as well as to document the proof that you are at least sixteen years old.
If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this processing of data is our legitimate interest according to GDPR art. 6(1)(f). We have a legitimate interest in processing the data you entered as part of the consultation form in order to send you information about our products and services.
Your personal data will be processed only as long as this is necessary for the purpose. The application email and the documents you send us will be retained until a decision is made as to whether to accept the applicant or not, and it will be deleted afterwards.
Insofar as we draw on our legitimate interest as grounds for the lawfulness of processing your data, you have the right to object.
Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, the failure to provide such data could under certain conditions result in you being unable to use our contact form.
When you visit our locations or when we visit your company or when you meet us at exhibitions or any other event, you have the option to fill in a form (“Welcome to Munich Business School!”) which you can use to request information material about training, studies, further education and/or other educational opportunities or to ask for individual consultation. The location indicated on the form you filled in is the Controller with regard to the processing of personal data resulting from the utilization of the form (see Chapter 2) Controller). When you contact us using this “Welcome to Munich Business School!” form, the data you enter will be processed exclusively by the location you selected.
if applicable, any other data you entered in the form.
Legal basis for processing the personal data you have provided us with in the context of requesting information is our legitimate interest according to GDPR art. 6 (1) (f). It is in our legitimate interest to enable you to request brochures and other information about training, studies, and/or further education in order to get a general idea about the training, studies, and/or further education we offer as well as to get sound advice and support when selecting a suitable educational opportunity.
If you have given your consent with regard to promotional activities, we will also process the data for this purpose. Legal basis for this processing of data is our legitimate interest according to GDPR art. 6 (1) (f). We have a legitimate interest in processing the data you entered as part of this form in order to send you information about our products and services.
The completed form which you hand in at your selected location will be scanned by the location and is recorded in our CRM.
The processed data will be stored only as long as this is necessary for the intended purpose or is required by law.
The recipient of the data is Euro IT Solutions Service und Vertriebs GmbH which provides the CRM and operates on our behalf in the context of commissioned order processing.
You can send or inform us about your objection at any time (e.g. by emailing your objection to datenschutz(at)eso.de).
In co-operation with Controller Institut GmbH, Vorgartenstraße 204/6, 1020 Vienna, Austria, we implement “Executive Education” training programs. These training programs are part-time further education programs for professionals working in medium/higher management.
In this respect, our website provides a form which you may use to contact us electronically to apply for one of our further education programs.
Should you use the form to contract us, we will process any data which you enter in the different entry fields.
These mandatory entries are required in the context of our internal routing processes to be able to assign to the applicants the right person to contact, to be able to fully process any applications and to be able to guarantee that clients are addressed in an appropriate manner. We employ a centralized CRM (customer relationship management) system, whereby our system directly transfers applications to the educational facility in charge and the relevant consultants based on the above mandatory entries.
your confirmation of having reached the age of sixteen or having obtained a consent from your parent or legal guardian.
Please note that the extent of personal data collection in the context of the application process also depends on which data you provide on the form yourself.
The purpose of processing your personal data consists in processing incoming applications and in being able to contact you to react to your queries. Personal data included in the application documents which you provide to us is processed for the purpose of being able to determine the adequacy of candidates.
The legal basis of processing your master data is art. 6(1) point (f) of the GDPR. We have a legitimate interest in providing you with an opportunity to contact us at any time and in adequately reacting to your queries. The processing of personal data included in applications is made on the legal basis of the provisions under art. 6(1) point (b) of the GDPR, art. 88(1) of the GDPR and sec. 26 para. 1 of the German Federal Data Protection Act in its new version.
Within the framework of these processing activities, co-operation with Munich Business School is based on a contract on joint controllership in terms of art. 26 of the GDPR; we will be happy to provide you with a copy upon your request.
in this case, the legal basis is our legitimate interest pursuant to art. 6(1) point (f) of the GDPR. We have a legitimate interest in preventing our contact form from being misused and in being able to prove that it was misused. In addition to the above, we have a legitimate interest in recording the declaration of consent we receive from you, your agreement to the data protection notices and your confirmation of having reached the age of sixteen.
To the extent you consented to any advertising activities, we additionally process your data for this purpose. The legal basis of this type of personal data processing is your consent which you granted on the basis of art. 6(1) point (a) of the GDPR.
In this regard, your personal data will be processed only for as long as this is required for the purpose of providing this function. Applications and related documents delivered by e-mail will be stored until a decision is made for or against the relevant applicant and they will be deleted after this.
Any data which is additionally collected while sending the form will be deleted not later than after 14 days.
All this data is transferred to Euro IT Solutions Service und Vertriebs GmbH who provides the CRM system and works for us in the context of contract data processing, as well as the server host also working for us in the context of a commissioned data processing contract.
You have a right to object. You can inform us about your objection at any time by sending a letter or an e-mail to datenschutz(at)eso.de.
Providing your personal data is neither a statutory nor a contractual requirement and this is not necessary for the conclusion of a contract. You are not obligated to provide your personal data, either; however, failure to provide such data might have the effect of you not being able to use our contact form.
You have the choice to contact us by mail, phone, fax, or email.
If you contact us by mail we may process in particular your address details (e.g. name, first name, street, place of residence, zip code), the date and time of reception of your mail as well as information gathered from the content of your letter.
