Breach Notification
Sets out how the Agency handles a lost, stolen or misdirected record or any other possible breach: same-day reporting, investigation, the HIPAA four-factor risk assessment, the separate Louisiana test for computerized personal information, the notices to individuals, HHS, the media and the Louisiana Attorney General with their time limits, law enforcement delay, and records.
About this policy
- Policy number
- LA-HSP-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR Part 164, Subpart D
- Library
- Louisiana hospice · 60 policies
- Category
- Privacy
- Sections
- 20
In short
- If patient or personal information may have been lost, stolen, seen or sent to the wrong person, tell the Privacy Official at once, the same day.
- Do not try to fix it or contact the patient yourself. The Privacy Official investigates and decides who must be told.
- Under HIPAA, patients are told without unreasonable delay and no later than 60 calendar days after the breach is discovered.
- Under Louisiana law, residents whose computerized personal information was taken are told within 60 days, and the Attorney General is told within 10 days of that notice.
- Every suspected breach is recorded on Form LA-HSP-PRV-03-A, even when no notice is needed.
What's inside
20 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR Part 164, Subpart D)
- 5. Reporting a Suspected Breach
- 6. Investigation
- 7. Is It a HIPAA Breach?
- 8. Does Louisiana’s Breach Law Apply?
- 9. Notices and Time Limits
- 10. Content of the Notice to Individuals
- 11. Law Enforcement Delay
- 12. After the Breach
- 13. Responsibilities
- 14. Records and Compliance Monitoring
- 15. Staff Training
- 16. References
- 17. Related Policies and Forms
- 18. Approval
- 19. Revision History
An inspector may ask
- What would a nurse do if she faxed a patient’s record to the wrong number?
- Show me your breach log and how you decided whether notice was required.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.