{"ref":"MO-HH-PRV-03","title":"HIPAA and Missouri Breach Notification","category":"Privacy","summary":"Sets out how the Agency responds when patient or personal information may have been lost, stolen or seen by the wrong person: immediate internal reporting, containment, the four-factor HIPAA risk assessment, notice to patients without unreasonable delay and no later than 60 calendar days after discovery, notice to the media and to HHS where the HIPAA thresholds are met, the law enforcement delay, and the Missouri breach notice law (RSMo §407.1500), including notice to the Missouri attorney general and consumer reporting agencies when more than 1,000 Missouri residents are notified at one time.","inShort":["Report at once any lost record or device, misdirected fax or email, or snooping in records.","Do not delete anything or contact the media. The privacy official leads the response.","Patients must be told of a breach without unreasonable delay and no later than 60 days after discovery.","Missouri law also requires notice to affected residents, and to the attorney general when more than 1,000 are notified at one time.","Write down what happened, when you found out, and who you told."],"primaryCitation":"45 CFR §164.404","citations":["RSMo §407.1500"],"federalCitations":["45 CFR §§164.400 to 164.414","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f), (j)"],"surveyorAsks":["A nurse's tablet was stolen from her car. Walk me through what you do.","How do you decide whether an incident is a reportable breach?"],"forms":[{"ref":"MO-HH-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.400 to 164.414; RSMo §407.1500)","5. What Staff Do at Once","6. Investigation and Risk Assessment","7. HIPAA Notices","8. Missouri Notices","9. Business Associates and Law Enforcement Delay","10. After the Notices","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"mo-hha","state":"Missouri","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}