If you contact us by phone, we can process in particular your phone number as well as information requested during the conversation such as your name, your email address, the time of your call and details of your query.
If you contact us by fax, we can process in particular the fax number and/or the source identifier as well as other details contained in your fax.
If you contact us by email, we will process in particular your email address, the time of emailing as well as data contained in the email (including attachments if any).
The purpose of processing the above data is to deal with the contact inquiry and to enable us to contact the inquirer in order to answer his or her queries.
The legal basis for the processing of personal data as described herein is GDPR art. 6(1)(f). Our legitimate interest is to enable you to contact us at any time so that we can answer your queries.
The personal data will be deleted as soon as it is no longer required for the intended purpose for which it was collected.
Providing us with personal data is neither required by law nor by contract nor is it necessary for the conclusion of a contract. You are not obliged to provide personal data. However, failure to provide such data could under certain conditions result in you being unable to contact us or in us being unable to get in touch with you.
Apart from this website, we also maintain a presence in various social media which you can reach by clicking on the corresponding command buttons on our website. If you visit such a site, it may be possible that personal data is transferred to the provider of the social network. It is possible that, apart from storage of the data you specifically enter in this social medium, other information may be processed by the provider of the social network.
Moreover, the provider of the social network may process the most important data regarding the computer system from which you are accessing the social network – e.g. your IP address, the type of processor you use, and your browser version including plug-ins.
If you are logged into your personal user account in the respective network while visiting such a website, this network can associate your visit with your account.
Please note that our website contains further links to external websites and that we do not have any influence on the processing of data on these external websites.
We use technical and organizational means to secure our website and other systems against loss, damage, access, modification, or distribution of your data by unauthorized persons. Despite regular checks, however, complete protection against all dangers is not possible.
Amendments of laws or changes in our in-house processes can make adapting this Data Privacy Statement necessary.
In case of any modifications, we will inform you accordingly in a separate notice under the heading “Data Privacy Statement”.
You have the right to revoke any consent you have given at any time and this will apply from that moment on. The lawfulness of the processing done based on your consent up to your revocation remains unaffected by your revocation. Please send your revocation to datenschutz(at)eso.de.
Please send any inquiries concerning the above to datenschutz(at)eso.de. Please note that when we receive such inquiries, we have to make sure that they have actually been sent by the person concerned.
Without prejudice to other legal redress in terms of administrative law or judicial remedies, you have the right to file a complaint with a supervisory authority for data protection.
Our website does not include any automatized decision-making.

matches:
art. 4
art. 21
art. 89
art. 21
art. 6
art. 6
art. 28
art. 6
art. 28
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 88
§26
art. 6
art. 6
art. 6
art. 6
art. 6
art. 6
art. 88
art. 26
art. 6
art. 6
art. 6


Amounts expended to lease premises and hire employees for the conduct of gambling enterprises, illegal under state law, are deductible as ordinary and necessary business expenses within the meaning of § 23(a)(1)(A) of the Internal Revenue Code of 1939. Pp. 356 U. S. 27-29.
241 F.2d 46, 242 F.2d 558, affirmed.
The taxpayers received income from bookmaking establishments in Chicago, Ill. The Tax Court found that these enterprises were illegal under Illinois law, [Footnote 2] that the acts performed by the employees constituted violations of that law, and that the payment of rent for the use of the premises for the purpose of bookmaking was also illegal under that law. The Tax Court accordingly held that the amount paid for wages and for rent could not be deducted from gross income, since those deductions were for expenditures made in connection with illegal acts. 15 CCH TC Mem. Dec. 23, 25 T.C. 513. The Court of Appeals reversed, 241 F.2d 46, 242 F.2d 558, on the basis of its prior decision in Commissioner v. Doyle, 231 F.2d 635. The case is here on a petition for certiorari, 354 U.S. 920, for consideration in connection with the companion cases Hoover Motor Express Co. v. United States, post, p. 356 U. S. 38, and Tank Truck Rentals, Inc. v. Commissioner, post, p. 356 U. S. 30.
gambling enterprise as a business for federal tax purposes. The policy that allows as a deduction the tax paid to conduct the business seems sufficiently hospitable to allow the normal deductions of the rent and wages necessary to operate it. We said in Commissioner v. Heininger, 320 U. S. 467, 320 U. S. 474, that the "fact that an expenditure bears a remote relation to an illegal act" does not make it nondeductible. And see Lilly v. Commissioner, 343 U. S. 90. If we enforce as federal policy the rule espoused by the Commissioner in this case, we would come close to making this type of business taxable on the basis of its gross receipts, while all other business would be taxable on the basis of net income. If that choice is to be made, Congress should do it. The amounts paid as wages to employees and to the landlord as rent are "ordinary and necessary expenses" in the accepted meaning of the words. That is enough to permit the deduction, unless it is clear that the allowance is a device to avoid the consequence of violations of a law, as in Hoover Motor Express Co. v. United States, supra, and Tank Truck Rentals, Inc. v. Commissioner, supra, or otherwise contravenes the federal policy expressed in a statute or regulation, as in Textile Mills Securities Corp. v. Commissioner, supra.
