Breach Notification: HIPAA and Health & Safety Code §1280.15
Sets out how and when the Agency reports a privacy breach. California's rule is stricter and faster than HIPAA: any unlawful or unauthorized access to, use or disclosure of a patient's medical information is reported to CDPH and to the patient or representative no later than 15 business days after it is detected (Health & Safety Code §1280.15), with daily penalties for late reports. HIPAA breach notices to individuals (within 60 calendar days), to HHS and, for large breaches, to the media follow, and California's computerized data breach law can also apply.
- Policy number
- CA-HSP-PRV-03
- Version
- 1.0
- Main rule
- Cal. Health & Safety Code §1280.15
- Library
- California hospice · 60 policies
- Category
- Privacy
- Sections
- 18
In short
- If patient information goes to the wrong person, is lost, or someone looks at a record without need, tell the privacy official the same day.
- California requires the Agency to report it to CDPH and to the patient within 15 business days after it is found, so every hour counts.
- Do not try to fix it alone, delete anything or contact the person who received it unless the privacy official asks you to.
- Write down what happened, when, and who was involved.
- You will not be punished for reporting in good faith.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (Health & Safety Code §1280.15)
- 5. Reporting a Suspected Breach Inside the Agency
- 6. Assessment (Day 0 to Day 5)
- 7. Who Is Told and When
- 8. Law Enforcement Delay
- 9. Penalties the Agency Is Exposed To
- 10. After the Notices
- 11. Responsibilities
- 12. Records and Compliance Monitoring
- 13. Staff Training
- 14. References
- 15. Related Policies and Forms
- 16. Approval
- 17. Revision History
An inspector may ask
- How and when do staff report a suspected breach, and to whom?
- Show me your breach log. When was this incident detected and when did you report it to CDPH and the patient?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.