{"ref":"MO-HSP-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets out what the Agency does when patient information may have been lost, stolen, sent to the wrong person or seen by someone who should not see it: immediate containment, the four-factor HIPAA risk assessment, notices to patients, the media and the U.S. Department of Health and Human Services within the federal time limits, and the Missouri breach notice law (RSMo §407.1500), which also covers employees' and others' personal information and requires notice to the Missouri Attorney General and the consumer reporting agencies when more than 1,000 Missouri residents are notified at one time.","inShort":["If patient papers or a device are lost or stolen, or information goes to the wrong person, tell the privacy official at once.","Do not try to decide yourself whether it is a breach. Help get the information back and save any evidence.","The Agency must notify patients no later than 60 days after it finds out, so every hour counts.","Missouri law also protects employees' and donors' personal information, such as Social Security numbers."],"primaryCitation":"45 CFR §§164.400-164.414","citations":["RSMo §407.1500","19 CSR 30-35.010(2)(K)6"],"federalCitations":["45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f)"],"surveyorAsks":["Walk me through what happens when a nurse reports that a visit bag with patient papers was stolen from her car.","Show me your breach log and the risk assessment for the last incident you decided was not a breach."],"forms":[{"ref":"MO-HSP-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.400-164.414; RSMo §407.1500)","5. First Steps and Risk Assessment","6. Federal Notices","6.1 Content of the notice to individuals","7. Missouri Notices (RSMo §407.1500)","8. Business Associates and Law Enforcement Delay","9. Timeline","10. Mitigation and Prevention","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"mo-hospice","state":"Missouri","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}