{"ref":"FL-HH-PRV-03","title":"Breach Notification Under HIPAA and the Florida Information Protection Act","category":"Privacy","summary":"Sets how the Agency investigates a possible breach of patient information, carries out the HIPAA four-factor risk assessment, and gives every notice required by the HIPAA Breach Notification Rule and the Florida Information Protection Act (s. 501.171, F.S.): to each affected person no later than 30 days after the breach is determined, which meets both laws; to the Florida Department of Legal Affairs when 500 or more Floridians are affected; to the media and HHS as HIPAA requires; and to the consumer reporting agencies when more than 1,000 people are notified at once.","inShort":["A lost phone, a fax to the wrong number, or a record left in the wrong place may be a breach.","Report it at once to the privacy official, Lee Sample, or to the Administrator.","Take any quick step that stops the problem, such as asking the wrong recipient to destroy the information.","Do not contact patients or the media yourself. The privacy official decides who must be told, and when."],"primaryCitation":"s. 501.171, F.S.","citations":["s. 501.171, F.S.","s. 501.171(1), F.S.","s. 501.171(3), F.S.","s. 501.171(4), F.S.","s. 501.171(5), F.S.","s. 501.171(6), F.S.","s. 501.171(9), F.S."],"federalCitations":["45 CFR Part 164, Subpart D","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f)"],"surveyorAsks":["Show me your breach log. How did you decide that this incident was not a breach?","A nurse left a visit list on a patient's porch. Walk me through what you did."],"forms":[{"ref":"FL-HH-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (s. 501.171, F.S.)","5. Reporting a Possible Breach","6. Investigation and Risk Assessment","7. Who Must Be Notified and When","8. Content and Method of Notice to Individuals","9. Notice to the Department of Legal Affairs","10. Business Associates, Third-Party Agents, and Law Enforcement Delay","11. After the Notices","12. Responsibilities","13. Records and Compliance Monitoring","14. Staff Training","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"fl-hha","state":"Florida","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}