Data Breach Response and Notification
Sets how the Agency responds when client or employee information may have been exposed: reporting it at once, containing it, deciding whether it is a breach under California law (and HIPAA if the Agency is a covered entity), notifying affected people within the legal time limits and in the required format, notifying the Attorney General when more than 500 Californians are affected, and learning from what happened.
About this policy
- Policy number
- CA-HC-PRV-03
- Version
- 1.0
- Main rule
- Cal. Civ. Code §1798.82
- Library
- California home care · 50 policies
- Category
- Privacy
- Sections
- 18
In short
- A lost phone, a stolen bag, or a message sent to the wrong person can be a data breach.
- Call the Administrator at once. Do not wait until your next shift.
- Do not delete anything or try to fix it yourself unless the Administrator asks you to.
- California law gives the Agency only 30 calendar days to notify the people affected.
- You will not be disciplined for reporting a problem quickly and honestly.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (Cal. Civ. Code §1798.82)
- 5. Reporting a Possible Breach
- 6. Containing the Incident
- 7. Deciding Whether It Is a Breach
- 8. Notifying Affected People
- 9. Notifying Others
- 10. After the Breach
- 11. Responsibilities
- 12. Records and Compliance Monitoring
- 13. Staff Training
- 14. References
- 15. Related Policies and Forms
- 16. Approval
- 17. Revision History
An inspector may ask
- What would your staff do if an aide lost a phone with client information on it?
- How quickly must you notify people after a data breach, and what must the notice say?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.