Skip to content

Breach of Medical Information: Reports to the Department and to Patients

Sets out what staff do the moment they suspect patient information has been seen, used, or sent without authorization, how the privacy official assesses it, and the reports that follow: to the Department and to the patient no later than 15 business days after detection (Cal. Health & Safety Code §1280.15(b); 22 CCR §79902), with the content the regulations require; HIPAA notice to patients, HHS, and the media where required (45 CFR §§164.404-164.408); California data breach notice where computerized personal information is involved (Cal. Civ. Code §1798.82); law enforcement delays; and the records the Agency keeps, including non-breach risk assessments for six years.

Preview: full text with a package
About this policy
Policy number
CA-HH-PRV-03
Version
1.0
Main rule
Cal. Health & Safety Code §1280.15(b)
Library
California home health · 58 policies
Category
Privacy
Sections
20

In short

  • If patient information may have gone to the wrong person or been lost, call the privacy official the same day.
  • Examples: a fax or email to the wrong place, a lost bag or device, a note left in the wrong home, someone looking at a record without a reason.
  • Ask the wrong recipient to return or destroy what they got, but do not tell the patient yourself.
  • The Agency must report to the Department and the patient within 15 business days of finding out, so every hour counts.
  • Fill in an incident report and write down when you first knew.

What's inside

20 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (Cal. Health & Safety Code §1280.15(b))
  • 5. What Staff Do at Once
  • 6. Assessment
  • 7. Report to the Department
  • 8. Notice to the Patient
  • 9. Other Notices
  • 10. Business Associates
  • 11. Law Enforcement Delay
  • 12. After the Notices
  • 13. Responsibilities
  • 14. Records and Compliance Monitoring
  • 15. Staff Training
  • 16. References
  • 17. Related Policies and Forms
  • 18. Approval
  • 19. Revision History

An inspector may ask

  • Walk me through what happens when a nurse sends a visit note to the wrong fax number.
  • Show me your breach log and your reports to the Department for the last three years.

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in