{"ref":"PA-HH-PRV-03","title":"HIPAA and Pennsylvania Breach Notification","category":"Privacy","summary":"Sets out how the Agency recognizes, contains, assesses and reports a breach of patient or staff information: the HIPAA breach notification rule (individuals within 60 calendar days of discovery at the latest; media for more than 500 residents of a State; the HHS Secretary), and the Pennsylvania Breach of Personal Information Notification Act (notice without unreasonable delay; the Attorney General when more than 500 Pennsylvania residents must be notified; consumer reporting agencies when more than 500 persons are notified at one time; free credit report and credit monitoring where certain identifiers are involved).","inShort":["If patient or staff information may have been lost, seen or sent to the wrong person, tell the office the same day.","Do not decide on your own that it is too small to report. The Privacy Official decides.","Help get the information back: ask the person who received it to return or destroy it, and tell the office what they said.","Do not contact affected patients yourself. The Agency sends any notice the law requires."],"primaryCitation":"45 CFR §§164.400-164.414","citations":["Breach of Personal Information Notification Act (Act 94 of 2005), 73 P.S. §2301 et seq.","73 P.S. §2302","73 P.S. §2303","73 P.S. §2305","73 P.S. §2307"],"federalCitations":["45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(j)"],"surveyorAsks":["What does a nurse do if she leaves a patient folder at the wrong house?","Show me your breach risk assessments for the past year, including incidents you decided were not breaches."],"forms":[{"ref":"PA-HH-PRV-03-A","title":"Breach Risk Assessment"}],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.400-164.414)","5. Risk Assessment","6. Federal Notification Requirements","7. Pennsylvania Notification Requirements","8. Business Associates and Law Enforcement Delay","9. Procedure","10. Responsibilities","11. Records and Compliance Monitoring","12. Staff Training","13. References","14. Related Policies and Forms","15. Approval","16. Revision History"],"version":"1.0","sample":false,"pack":"pa-hha","state":"Pennsylvania","service":"Home health","guides":[{"path":"/guides/home-health-agency-policies/","h1":"What policies and procedures are required for home health agencies?"},{"path":"/guides/home-health-conditions-of-participation/","h1":"Home health Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}