{"ref":"OH-HH-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets out what the Agency does when patient information may have been lost, stolen, sent to the wrong person or otherwise compromised: same-day internal reporting, containment, a documented four-factor risk assessment, and every notice HIPAA requires (individuals within 60 calendar days of discovery, the HHS Secretary, and the media for large breaches). Explains that Ohio’s data breach notice law does not apply to a HIPAA covered entity, so HIPAA governs.","inShort":["If patient information is lost, stolen, sent to the wrong person or seen by someone who should not see it, tell the office the same day.","Report even if you are not sure anything went wrong. The Privacy Official decides, not you.","Help get the information back: ask the person who received it to return or destroy it, and tell the office.","Patients must be told of a breach within 60 days of its discovery, so a late report puts the Agency at risk."],"primaryCitation":"45 CFR §164.404","citations":["ORC 1349.19","ORC 1349.19(F)(2)"],"federalCitations":["45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.530"],"surveyorAsks":["Walk me through what happens when a nurse reports a lost tablet or a misdirected fax.","Show me the risk assessment for your last privacy incident and how you concluded whether notice was required."],"forms":[{"ref":"OH-HH-PRV-03-A","title":"Breach Risk Assessment and Notification Record"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §164.404)","5. Risk Assessment","6. Federal Notification Requirements","7. Content and Method of Notice to Individuals","8. Ohio Law","9. Business Associates and Law Enforcement Delay","10. Procedure","11. Responsibilities","12. Records and Compliance Monitoring","13. Staff Training","14. References","15. Related Policies and Forms","16. Approval","17. Revision History"],"version":"1.0","sample":false,"pack":"oh-hha","state":"Ohio","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}