Breach Notification
Sets out how the Agency responds when client or employee information may have been lost, stolen, seen or sent improperly: report at once to the privacy official, contain and investigate, apply the HIPAA four-factor risk assessment, and give notice without unreasonable delay and no later than 60 calendar days after discovery to affected individuals, to the U.S. Department of Health and Human Services (at the same time for 500 or more, or in the annual log for fewer), and to the media for more than 500 residents of a state. It also applies the North Carolina Identity Theft Protection Act, G.S. 75-65, when Social Security, driver's license, account or similar numbers are involved, including notice to the Attorney General's Consumer Protection Division.
- Policy number
- NC-HC-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §164.404
- Library
- North Carolina home care · 50 policies
- Category
- Privacy
- Sections
- 18
In short
- A text, email or fax to the wrong person, a lost folder or a stolen phone may be a breach.
- Tell the privacy official at once, and always before the end of your shift.
- Help contain it: ask the wrong person to delete or return the information.
- Do not try to investigate or contact clients about it yourself. The Agency decides who must be told.
- Required notices go out without unreasonable delay and never later than the law allows.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §164.404)
- 5. Report and Contain
- 6. Exceptions and the Risk Assessment
- 7. HIPAA Notifications
- 8. North Carolina Security Breach Notice (G.S. 75-65)
- 9. Business Associates
- 10. After the Breach
- 11. Responsibilities
- 12. Records and Compliance Monitoring
- 13. Staff Training
- 14. References
- 15. Related Policies and Forms
- 16. Approval
- 17. Revision History
An inspector may ask
- An aide's phone with the EVV app was stolen. Walk me through what happens next.
- How do you decide whether an improper disclosure is a reportable breach?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.