{"ref":"FL-HSP-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets how the Agency finds, assesses and reports a breach of patient information: the HIPAA four-factor risk assessment, notice to patients without unreasonable delay and no later than 60 days after discovery, notice to HHS and the media, and the Florida Information Protection Act (s. 501.171, F.S.), which requires notice to the Florida Department of Legal Affairs within 30 days when 500 or more Floridians are affected and notice to consumer reporting agencies when more than 1,000 are notified.","inShort":["If patient information goes to the wrong person, is lost or is seen by someone who should not see it, stop it if you safely can.","Tell Lee Sample at once, and no later than the end of your shift.","Write down what happened, when, and what information was involved.","Do not contact the patient or investigate further unless the privacy official asks you to.","The privacy official decides whether patients, the government and others must be told, and by when."],"primaryCitation":"45 CFR §§164.400-164.414","citations":["s. 501.171, F.S."],"federalCitations":["45 CFR §§164.400-164.414","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f)"],"surveyorAsks":["What does a staff member do if they send patient information to the wrong person?","Show me your breach log and a completed risk assessment."],"forms":[{"ref":"FL-HSP-PRV-03-A","title":"Breach Risk Assessment and Notification Log"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.400-164.414; s. 501.171, F.S.)","5. What Staff Do First","6. Risk Assessment","7. Notices","7.1 Content and method of the notice to individuals","8. After the Breach","9. Responsibilities","10. Records and Compliance Monitoring","11. Staff Training","12. References","13. Related Policies and Forms","14. Approval","15. Revision History"],"version":"1.0","sample":false,"pack":"fl-hospice","state":"Florida","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}