{"ref":"LA-HC-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets out what the Agency does when client or staff information may have been lost, stolen or wrongly shared: immediate reporting and containment, the HIPAA four-factor risk assessment, notice to individuals, the media and HHS within the federal time limits, and notice to Louisiana residents and the Attorney General under R.S. 51:3074 and LAC 16:III.701.","inShort":["If client or staff information is lost, stolen, seen by the wrong person or sent to the wrong place, tell your supervisor and the privacy official at once.","Do not investigate on your own and do not delete anything.","The Agency decides whether it is a breach and must notify affected people no later than 60 days after discovery.","Louisiana law also requires notice to affected residents and to the Attorney General.","Reporting quickly protects clients and is never punished."],"primaryCitation":"45 CFR §164.404","citations":["La. R.S. 51:3073","La. R.S. 51:3074","LAC 16:III.701"],"federalCitations":["45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f)","45 CFR §164.530(j)"],"surveyorAsks":["What does a worker do if a phone with client information is lost or a document is sent to the wrong person?","Show me your breach log and the risk assessment for this incident."],"forms":[{"ref":"LA-HC-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.404)","5. Step 1: Report at Once","6. Step 2: Contain and Mitigate","7. Step 3: Decide Whether It Is a HIPAA Breach","8. Step 4: Notify Affected Clients","9. Step 5: Notify the Media and HHS","10. Law Enforcement Delay","11. Louisiana Notice Requirements","12. Breaches by Business Associates","13. After the Breach","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"la-hca","state":"Louisiana","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}