{"ref":"DC-HC-PRV-02","title":"Information Security and Data Breach Notification","category":"Privacy","summary":"The Agency's security safeguards for client and employee information under D.C. Code §28-3852.01, how staff report a lost device or misdirected message, how the Director assesses a security incident on Form DC-HC-PRV-02-A, and the notices District law requires after a breach: to affected District residents without unreasonable delay, to the Office of the Attorney General when 50 or more District residents are affected, to consumer reporting agencies when more than 1,000 persons are notified, and free identity theft protection when Social Security or taxpayer numbers are involved, plus the HIPAA breach notices if the Agency is a covered entity.","inShort":["Lock every phone or device you use for work with a passcode, and keep it updated.","If a phone, laptop or bag with client papers is lost or stolen, call the Director at once, before the end of your shift.","If you send a message or email to the wrong person, tell the Director at once. You will not be disciplined for reporting a mistake promptly.","Never share your password or forward Agency email to a personal account.","After a breach, the Director tells the people affected and, when 50 or more District residents are affected, the DC Attorney General, as District law requires."],"primaryCitation":"D.C. Code §28-3852","citations":["D.C. Code §28-3851","D.C. Code §28-3852","D.C. Code §28-3852.01","D.C. Code §28-3852.02","D.C. Code §28-3853","22-B DCMR §9915.1(a)","22-B DCMR §9901.4"],"federalCitations":["45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR Part 164, Subpart C (only if the Agency is a HIPAA covered entity)"],"surveyorAsks":["How do you protect client information on phones and computers?","What does an aide do if a phone with client information is lost?"],"forms":[{"ref":"DC-HC-PRV-02-A","title":"Security Incident and Breach Assessment"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (D.C. Code §28-3852)","5. Security Safeguards","6. Reporting a Security Incident","7. Assessing the Incident","8. Notice to Affected District Residents","9. Notice to the Office of the Attorney General","10. Other Notices and Remedies","11. If the Agency Is a HIPAA Covered Entity","12. After the Breach","13. Responsibilities","14. Records and Compliance Monitoring","15. Staff Training","16. References","17. Related Policies and Forms","18. Approval","19. Revision History"],"version":"1.0","sample":false,"pack":"dc-hca","state":"Washington, DC","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}