{"ref":"PA-HSP-PRV-03","title":"Breach Notification","category":"Privacy","summary":"Sets out what the Agency does when patient or staff information may have been lost, seen or sent to the wrong person: same-day reporting, containment, the HIPAA risk assessment, the federal notices to individuals, HHS and the media, and the Pennsylvania breach law duties, including the Attorney General and consumer reporting agency notices and free credit monitoring.","inShort":["If patient or staff information may have been lost, seen or sent to the wrong person, tell the privacy official the same day, even if you are not sure.","Do not decide for yourself whether it matters. The privacy official assesses every report.","Help limit the harm: ask the wrong recipient to return or destroy the information, and report a lost device so it can be locked or wiped.","Write down what happened, when, and who was involved.","The law sets strict time limits for telling patients and others, so speed matters."],"primaryCitation":"45 CFR §§164.400-164.414","citations":["73 P.S. §2301 et seq."],"federalCitations":["45 CFR §§164.400-164.414","45 CFR §164.402","45 CFR §164.404","45 CFR §164.406","45 CFR §164.408","45 CFR §164.410","45 CFR §164.412","45 CFR §164.414","45 CFR §164.530(f), (j)"],"surveyorAsks":["A nurse faxed a medication list to the wrong nursing facility. Walk me through what you do.","How do you decide whether an incident is a reportable breach?"],"forms":[],"headings":["Terms of Reference","1. Purpose","2. Scope","3. Definitions","4. Policy Statement (45 CFR §§164.400-164.414)","5. Risk Assessment","6. Federal Notices","6.1 Content and method of notice to individuals","7. Pennsylvania Notices","7.1 How the HIPAA and Pennsylvania duties fit together","8. Business Associates and Law Enforcement Delay","9. Procedure","10. Responsibilities","11. Records and Compliance Monitoring","12. Staff Training","13. References","14. Related Policies and Forms","15. Approval","16. Revision History"],"version":"1.0","sample":false,"pack":"pa-hospice","state":"Pennsylvania","service":"Hospice","guides":[{"path":"/guides/hospice-policies/","h1":"What policies are required for hospice?"},{"path":"/guides/hospice-conditions-of-participation/","h1":"Hospice Conditions of Participation: which policies each one needs"}],"agency":{"name":"Sample Agency","legalName":"Sample Agency, LLC","logo":null}}