HIPAA and Missouri Breach Notification
Sets out how the Agency responds when patient or personal information may have been lost, stolen or seen by the wrong person: immediate internal reporting, containment, the four-factor HIPAA risk assessment, notice to patients without unreasonable delay and no later than 60 calendar days after discovery, notice to the media and to HHS where the HIPAA thresholds are met, the law enforcement delay, and the Missouri breach notice law (RSMo §407.1500), including notice to the Missouri attorney general and consumer reporting agencies when more than 1,000 Missouri residents are notified at one time.
- Policy number
- MO-HH-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §164.404
- Library
- Missouri home health · 57 policies
- Category
- Privacy
- Sections
- 18
In short
- Report at once any lost record or device, misdirected fax or email, or snooping in records.
- Do not delete anything or contact the media. The privacy official leads the response.
- Patients must be told of a breach without unreasonable delay and no later than 60 days after discovery.
- Missouri law also requires notice to affected residents, and to the attorney general when more than 1,000 are notified at one time.
- Write down what happened, when you found out, and who you told.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §§164.400 to 164.414; RSMo §407.1500)
- 5. What Staff Do at Once
- 6. Investigation and Risk Assessment
- 7. HIPAA Notices
- 8. Missouri Notices
- 9. Business Associates and Law Enforcement Delay
- 10. After the Notices
- 11. Responsibilities
- 12. Records and Compliance Monitoring
- 13. Staff Training
- 14. References
- 15. Related Policies and Forms
- 16. Approval
- 17. Revision History
An inspector may ask
- A nurse's tablet was stolen from her car. Walk me through what you do.
- How do you decide whether an incident is a reportable breach?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.