"All the ordinary and necessary expenses paid or incurred during the taxable year in carrying on any trade or business, including a reasonable allowance for salaries or other compensation for personal services actually rendered; . . . and rentals or other payments required to be made as a condition to the continued use or possession, for purposes of the trade or business, of property to which the taxpayer has not taken or is not taking title or in which he has no equity."
53 Stat. 12, as amended 56 Stat. 819, 26 U.S.C. §23(a)(1)(A).
Ill.Rev.Stat.1945, c. 38, § 336.
"The Federal excise tax on wagers under section 3285(d) of the Internal Revenue Code and the special tax under section 3290 of the Code paid by persons engaged in receiving wagers are deductible, for Federal income tax purposes, as ordinary and necessary business expenses under section 23(a) of the Internal Revenue Code, provided the taxpayer is engaged in the business of accepting wagers or conducting wagering pools or lotteries, or is engaged in receiving wagers for or on behalf of any person liable for the tax under section 3285(d) of the Code."


This is a summary of key elements of the Privacy Rule including who is covered, what information is protected, and how protected health information can be used and disclosed. Because it is an overview of the Privacy Rule, it does not address every detail of each provision.
The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).1 The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals’ privacy rights to understand and control how their health information is used. Within HHS, the Office for Civil Rights (“OCR”) has responsibility for implementing and enforcing the Privacy Rule with respect to voluntary compliance activities and civil money penalties.A major goal of the Privacy Rule is to assure that individuals’ health information is properly protected while allowing the flow of health information needed to provide and promote high quality health care and to protect the public’s health and well being. The Rule strikes a balance that permits important uses of information, while protecting the privacy of people who seek care and healing. Given that the health care marketplace is diverse, the Rule is designed to be flexible and comprehensive to cover the variety of uses and disclosures that need to be addressed.This is a summary of key elements of the Privacy Rule and not a complete or comprehensive guide to compliance. Entities regulated by the Rule are obligated to comply with all of its applicable requirements and should not rely on this summary as a source of legal information or advice. To make it easier for entities to review the complete requirements of the Rule, provisions of the Rule referenced in this summary are cited in the end notes. Visit our Privacy Rule section to view the entire Rule, and for other additional helpful information about how the Rule applies. In the event of a conflict between this summary and the Rule, the Rule governs.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, was enacted on August 21, 1996. Sections 261 through 264 of HIPAA require the Secretary of HHS to publicize standards for the electronic exchange, privacy and security of health information. Collectively these are known as the Administrative Simplification provisions.HIPAA required the Secretary to issue privacy regulations governing individually identifiable health information, if Congress did not enact privacy legislation within three years of the passage of HIPAA. Because Congress did not enact privacy legislation, HHS developed a proposed rule and released it for public comment on November 3, 1999. The Department received over 52,000 public comments. The final regulation, the Privacy Rule, was published December 28, 2000.2 In March 2002, the Department proposed and released for public comment modifications to the Privacy Rule. The Department received over 11,000 comments.The final modifications were published in final form on August 14, 2002.3 A text combining the final regulation and the modifications can be found at 45 CFR Part 160 and Part 164, Subparts A and E.
Health Care Clearinghouses.Health care clearinghouses are entities that process nonstandard information they receive from another entity into a standard (i.e., standard format or data content), or vice versa.7 In most instances, health care clearinghouses will receive individually identifiable health information only when they are providing these processing services to a health plan or health care provider as a business associate. In such instances, only certain provisions of the Privacy Rule are applicable to the health care clearinghouse’s uses and disclosures of protected health information.8Health care clearinghouses include billing services, repricing companies, community health management information systems, and value-added networks and switches if these entities perform clearinghouse functions.
Business Associate Defined. In general, a business associate is a person or organization, other than a member of a covered entity’s workforce, that performs certain functions or activities on behalf of, or provides certain services to, a covered entity that involve the use or disclosure of individually identifiable health information. Business associate functions or activities on behalf of a covered entity include claims processing, data analysis, utilization review, and billing.9 Business associate services to a covered entity are limited to legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services. However, persons or organizations are not considered business associates if their functions or services do not involve the use or disclosure of protected health information, and where any access to protected health information by such persons would be incidental, if at all. A covered entity can be the business associate of another covered entity.
Business Associate Contract. When a covered entity uses a contractor or other non-workforce member to perform “business associate” services or activities, the Rule requires that the covered entity include certain protections for the information in a business associate agreement (in certain circumstances governmental entities may use alternative means to achieve the same protections). In the business associate contract, a covered entity must impose specified written safeguards on the individually identifiable health information used or disclosed by its business associates.10 Moreover, a covered entity may not contractually authorize its business associate to make any use or disclosure of protected health information that would violate the Rule. Covered entities that had an existing written contract or agreement with business associates prior to October 15, 2002, which was not renewed or modified prior to April 14, 2003, were permitted to continue to operate under that contract until they renewed the contract or April 14, 2004, whichever was first.11 See additional guidance on Business Associates and sample business associate contract language.
Required Disclosures. A covered entity must disclose protected health information in only two situations: (a) to individuals (or their personal representatives) specifically when they request access to, or an accounting of disclosures of, their protected health information; and (b) to HHS when it is undertaking a compliance investigation or review or enforcement action.17 See additional guidance on Government Access.
