Breach Notification Under HIPAA and the Michigan Identity Theft Protection Act
Sets out what the Agency does when protected health information or other personal information may have been lost, stolen, seen or sent where it should not go: immediate reporting to the Privacy Official, containment, the four-factor risk assessment under 45 CFR §164.402, notice to patients without unreasonable delay and in no case later than 60 calendar days after discovery, notice to HHS and, for more than 500 residents of a state, to the media, the law enforcement delay, breaches by business associates, the yearly HHS report for smaller breaches, and the separate Michigan Identity Theft Protection Act duties for personal information (such as employees’ Social Security numbers) that HIPAA does not cover. Form MI-HH-PRV-03-A records each assessment and notice.
- Policy number
- MI-HH-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §164.400 to §164.414
- Library
- Michigan home health · 57 policies
- Category
- Privacy
- Sections
- 24
In short
- If patient information is lost, stolen, sent to the wrong person or seen by someone who should not see it, tell the Privacy Official at once.
- Do not delete anything or try to fix it alone. Follow the Privacy Official’s instructions.
- The Privacy Official decides whether it is a breach that must be reported, using a written risk assessment.
- Patients are told without unreasonable delay and never later than 60 calendar days after the Agency discovers the breach.
- The clock starts the day any staff member knows, so reporting late puts the Agency at risk.
What's inside
24 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §164.400 to §164.414)
- 5. Report at Once and Contain
- 6. Is It a Breach? Exceptions and Risk Assessment
- 6.1 The Four-Factor Risk Assessment
- 7. Notice Time Frames
- 8. Notice to Patients
- 8.1 Content
- 8.2 Method
- 9. Media and HHS Notice
- 10. Law Enforcement Delay
- 11. Breaches by Business Associates
- 12. Michigan Identity Theft Protection Act
- 13. After the Breach
- 14. Responsibilities
- 15. Records and Compliance Monitoring
- 16. Staff Training
- 17. References
- 18. Related Policies and Forms
- 19. Approval
- 20. Revision History
An inspector may ask
- Walk me through what happens when a nurse loses a phone or sends a visit note to the wrong fax number.
- Show me your breach log and the risk assessment for this incident.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.