{"ref":"MO-HC-PRV-03","title":"Breach Notification","category":"Privacy","summary":"What the Agency does when participant or employee information may have been lost, stolen, viewed or sent without permission: immediate reporting and containment, reports to the state agency, the four-factor HIPAA risk assessment, notice to individuals without unreasonable delay and no later than 60 calendar days after discovery, notice to HHS and the media where required, Missouri breach notice under RSMo 407.1500, law enforcement delays, and documentation.","inShort":["Report at once if participant or employee information may have gone to the wrong person, been lost or stolen, or been seen by someone not allowed.","Examples: a lost phone or bag, a fax or e-mail to the wrong person, someone using your EVV log-in.","Call the privacy official, Lee Sample, or the office right away. Do not wait to be sure.","Help get the information back, but do not try to investigate on your own.","You will not be punished for reporting a mistake honestly."],"primaryCitation":"45 CFR §164.404","citations":["RSMo 407.1500","MMAC In-Home Services Program Requirements 6.3.i, 6.3.j, 6.3.k, 6.3.l, 6.3.p"],"federalCitations":["45 CFR §§164.400 to 164.414","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f), (j)"],"surveyorAsks":["An aide's phone with the EVV application was stolen last month. Walk me through what you did.","Show me your breach log and your last report to HHS."],"forms":[{"ref":"MO-HC-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.404)","5. Step 1: Report at Once","6. Step 2: Contain and Reduce Harm","7. Step 3: Tell the State Agency","8. Step 4: Risk Assessment","9. Step 5: Notify Individuals","10. Step 6: Notify HHS and, Where Required, the Media","11. Step 7: Missouri Breach Notice (RSMo 407.1500)","12. Law Enforcement Delay","13. Breaches by the Agency's Business Associates","14. Responsibilities","15. Records and Compliance Monitoring","16. Staff Training","17. References","18. Related Policies and Forms","19. Approval","20. Revision History"],"version":"1.0","sample":false,"pack":"mo-hca","state":"Missouri","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}