{"ref":"GA-HH-PRV-03","title":"HIPAA Breach Notification","category":"Privacy","summary":"Sets out what the Agency does when patient information may have been lost, stolen, sent to the wrong person, or otherwise compromised: same-day internal reporting, containment, a documented four-factor risk assessment, and every notice HIPAA requires (individuals within 60 calendar days of discovery, the HHS Secretary, and the media for large breaches), with the limited Georgia breach notice law explained.","inShort":["If patient information is lost, stolen, sent to the wrong person, or seen by someone who should not see it, tell the Administrator the same day.","Report it even if you are not sure it matters. The Administrator decides whether the law requires notice, not you.","Help get the information back: ask the person who received it to return or destroy it, and tell the office so a lost device can be locked or wiped.","The law gives us strict deadlines to notify patients, so a late report can put the Agency at risk."],"primaryCitation":"45 CFR §§164.400-164.414","citations":["O.C.G.A. §10-1-912","Ga. Comp. R. & Regs. 111-8-31-.09(f)"],"federalCitations":["45 CFR §§164.400-164.414","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.414","45 CFR §164.530"],"surveyorAsks":["Walk me through what happens when a nurse reports a lost tablet or a misdirected fax.","Show me the risk assessment for your last privacy incident and how you concluded whether notice was required."],"forms":[{"ref":"GA-HH-PRV-03-A","title":"Breach Risk Assessment"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.400-164.414)","5. Risk Assessment","6. Federal Notification Requirements","7. Content and Method of Notice to Individuals","8. Georgia Law","9. Business Associates and Law Enforcement Delay","10. Procedure","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"ga-hha","state":"Georgia","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}