{"ref":"NC-HH-PRV-03","title":"Breach Notification Under HIPAA and North Carolina Law","category":"Privacy","summary":"Requires every suspected loss, theft or wrongful disclosure of patient or employee information to be reported to the Privacy Official the same day, assessed in writing, and notified as the law requires: under HIPAA, to each affected patient no later than 60 calendar days after discovery, to HHS, and to the media for large breaches; and under North Carolina’s Identity Theft Protection Act, to each affected person without unreasonable delay when unencrypted personal information such as a Social Security or account number is involved, with notice to the Attorney General’s Consumer Protection Division.","inShort":["If patient or employee information may have been lost, seen or sent to the wrong person, tell the Privacy Official at once and in every case the same day, even if you are not sure.","Never decide alone that an incident is too small to report. The Privacy Official decides whether the law requires notice.","Help contain it: get the folder back, ask the wrong recipient to return or destroy the information, and report a lost device so it can be locked or wiped.","Under HIPAA, affected patients must be told no later than 60 calendar days after the breach is discovered, so report without delay.","North Carolina law also protects Social Security, bank and card numbers of patients and employees, on paper or on a computer."],"primaryCitation":"45 CFR §164.404","citations":["G.S. 75-61","G.S. 75-65","G.S. 14-113.20(b)","10A NCAC 13J .1001(a)(10)"],"federalCitations":["45 CFR §164.400","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(j)"],"surveyorAsks":["Show me your breach log and the risk assessment for each incident.","An aide left another patient’s visit sheet in a home. Was that a breach, and who decided?"],"forms":[{"ref":"NC-HH-PRV-03-A","title":"Breach Risk Assessment"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.400 to 164.414; G.S. 75-65)","5. Which Law Applies","6. Risk Assessment","7. HIPAA Notices","8. North Carolina Notices (G.S. 75-65)","9. Business Associates and Law Enforcement Delay","10. Procedure","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"nc-hha","state":"North Carolina","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}