Permitted Uses and Disclosures. A covered entity is permitted, but not required, to use and disclose protected health information, without an individual’s authorization, for the following purposes or situations: (1) To the Individual (unless required for access or accounting of disclosures); (2) Treatment, Payment, and Health Care Operations; (3) Opportunity to Agree or Object; (4) Incident to an otherwise permitted use and disclosure; (5) Public Interest and Benefit Activities; and (6) Limited Data Set for the purposes of research, public health or health care operations.18 Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.
(2) Treatment, Payment, Health Care Operations. A covered entity may use and disclose protected health information for its own treatment, payment, and health care operations activities.19 A covered entity also may disclose protected health information for the treatment activities of any health care provider, the payment activities of another covered entity and of any health care provider, or the health care operations of another covered entity involving either quality or competency assurance activities or fraud and abuse detection and compliance activities, if both covered entities have or had a relationship with the individual and the protected health information pertains to the relationship. See additional guidance on Treatment, Payment, & Health Care Operations.
Most uses and disclosures of psychotherapy notes for treatment, payment, and health care operations purposes require an authorization as described below.23 Obtaining “consent” (written permission from individuals to use and disclose their protected health information for treatment, payment, and health care operations) is optional under the Privacy Rule for all covered entities.24 The content of a consent form, and the process for obtaining consent, are at the discretion of the covered entity electing to seek consent.
For Notification and Other Purposes. A covered entity also may rely on an individual’s informal permission to disclose to the individual’s family, relatives, or friends, or to other persons whom the individual identifies, protected health information directly relevant to that person’s involvement in the individual’s care or payment for care. 26 This provision, for example, allows a pharmacist to dispense filled prescriptions to a person acting on behalf of the patient. Similarly, a covered entity may rely on an individual’s informal permission to use or disclose protected health information for the purpose of notifying (including identifying or locating) family members, personal representatives, or others responsible for the individual’s care of the individual’s location, general condition, or death. In addition, protected health information may be disclosed for notification purposes to public or private entities authorized by law or charter to assist in disaster relief efforts.
(4) Incidental Use and Disclosure. The Privacy Rule does not require that every risk of an incidental use or disclosure of protected health information be eliminated. A use or disclosure of this information that occurs as a result of, or as “incident to,” an otherwise permitted use or disclosure is permitted as long as the covered entity has adopted reasonable safeguards as required by the Privacy Rule, and the information being shared was limited to the “minimum necessary,” as required by the Privacy Rule.27See additional guidance on Incidental Uses and Disclosures.
Public Health Activities. Covered entities may disclose protected health information to: (1) public health authorities authorized by law to collect or receive such information for preventing or controlling disease, injury, or disability and to public health or other government authorities authorized to receive reports of child abuse and neglect; (2) entities subject to FDA regulation regarding FDA regulated products or activities for purposes such as adverse event reporting, tracking of products, product recalls, and post-marketing surveillance; (3) individuals who may have contracted or been exposed to a communicable disease when notification is authorized by law; and (4) employers, regarding employees, when requested by employers, for information concerning a work-related illness or injury or workplace related medical surveillance, because such information is needed by the employer to comply with the Occupational Safety and Health Administration (OHSA), the Mine Safety and Health Administration (MHSA), or similar state law.30 See additional guidance on Public Health Activities and CDC’s web pages on Public Health and HIPAA Guidance.
Workers’ Compensation. Covered entities may disclose protected health information as authorized by, and to comply with, workers’ compensation laws and other similar programs providing benefits for work-related injuries or illnesses.42 See additional guidance on Workers’ Compensation.
(6) Limited Data Set. A limited data set is protected health information from which certain specified direct identifiers of individuals and their relatives, household members, and employers have been removed.43 A limited data set may be used and disclosed for research, health care operations, and public health purposes, provided the recipient enters into a data use agreement promising specified safeguards for the protected health information within the limited data set.
An authorization must be written in specific terms. It may allow use and disclosure of protected health information by the covered entity seeking the authorization, or by a third party. Examples of disclosures that would require an individual’s authorization include disclosures to a life insurer for coverage purposes, disclosures to an employer of the results of a pre-employment physical or lab test, or disclosures to a pharmaceutical firm for their own marketing purposes.
The covered entity who originated the notes may use them for treatment.
A covered entity may use or disclose, without an individual’s authorization, the psychotherapy notes, for its own training, and to defend itself in legal proceedings brought by the individual, for HHS to investigate or determine the covered entity’s compliance with the Privacy Rules, to avert a serious and imminent threat to public health or safety, to a health oversight agency for lawful oversight of the originator of the psychotherapy notes, for the lawful activities of a coroner or medical examiner or as required by law.
Communications for case management or care coordination for the individual, or to direct or recommend alternative treatments, therapies, health care providers, or care settings to the individual.
Marketing also is an arrangement between a covered entity and any other entity whereby the covered entity discloses protected health information, in exchange for direct or indirect remuneration, for the other entity to communicate about its own products or services encouraging the use or purchase of those products or services. A covered entity must obtain an authorization to use or disclose protected health information for marketing, except for face-to-face marketing communications between a covered entity and an individual, and for a covered entity’s provision of promotional gifts of nominal value. No authorization is needed, however, to make a communication that falls within one of the exceptions to the marketing definition. An authorization for marketing that involves the covered entity’s receipt of direct or indirect remuneration from a third party must reveal that fact. See additional guidance on Marketing.
