{"ref":"DC-HSP-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets out how the Agency recognizes, assesses and reports a breach of patient information: notice to each patient without unreasonable delay and no later than 60 calendar days after discovery, notice to HHS and, for more than 500 District residents, the media under HIPAA, and the District’s added duties under D.C. Code §28-3852, including written notice to the DC Attorney General when 50 or more District residents are affected.","inShort":["A breach is when patient information is lost, stolen, sent to the wrong person or seen without a reason.","Tell the privacy official or security official at once, and no later than the same day.","Do what you safely can to limit harm, such as asking a wrong recipient to delete an e-mail.","The Agency tells affected patients no later than 60 days after it finds out, and sooner when it can.","If 50 or more District residents are affected, the Agency also tells the DC Attorney General."],"primaryCitation":"45 CFR §164.400-414","citations":["D.C. Code §28-3851","D.C. Code §28-3852"],"federalCitations":["45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f)"],"surveyorAsks":["What would you do if a nurse’s laptop with patient information was stolen today?","How do you decide whether a privacy incident is a reportable breach? Show me your last risk assessment."],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.400-414)","5. Reporting a Suspected Breach","6. Assessment","7. Notices Under HIPAA","8. District of Columbia Duties","9. Mitigation and Follow-Up","10. Responsibilities","11. Records and Compliance Monitoring","12. Staff Training","13. References","14. Related Policies and Forms","15. Approval","16. Revision History"],"version":"1.0","sample":false,"pack":"dc-hospice","state":"Washington, DC","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}