HIPAA Breach Notification
Explains what to do if client information is lost, stolen, or sent to the wrong person: tell the office at once, so the Agency can assess the incident and notify every person and authority the law requires within the federal deadlines.
About this policy
- Policy number
- GA-HC-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §§164.400-164.414
- Library
- Georgia home care · 49 policies
- Category
- Privacy
- Sections
- 18
In short
- If client papers or a phone with client information are lost or stolen, tell the office the same day.
- Also report a text, email or document sent to the wrong person, even if you think it is minor.
- Do not decide yourself whether it is a breach. The Privacy Official decides.
- Help get the information back or deleted if the office asks you to.
- Never hide or delay a report. You will not be punished for reporting honestly.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §§164.400-164.414)
- 5. Risk Assessment
- 6. Who Must Be Notified and When
- 7. Content and Method of Notice to Individuals
- 8. Georgia Law and Staff Information
- 9. Business Associates and Law Enforcement Delay
- 10. Procedure
- 11. Responsibilities
- 12. Records and Compliance Monitoring
- 13. Staff Training
- 14. References
- 15. Related Policies and Forms
- 16. Approval
- 17. Revision History
An inspector may ask
- Ask a caregiver: a client's daily record fell out of your bag at the store. What do you do?
- Show me the risk assessment for your most recent privacy incident, or your log showing you have had none.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.