Breach Notification
Explains what happens when patient information is lost, stolen, sent to the wrong person or seen by someone who should not see it: staff report it the same day, the Privacy Official assesses it, and the Agency notifies every affected individual, the U.S. Department of Health and Human Services and, for large breaches, the media, within the HIPAA time limits. It also explains how the Georgia breach statute relates to a private hospice.
About this policy
- Policy number
- GA-HSP-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR Part 164 Subpart D
- Library
- Georgia hospice · 60 policies
- Category
- Privacy
- Sections
- 18
In short
- If patient information is lost, stolen, misdirected or overheard, tell the Privacy Official the same day.
- Report even if you are not sure. Deciding is the Privacy Official’s job.
- Help get the information back: ask the wrong recipient to return or destroy it.
- Patients must be told within 60 days of discovery at the latest, so every hour counts.
- Write down what happened, when, and who was involved.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §§164.400-164.414)
- 5. Risk Assessment
- 6. Federal Notices
- 6.1 Content and method of notice to individuals
- 7. Georgia Breach Statute
- 8. Business Associates and Law Enforcement Delay
- 9. Procedure
- 10. Responsibilities
- 11. Records and Compliance Monitoring
- 12. Staff Training
- 13. References
- 14. Related Policies and Forms
- 15. Approval
- 16. Revision History
An inspector may ask
- A nurse’s bag with a visit sheet is stolen from her car. Walk me through what happens next.
- Show me the risk assessment for your most recent incident, or your log showing you had none.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.