Minimum Necessary. A central aspect of the Privacy Rule is the principle of “minimum necessary” use and disclosure. A covered entity must make reasonable efforts to use, disclose, and request only the minimum amount of protected health information needed to accomplish the intended purpose of the use, disclosure, or request.50 A covered entity must develop and implement policies and procedures to reasonably limit uses and disclosures to the minimum necessary. When the minimum necessary standard applies to a use or disclosure, a covered entity may not use, disclose, or request the entire medical record for a particular purpose, unless it can specifically justify the whole record as the amount reasonably needed for the purpose. See additional guidance on Minimum Necessary.
The minimum necessary requirement is not imposed in any of the following circumstances: (a) disclosure to or a request by a health care provider for treatment; (b) disclosure to an individual who is the subject of the information, or the individual’s personal representative; (c) use or disclosure made pursuant to an authorization; (d) disclosure to HHS for complaint investigation, compliance review or enforcement; (e) use or disclosure that is required by law; or (f) use or disclosure required for compliance with the HIPAA Transactions Rule or other HIPAA Administrative Simplification Rules.
Access and Uses. For internal uses, a covered entity must develop and implement policies and procedures that restrict access and uses of protected health information based on the specific roles of the members of their workforce. These policies and procedures must identify the persons, or classes of persons, in the workforce who need access to protected health information to carry out their duties, the categories of protected health information to which access is needed, and any conditions under which they need the information to do their jobs.
documentation or representation required by the Privacy Rule for research.
Privacy Practices Notice. Each covered entity, with certain exceptions, must provide a notice of its privacy practices.51 The Privacy Rule requires that the notice contain certain elements. The notice must describe the ways in which the covered entity may use and disclose protected health information. The notice must state the covered entity’s duties to protect privacy, provide a notice of privacy practices, and abide by the terms of the current notice. The notice must describe individuals’ rights, including the right to complain to HHS and to the covered entity if they believe their privacy rights have been violated. The notice must include a point of contact for further information and for making complaints to the covered entity. Covered entities must act in accordance with their notices. The Rule also contains specific distribution requirements for direct treatment providers, all other health care providers, and health plans. See additional guidance on Notice.
Covered entities, whether direct treatment providers or indirect treatment providers (such as laboratories) or health plans must supply notice to anyone on request.52 A covered entity must also make its notice electronically available on any web site it maintains for customer service or benefits information.
Acknowledgement of Notice Receipt. A covered health care provider with a direct treatment relationship with individuals must make a good faith effort to obtain written acknowledgement from patients of receipt of the privacy practices notice.54 The Privacy Rule does not prescribe any particular content for the acknowledgement. The provider must document the reason for any failure to obtain the patient’s written acknowledgement. The provider is relieved of the need to request acknowledgement in an emergency treatment situation.
Access. Except in certain circumstances, individuals have the right to review and obtain a copy of their protected health information in a covered entity’s designated record set.55 The “designated record set” is that group of records maintained by or for a covered entity that is used, in whole or part, to make decisions about individuals, or that is a provider’s medical and billing records about individuals or a health plan’s enrollment, payment, claims adjudication, and case or medical management record systems.56 The Rule excepts from the right of access the following protected health information: psychotherapy notes, information compiled for legal proceedings, laboratory results to which the Clinical Laboratory Improvement Act (CLIA) prohibits access, or information held by certain research laboratories. For information included within the right of access, covered entities may deny an individual access in certain specified situations, such as when a health care professional believes access could cause harm to the individual or another. In such situations, the individual must be given the right to have such denials reviewed by a licensed health care professional for a second opinion.57Covered entities may impose reasonable, cost-based fees for the cost of copying and postage.
Amendment. The Rule gives individuals the right to have covered entities amend their protected health information in a designated record set when that information is inaccurate or incomplete. 58 If a covered entity accepts an amendment request, it must make reasonable efforts to provide the amendment to persons that the individual has identified as needing it, and to persons that the covered entity knows might rely on the information to the individual’s detriment.59 If the request is denied, covered entities must provide the individual with a written denial and allow the individual to submit a statement of disagreement for inclusion in the record. The Rule specifies processes for requesting and responding to a request for amendment. A covered entity must amend protected health information in its designated record set upon receipt of notice to amend from another covered entity.
Disclosure Accounting. Individuals have a right to an accounting of the disclosures of their protected health information by a covered entity or the covered entity’s business associates.60 The maximum disclosure accounting period is the six years immediately preceding the accounting request, except a covered entity is not obligated to account for any disclosure made before its Privacy Rule compliance date.
The Privacy Rule does not require accounting for disclosures: (a) for treatment, payment, or health care operations; (b) to the individual or the individual’s personal representative; (c) for notification of or to persons involved in an individual’s health care or payment for health care, for disaster relief, or for facility directories; (d) pursuant to an authorization; (e) of a limited data set; (f) for national security or intelligence purposes; (g) to correctional institutions or law enforcement officials for certain purposes regarding inmates or individuals in lawful custody; or (h) incident to otherwise permitted or required uses or disclosures. Accounting for disclosures to health oversight agencies and law enforcement officials must be temporarily suspended on their written representation that an accounting would likely impede their activities.
