{"ref":"OH-HC-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets how the Agency recognizes, investigates and reports a breach of client information: the HIPAA risk assessment, notice to clients without unreasonable delay and in no case later than 60 calendar days after discovery, notice to the Secretary of Health and Human Services and, for more than 500 residents of a state, the media; and, for an Agency that is not a HIPAA covered entity, Ohio's breach notice law for computerized personal information (no later than forty-five days after discovery).","inShort":["If client information went to the wrong person, was lost or was seen by someone without a reason, tell your supervisor and the privacy official the same day.","Examples: papers left in the wrong home, a text to the wrong number, a lost phone or folder.","Do not try to fix it alone and do not delete anything.","The privacy official decides whether clients and the government must be told, and sends the notices on time.","Reporting a mistake quickly is never punished; hiding one is."],"primaryCitation":"45 CFR §164.404","citations":["ORC 1349.19"],"federalCitations":["45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414"],"surveyorAsks":["What does a staff member do on finding that a client's information went to the wrong person?","How do you decide whether an incident is a reportable breach?"],"forms":[{"ref":"OH-HC-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.404)","5. Reporting a Suspected Breach Inside the Agency","6. Deciding Whether It Is a Reportable Breach (HIPAA)","7. Notifying Clients (HIPAA)","8. Notifying the Secretary and the Media (HIPAA)","9. Breaches by Business Associates","10. If the Agency Is Not a HIPAA Covered Entity: Ohio Law","11. Program and Other Notices","12. Responsibilities","13. Records and Compliance Monitoring","14. Staff Training","15. References","16. Related Policies and Forms","17. Approval","18. Revision History"],"version":"1.0","sample":false,"pack":"oh-hca","state":"Ohio","service":"Home care","guides":[{"path":"/guides/home-care-agency-policies/","h1":"What policies does a home care agency need?"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}