{"ref":"NC-HSP-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets out what staff do the moment health or personal information may have gone to the wrong person: report at once, contain, assess the four HIPAA risk factors, and, for a breach, notify each patient (or the next of kin of a patient who has died) without unreasonable delay and within 60 calendar days, the media and HHS as the size of the breach requires, and, under the North Carolina Identity Theft Protection Act, the Consumer Protection Division of the Attorney General's Office and, above 1,000 persons, the consumer reporting agencies.","inShort":["If information goes to the wrong person, a device is lost, or someone sees what they should not, tell the Privacy Official at once and before the end of your shift.","Take the obvious steps to stop harm: ask the wrong recipient to destroy or return it, and get the device wiped.","Do not delete emails or logs and do not investigate on your own.","Write down what happened, when, who was involved and what information was affected.","The Privacy Official decides whether it is a breach. Patients, or the family of a patient who has died, must be told within 60 days."],"primaryCitation":"45 CFR §164.404","citations":["G.S. 75-61","G.S. 75-65","G.S. 14-113.20(b)"],"federalCitations":["45 CFR §§164.400-164.414","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414"],"surveyorAsks":["A nurse faxed a medication list to the wrong pharmacy. Walk me through what happens next.","How do you decide whether an incident is a reportable breach? Show me a completed assessment."],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.404)","5. Report and Contain at Once","6. Risk Assessment","6.1 Recording the decision","7. Notice to Each Affected Patient","7.1 How notice is sent","8. Notice to the Media and to HHS","9. North Carolina Identity Theft Protection Act","10. Breaches at a Business Associate","11. Law Enforcement Delay","12. After the Notice","13. Responsibilities","14. Records and Compliance Monitoring","15. Staff Training","16. References","17. Related Policies and Forms","18. Approval","19. Revision History"],"version":"1.0","sample":false,"pack":"nc-hospice","state":"North Carolina","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}