{"ref":"LA-HSP-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets out how the Agency handles a lost, stolen or misdirected record or any other possible breach: same-day reporting, investigation, the HIPAA four-factor risk assessment, the separate Louisiana test for computerized personal information, the notices to individuals, HHS, the media and the Louisiana Attorney General with their time limits, law enforcement delay, and records.","inShort":["If patient or personal information may have been lost, stolen, seen or sent to the wrong person, tell the Privacy Official at once, the same day.","Do not try to fix it or contact the patient yourself. The Privacy Official investigates and decides who must be told.","Under HIPAA, patients are told without unreasonable delay and no later than 60 calendar days after the breach is discovered.","Under Louisiana law, residents whose computerized personal information was taken are told within 60 days, and the Attorney General is told within 10 days of that notice.","Every suspected breach is recorded on Form LA-HSP-PRV-03-A, even when no notice is needed."],"primaryCitation":"45 CFR Part 164, Subpart D","citations":["R.S. 51:3071 et seq.","R.S. 51:3073","R.S. 51:3074","R.S. 51:3076","LAC 16:III.701"],"federalCitations":["45 CFR Part 164, Subpart D","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(j)"],"surveyorAsks":["What would a nurse do if she faxed a patient’s record to the wrong number?","Show me your breach log and how you decided whether notice was required."],"forms":[{"ref":"LA-HSP-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR Part 164, Subpart D)","5. Reporting a Suspected Breach","6. Investigation","7. Is It a HIPAA Breach?","8. Does Louisiana’s Breach Law Apply?","9. Notices and Time Limits","10. Content of the Notice to Individuals","11. Law Enforcement Delay","12. After the Breach","13. Responsibilities","14. Records and Compliance Monitoring","15. Staff Training","16. References","17. Related Policies and Forms","18. Approval","19. Revision History"],"version":"1.0","sample":false,"pack":"la-hospice","state":"Louisiana","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}