Breach Notification Under HIPAA and Louisiana Law
Sets out how the Agency recognizes, reports, investigates and documents a possible breach of patient information and gives the notices that the HIPAA Breach Notification Rule (45 CFR §§164.400 to 164.414) and the Louisiana Database Security Breach Notification Law (R.S. 51:3071 et seq.; LAC 16:III.701) require: to each affected person without unreasonable delay and no later than 60 calendar days after discovery, to the media and the Secretary of Health and Human Services where the rule requires, and to the Louisiana Attorney General's Consumer Protection Section.
- Policy number
- LA-HH-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §164.404
- Library
- Louisiana home health · 57 policies
- Category
- Privacy
- Sections
- 21
In short
- Report any lost record, lost device, or information sent to the wrong person at once, before your shift ends.
- Call the privacy official, or the Administrator if you cannot reach them.
- Do not investigate or delete anything yourself.
- The law sets strict deadlines to tell patients, so every minute counts.
- Reporting a mistake quickly is never punished. Hiding one is.
What's inside
21 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §164.404)
- 5. Recognizing and Reporting a Possible Breach
- 6. First Steps and the Discovery Date
- 7. Is It a HIPAA Breach? Exceptions and the Risk Assessment
- 8. Is It a Breach Under Louisiana Law?
- 9. Notification Time Limits
- 10. Content and Method of the Notice to Individuals
- 11. Notices to the Secretary, the Media, and the Attorney General
- 12. Business Associates
- 13. After the Incident: Mitigation, Sanctions, and Prevention
- 14. Responsibilities
- 15. Records and Compliance Monitoring
- 16. Staff Training
- 17. References
- 18. Related Policies and Forms
- 19. Approval
- 20. Revision History
An inspector may ask
- A nurse's bag with three patients' visit notes was stolen from her car. Walk me through what you do and the deadlines.
- Show me your breach log and the risk assessment for your most recent incident.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.