{"ref":"CA-HH-PRV-03","title":"Breach of Medical Information: Reports to the Department and to Patients","category":"Privacy","summary":"Sets out what staff do the moment they suspect patient information has been seen, used, or sent without authorization, how the privacy official assesses it, and the reports that follow: to the Department and to the patient no later than 15 business days after detection (Cal. Health & Safety Code §1280.15(b); 22 CCR §79902), with the content the regulations require; HIPAA notice to patients, HHS, and the media where required (45 CFR §§164.404-164.408); California data breach notice where computerized personal information is involved (Cal. Civ. Code §1798.82); law enforcement delays; and the records the Agency keeps, including non-breach risk assessments for six years.","inShort":["If patient information may have gone to the wrong person or been lost, call the privacy official the same day.","Examples: a fax or email to the wrong place, a lost bag or device, a note left in the wrong home, someone looking at a record without a reason.","Ask the wrong recipient to return or destroy what they got, but do not tell the patient yourself.","The Agency must report to the Department and the patient within 15 business days of finding out, so every hour counts.","Fill in an incident report and write down when you first knew."],"primaryCitation":"Cal. Health & Safety Code §1280.15(b)","citations":["Cal. Health & Safety Code §1280.15","Cal. Health & Safety Code §1280.15(a)","Cal. Health & Safety Code §1280.15(b)","Cal. Health & Safety Code §1280.15(c)","Cal. Health & Safety Code §1280.15(d)","22 CCR §79901","22 CCR §79902","22 CCR §79903","22 CCR §79904","Cal. Civ. Code §1798.82"],"federalCitations":["45 CFR §164.400","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414"],"surveyorAsks":["Walk me through what happens when a nurse sends a visit note to the wrong fax number.","Show me your breach log and your reports to the Department for the last three years."],"forms":[{"ref":"CA-HH-PRV-03-A","title":"Breach Assessment and Reporting Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (Cal. Health & Safety Code §1280.15(b))","5. What Staff Do at Once","6. Assessment","7. Report to the Department","8. Notice to the Patient","9. Other Notices","10. Business Associates","11. Law Enforcement Delay","12. After the Notices","13. Responsibilities","14. Records and Compliance Monitoring","15. Staff Training","16. References","17. Related Policies and Forms","18. Approval","19. Revision History"],"version":"1.0","sample":false,"pack":"ca-hha","state":"California","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}