Skip to content

Breach Notification

Sets out what the Agency does when patient information may have been lost, stolen, sent to the wrong person or seen by someone who should not see it: immediate containment, the four-factor HIPAA risk assessment, notices to patients, the media and the U.S. Department of Health and Human Services within the federal time limits, and the Missouri breach notice law (RSMo §407.1500), which also covers employees' and others' personal information and requires notice to the Missouri Attorney General and the consumer reporting agencies when more than 1,000 Missouri residents are notified at one time.

Preview: full text with a package
About this policy
Policy number
MO-HSP-PRV-03
Version
1.0
Main rule
45 CFR §§164.400-164.414
Library
Missouri hospice · 59 policies
Category
Privacy
Sections
19

In short

  • If patient papers or a device are lost or stolen, or information goes to the wrong person, tell the privacy official at once.
  • Do not try to decide yourself whether it is a breach. Help get the information back and save any evidence.
  • The Agency must notify patients no later than 60 days after it finds out, so every hour counts.
  • Missouri law also protects employees' and donors' personal information, such as Social Security numbers.

What's inside

19 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR §§164.400-164.414; RSMo §407.1500)
  • 5. First Steps and Risk Assessment
  • 6. Federal Notices
  • 6.1 Content of the notice to individuals
  • 7. Missouri Notices (RSMo §407.1500)
  • 8. Business Associates and Law Enforcement Delay
  • 9. Timeline
  • 10. Mitigation and Prevention
  • 11. Responsibilities
  • 12. Records and Compliance Monitoring
  • 13. Staff Training
  • 14. References
  • 15. Related Policies and Forms
  • 16. Approval
  • 17. Revision History

An inspector may ask

  • Walk me through what happens when a nurse reports that a visit bag with patient papers was stolen from her car.
  • Show me your breach log and the risk assessment for the last incident you decided was not a breach.

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in