{"ref":"NC-HC-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets out how the Agency responds when client or employee information may have been lost, stolen, seen or sent improperly: report at once to the privacy official, contain and investigate, apply the HIPAA four-factor risk assessment, and give notice without unreasonable delay and no later than 60 calendar days after discovery to affected individuals, to the U.S. Department of Health and Human Services (at the same time for 500 or more, or in the annual log for fewer), and to the media for more than 500 residents of a state. It also applies the North Carolina Identity Theft Protection Act, G.S. 75-65, when Social Security, driver's license, account or similar numbers are involved, including notice to the Attorney General's Consumer Protection Division.","inShort":["A text, email or fax to the wrong person, a lost folder or a stolen phone may be a breach.","Tell the privacy official at once, and always before the end of your shift.","Help contain it: ask the wrong person to delete or return the information.","Do not try to investigate or contact clients about it yourself. The Agency decides who must be told.","Required notices go out without unreasonable delay and never later than the law allows."],"primaryCitation":"45 CFR §164.404","citations":["G.S. 75-61","G.S. 75-65","G.S. 14-113.20(b)","10A NCAC 13J .1001(a)(10)"],"federalCitations":["45 CFR §164.400-414","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f), (j)"],"surveyorAsks":["An aide's phone with the EVV app was stolen. Walk me through what happens next.","How do you decide whether an improper disclosure is a reportable breach?"],"forms":[{"ref":"NC-HC-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.404)","5. Report and Contain","6. Exceptions and the Risk Assessment","7. HIPAA Notifications","8. North Carolina Security Breach Notice (G.S. 75-65)","9. Business Associates","10. After the Breach","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"nc-hca","state":"North Carolina","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}