{"ref":"CA-HC-PRV-03","title":"Data Breach Response and Notification","category":"Privacy","summary":"Sets how the Agency responds when client or employee information may have been exposed: reporting it at once, containing it, deciding whether it is a breach under California law (and HIPAA if the Agency is a covered entity), notifying affected people within the legal time limits and in the required format, notifying the Attorney General when more than 500 Californians are affected, and learning from what happened.","inShort":["A lost phone, a stolen bag, or a message sent to the wrong person can be a data breach.","Call the Administrator at once. Do not wait until your next shift.","Do not delete anything or try to fix it yourself unless the Administrator asks you to.","California law gives the Agency only 30 calendar days to notify the people affected.","You will not be disciplined for reporting a problem quickly and honestly."],"primaryCitation":"Cal. Civ. Code §1798.82","citations":["Cal. Civ. Code §1798.82","Cal. Civ. Code §1798.81.5","Cal. Health & Safety Code §1796.43(a)(1)"],"federalCitations":["45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414"],"surveyorAsks":["What would your staff do if an aide lost a phone with client information on it?","How quickly must you notify people after a data breach, and what must the notice say?"],"forms":[{"ref":"CA-HC-PRV-03-A","title":"Breach Assessment and Notification Log"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (Cal. Civ. Code §1798.82)","5. Reporting a Possible Breach","6. Containing the Incident","7. Deciding Whether It Is a Breach","8. Notifying Affected People","9. Notifying Others","10. After the Breach","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"ca-hca","state":"California","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}