Breach Notification Under HIPAA and the Florida Information Protection Act
Sets how the Agency investigates a possible breach of patient information, carries out the HIPAA four-factor risk assessment, and gives every notice required by the HIPAA Breach Notification Rule and the Florida Information Protection Act (s. 501.171, F.S.): to each affected person no later than 30 days after the breach is determined, which meets both laws; to the Florida Department of Legal Affairs when 500 or more Floridians are affected; to the media and HHS as HIPAA requires; and to the consumer reporting agencies when more than 1,000 people are notified at once.
- Policy number
- FL-HH-PRV-03
- Version
- 1.0
- Main rule
- s. 501.171, F.S.
- Library
- Florida home health · 57 policies
- Category
- Privacy
- Sections
- 19
In short
- A lost phone, a fax to the wrong number, or a record left in the wrong place may be a breach.
- Report it at once to the privacy official, Lee Sample, or to the Administrator.
- Take any quick step that stops the problem, such as asking the wrong recipient to destroy the information.
- Do not contact patients or the media yourself. The privacy official decides who must be told, and when.
What's inside
19 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (s. 501.171, F.S.)
- 5. Reporting a Possible Breach
- 6. Investigation and Risk Assessment
- 7. Who Must Be Notified and When
- 8. Content and Method of Notice to Individuals
- 9. Notice to the Department of Legal Affairs
- 10. Business Associates, Third-Party Agents, and Law Enforcement Delay
- 11. After the Notices
- 12. Responsibilities
- 13. Records and Compliance Monitoring
- 14. Staff Training
- 15. References
- 16. Related Policies and Forms
- 17. Approval
- 18. Revision History
An inspector may ask
- Show me your breach log. How did you decide that this incident was not a breach?
- A nurse left a visit list on a patient's porch. Walk me through what you did.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.