Confidential Communications Requirements. Health plans and covered health care providers must permit individuals to request an alternative means or location for receiving communications of protected health information by means other than those that the covered entity typically employs.63 For example, an individual may request that the provider communicate with the individual through a designated address or phone number. Similarly, an individual may request that the provider send communications in a closed envelope rather than a post card.
endangerment. Any covered entity may condition compliance with a confidential communication request on the individual specifying an alternative address or method of contact and explaining how any payment will be handled.
Data Safeguards. A covered entity must maintain reasonable and appropriate administrative, technical, and physical safeguards to prevent intentional or unintentional use or disclosure of protected health information in violation of the Privacy Rule and to limit its incidental use and disclosure pursuant to otherwise permitted or required use or disclosure.70 For example, such safeguards might include shredding documents containing protected health information before discarding them, securing medical records with lock and key or pass code, and limiting access to keys or pass codes. See additional guidance on Incidental Uses and Disclosures.
Among other things, the covered entity must identify to whom individuals can submit complaints to at the covered entity and advise that complaints also can be submitted to the Secretary of HHS.
Covered Entities With Multiple Covered Functions. A covered entity that performs multiple covered functions must operate its different covered functions in compliance with the Privacy Rule provisions applicable to those covered functions.82 The covered entity may not use or disclose the protected health information of an individual who receives services from one covered function (e.g., health care provider) for another covered function (e.g., health plan) if the individual is not involved with the other function.
Enrollment or disenrollment information with respect to the group health plan or a health insurer or HMO offered by the plan.
If requested by the plan sponsor, summary health information for the plan sponsor to use to obtain premium bids for providing health insurance coverage through the group health plan, or to modify, amend, or terminate the group health plan. “Summary health information” is information that summarizes claims history, claims expenses, or types of claims experience of the individuals for whom the plan sponsor has provided health benefits through the group health plan, and that is stripped of all individual identifiers other than five digit zip code (though it need not qualify as de-identified protected health information).
Protected health information of the group health plan’s enrollees for the plan sponsor to perform plan administration functions. The plan must receive certification from the plan sponsor that the group health plan document has been amended to impose restrictions on the plan sponsor’s use and disclosure of the protected health information. These restrictions must include the representation that the plan sponsor will not use or disclose the protected health information for any employment-related action or decision or in connection with any other benefit plan.
health information, a covered entity has discretion to provide or deny a parent access to the minor’s health information, provided the decision is made by a licensed health care professional in the exercise of professional judgment. See additional guidance on Personal Representatives.
Preemption. In general, State laws that are contrary to the Privacy Rule are preempted by the federal requirements, which means that the federal requirements will apply.85 “Contrary” means that it would be impossible for a covered entity to comply with both the State and federal requirements, or that the provision of State law is an obstacle to accomplishing the full purposes and objectives of the Administrative Simplification provisions of HIPAA.86 The Privacy Rule provides exceptions to the general rule of federal preemption for contrary State laws that (1) relate to the privacy of individually identifiable health information and provide greater privacy protections or privacy rights with respect to such information, (2) provide for the reporting of disease or injury, child abuse, birth, or death, or for public health surveillance, investigation, or intervention, or (3) require certain health plan reporting, such as for management or financial audits.
Compliance. The Standards for Privacy of Individually Identifiable Health Information (Privacy Rule) establishes a set of national standards for the use and disclosure of an individual’s health information – called protected health information – by covered entities, as well as standards for providing individuals with privacy rights to understand and control how their health information is used. The Department of Health and Human Services, Office for Civil Rights (OCR) is responsible for administering and enforcing these standards and may conduct complaint investigations and compliance reviews.
Consistent with the principles for achieving compliance provided in the Privacy Rule, OCR will seek the cooperation of covered entities and may provide technical assistance to help them comply voluntarily with the Privacy Rule. Covered entities that fail to comply voluntarily with the standards may be subject to civil money penalties. In addition, certain violations of the Privacy Rule may be subject to criminal prosecution. These penalty provisions are explained below.
Civil Money Penalties. OCR may impose a penalty on a covered entity for a failure to comply with a requirement of the Privacy Rule. Penalties will vary significantly depending on factors such as the date of the violation, whether the covered entity knew or should have known of the failure to comply, or whether the covered entity’s failure to comply was due to willful neglect. Penalties may not exceed a calendar year cap for multiple violations of the same requirement.
the Department of Justice has imposed a criminal penalty for the failure to comply (see below).
In addition, OCR may choose to reduce a penalty if the failure to comply was due to reasonable cause and the penalty would be excessive given the nature and extent of the noncompliance.
Before OCR imposes a penalty, it will notify the covered entity and provide the covered entity with an opportunity to provide written evidence of those circumstances that would reduce or bar a penalty. This evidence must be submitted to OCR within 30 days of receipt of the notice. In addition, if OCR states that it intends to impose a penalty, a covered entity has the right to request an administrative hearing to appeal the proposed penalty.
Compliance Schedule. All covered entities, except “small health plans,” must have been compliant with the Privacy Rule by April 14, 2003.90 Small health plans, however, had until April 14, 2004 to comply.
