{"ref":"MI-HC-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets how the Agency finds, assesses and reports a breach of clients' unsecured protected health information under the HIPAA Breach Notification Rule (the four-factor risk assessment, notice to each affected person without unreasonable delay and no later than 60 calendar days after discovery, media notice for more than 500 residents of a state, and notice to HHS), how it handles a breach of employees' or clients' Social Security, driver's license or financial account numbers under Michigan's Identity Theft Protection Act, and how every incident is logged.","inShort":["A lost phone or file, or information sent to the wrong person, may be a breach.","Tell the privacy official the same day. Do not try to fix it quietly.","Help contain it: ask the wrong recipient to delete or return the information.","The privacy official decides whether it is a breach and sends any notices on time.","Clients must be told no later than 60 days after a breach is discovered, so speed matters."],"primaryCitation":"45 CFR §164.404","citations":["MCL 445.63","MCL 445.72"],"federalCitations":["45 CFR §164.400","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530"],"surveyorAsks":["A caregiver texted a client's schedule to the wrong person. Walk me through what you would do.","How do you decide whether an incident is a reportable breach?"],"forms":[{"ref":"MI-HC-PRV-03-A","title":"Breach Risk Assessment and Notification Log"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.404)","5. Step 1: Report and Contain (Same Day)","6. Step 2: Decide Whether It Is a HIPAA Breach","7. Step 3: Give the HIPAA Notices","8. Law Enforcement Delay","9. Michigan Identity Theft Protection Act","10. Step 4: Log, Correct and Report","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"mi-hca","state":"Michigan","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}