Small Health Plans. A health plan with annual receipts of not more than $5 million is a small health plan.91 Health plans that file certain federal tax returns and report receipts on those returns should use the guidance provided by the Small Business Administration at 13 Code of Federal Regulations (CFR) 121.104 to calculate annual receipts. Health plans that do not report receipts to the Internal Revenue Service (IRS), for example, group health plans regulated by the Employee Retirement Income Security Act 1974 (ERISA) that are exempt from filing income tax returns, should use proxy measures to determine their annual receipts.92See What constitutes a small health plan?
See our Combined Regulation Text of All Rules section of our site for the full suite of HIPAA Administrative Simplification Regulations and Understanding HIPAA for additional guidance material.
4 45 C.F.R. §§ 160.102, 160.103.
5 Even if an entity, such as a community health center, does not meet the definition of a health plan, it may, nonetheless, meet the definition of a health care provider, and, if it transmits health information in electronic form in connection with the transactions for which the Secretary of HHS has adopted standards under HIPAA, may still be a covered entity.
6 45 C.F.R. §§ 160.102, 160.103; see Social Security Act § 1172(a)(3), 42 U.S.C. § 1320d-1(a)(3).
The transaction standards are established by the HIPAA Transactions Rule at 45 C.F.R. Part 162.
7 45 C.F.R. § 160.103.
8 45 C.F.R. § 164.500(b).
9 45 C.F.R. § 160.103.
10 45 C.F.R. §§ 164.502(e), 164.504(e).
12 45 C.F.R. § 160.103.
14 45 C.F.R. §§ 164.502(d)(2), 164.514(a) and (b).
15 The following identifiers of the individual or of relatives, employers, or household members of the individual must be removed to achieve the “safe harbor” method of de-identification: (A) Names; (B) All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, and their equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of Census (1) the geographic units formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and (2) the initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000; (C) All elements of dates (except year) for dates directly related to the individual, including birth date, admission date, discharge date, date of death; and all ages over 89 and all elements of dates (including year) indicative of such age, except that such ages and elements may be aggregated into a single category of age 90 or older; (D) Telephone numbers; (E) Fax numbers; (F) Electronic mail addresses: (G) Social security numbers; (H) Medical record numbers; (I) Health plan beneficiary numbers; (J) Account numbers; (K) Certificate/license numbers; (L) Vehicle identifiers and serial numbers, including license plate numbers; (M) Device identifiers and serial numbers; (N) Web Universal Resource Locators (URLs); (O) Internet Protocol (IP) address numbers; (P) Biometric identifiers, including finger and voice prints; (Q) Full face photographic images and any comparable images; and ® any other unique identifying number, characteristic, or code, except as permitted for re-identification purposes provided certain conditions are met. In addition to the removal of the above-stated identifiers, the covered entity may not have actual knowledge that the remaining information could be used alone or in combination with any other information to identify an individual who is subject of the information. 45 C.F.R. § 164.514(b).
16 45 C.F.R. § 164.502(a).
17 45 C.F.R. § 164.502(a)(2).
18 45 C.F.R. § 164.502(a)(1).
19 45 C.F.R. § 164.506(c).
20 45 C.F.R. § 164.501.
21 45 C.F.R. § 164.501.
22 45 C.F.R. § 164.501.
24 45 C.F.R. § 164.506(b).
25 45 C.F.R. § 164.510(a).
26 45 C.F.R. § 164.510(b).
27 45 C.F.R. §§ 164.502(a)(1)(iii).
28 See 45 C.F.R. § 164.512.
29 45 C.F.R. § 164.512(a).
30 45 C.F.R. § 164.512(b).
31 45 C.F.R. § 164.512(a), (c).
32 45 C.F.R. § 164.512(d).
33 45 C.F.R. § 164.512(e).
34 45 C.F.R. § 164.512(f).
35 45 C.F.R. § 164.512(g).
36 45 C.F.R. § 164.512(h).
37 The Privacy Rule defines research as, “a systematic investigation, including research development, testing, and evaluation, designed to develop or contribute to generalizable knowledge.” 45 C.F.R. § 164.501.
38 45 C.F.R. § 164.512(i).
39 45 CFR § 164.514(e).
40 45 C.F.R. § 164.512(j).
41 45 C.F.R. § 164.512(k).
42 45 C.F.R. § 164.512(l).
comparable images. 45 C.F.R. § 164.514(e)(2).
44 45 C.F.R. § 164.508.
45 A covered entity may condition the provision of health care solely to generate protected health information for disclosure to a third party on the individual giving authorization to disclose the information to the third party. For example, a covered entity physician may condition the provision of a physical examination to be paid for by a life insurance issuer on an individual’s authorization to disclose the results of that examination to the life insurance issuer. A health plan may condition enrollment or benefits eligibility on the individual giving authorization, requested before the individual’s enrollment, to obtain protected health information (other than psychotherapy notes) to determine the individual’s eligibility or enrollment or for underwriting or risk rating. A covered health care provider may condition treatment related to research (e.g., clinical trials) on the individual giving authorization to use or disclose the individual’s protected health information for the research. 45 C.F.R. 508(b)(4).
46 45 CFR § 164.532.
47 “Psychotherapy notes” means notes recorded (in any medium) by a health care provider who is a mental health professional documenting or analyzing the contents of conversation during a private counseling session or a group, joint, or family counseling session and that are separated from the rest of the of the individual’s medical record. Psychotherapy notes excludes medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date.
48 45 C.F.R. § 164.508(a)(2).
49 45 C.F.R. §§ 164.501 and 164.508(a)(3).
50 45 C.F.R. §§ 164.502(b) and 164.514 (d).
51 45 C.F.R. §§ 164.520(a) and (b). A group health plan, or a health insurer or HMO with respect to the group health plan, that intends to disclose protected health information (including enrollment data or summary health information) to the plan sponsor, must state that fact in the notice. Special statements are also required in the notice if a covered entity intends to contact individuals about health-related benefits or services, treatment alternatives, or appointment reminders, or for the covered entity’s own fundraising.
52 45 C.F.R. § 164.520(c).
53 45 C.F.R. § 164.520(d).
54 45 C.F.R. § 164.520(c).
55 45 C.F.R. § 164.524.
56 45 C.F.R. § 164.501.
57 A covered entity may deny an individual access, provided that the individual is given a right to have such denials reviewed by a licensed health care professional (who is designated by the covered entity and who did not participate in the original decision to deny), when a licensed health care professional has determined, in the exercise of professional judgment, that: (a) the access requested is reasonably likely to endanger the life or physical safety of the individual or another person; (b) the protected health information makes reference to another person (unless such other person is a health care provider) and the access requested is reasonably likely to cause substantial harm to such other person; or (c) the request for access is made by the individual’s personal representative and the provision of access to such personal representative is reasonably likely to cause substantial harm to the individual or another person.
A covered entity may deny access to individuals, without providing the individual an opportunity for review, in the following protected situations: (a) the protected health information falls under an exception to the right of access; (b) an inmate request for protected health information under certain circumstances; (c) information that a provider creates or obtains in the course of research that includes treatment for which the individual has agreed not to have access as part of consenting to participate in the research (as long as access to the information is restored upon completion of the research); (d) for records subject to the Privacy Act, information to which access may be denied under the Privacy Act, 5 U.S.C. § 552a; and (e) information obtained under a promise of confidentiality from a source other than a health care provider, if granting access would likely reveal the source. 45 C.F.R. § 164.524.
58 45 C.F.R. § 164.526.
59 Covered entities may deny an individual’s request for amendment only under specified circumstances. A covered entity may deny the request if it: (a) may exclude the information from access by the individual; (b) did not create the information (unless the individual provides a reasonable basis to believe the originator is no longer available); (c) determines that the information is accurate and complete; or (d) does not hold the information in its designated record set. 164.526(a)(2).
60 45 C.F.R. § 164.528.
61 45 C.F.R. § 164.522(a).
62 45 C.F.R. § 164.522(a). In addition, a restriction agreed to by a covered entity is not effective under this subpart to prevent uses or disclosures permitted or required under §§ 164.502(a)(2)(ii), 164.510(a) or 164.512.
63 45 C.F.R. § 164.522(b).
64 45 C.F.R. § 164.530(i).
65 45 C.F.R. § 164.530(a).
67 45 C.F.R. § 164.530(b).
68 45 C.F.R. § 164.530(e).
69 45 C.F.R. § 164.530(f).
70 45 C.F.R. § 164.530(c).
71 45 C.F.R. § 164.530(d).
72 45 C.F.R. § 164.520(b)(1)(vi).
73 45 C.F.R. § 164.530(g).
74 45 C.F.R. § 164.530(h).
75 45 C.F.R. § 164.530(j).
76 45 C.F.R. § 164.530(k).
77 45 C.F.R. §§ 164.103, 164.105.
78 45 C.F.R. § 164.103.
79 45 C.F.R. §164.105. Common ownership exists if an entity possesses an ownership or equity interest of five percent or more in another entity; common control exists if an entity has the direct or indirect power significantly to influence or direct the actions or policies of another entity. 45 C.F.R. §§ 164.103.
An organized system of health care in which the participating covered entities hold themselves out to the public as part of a joint arrangement and jointly engage in utilization review, quality assessment and improvement activities, or risk-sharing payment activities.
A group health plan and the health insurer or HMO that insures the plan’s benefits, with respect to protected health information created or received by the insurer or HMO that relates to individuals who are or have been participants or beneficiaries of the group health plan.
All group health plans maintained by the same plan sponsor.
All group health plans maintained by the same plan sponsor and all health insurers and HMOs that insure the plans’ benefits, with respect to protected health information created or received by the insurers or HMOs that relates to individuals who are or have been participants or beneficiaries in the group health plans.
81 45 C.F.R. § 164.506(c)(5).
82 45 C.F.R. § 164.504(g).
83 45 C.F.R. § 164.504(f).
84 45 C.F.R. § 164.502(g).
86 45 C.F.R. § 160.202.
88 Pub. L. 104-191; 42 U.S.C. §1320d-5.
89 Pub. L. 104-191; 42 U.S.C. §1320d-6.
90 45 C.F.R. § 164.534.
91 45 C.F.R. § 160.103.
self-insurance should combine proxy measures to determine their total annual receipts.