Breach Notification Under HIPAA and North Carolina Law
Requires every suspected loss, theft or wrongful disclosure of patient or employee information to be reported to the Privacy Official the same day, assessed in writing, and notified as the law requires: under HIPAA, to each affected patient no later than 60 calendar days after discovery, to HHS, and to the media for large breaches; and under North Carolina’s Identity Theft Protection Act, to each affected person without unreasonable delay when unencrypted personal information such as a Social Security or account number is involved, with notice to the Attorney General’s Consumer Protection Division.
- Policy number
- NC-HH-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §164.404
- Library
- North Carolina home health · 57 policies
- Category
- Privacy
- Sections
- 18
In short
- If patient or employee information may have been lost, seen or sent to the wrong person, tell the Privacy Official at once and in every case the same day, even if you are not sure.
- Never decide alone that an incident is too small to report. The Privacy Official decides whether the law requires notice.
- Help contain it: get the folder back, ask the wrong recipient to return or destroy the information, and report a lost device so it can be locked or wiped.
- Under HIPAA, affected patients must be told no later than 60 calendar days after the breach is discovered, so report without delay.
- North Carolina law also protects Social Security, bank and card numbers of patients and employees, on paper or on a computer.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §§164.400 to 164.414; G.S. 75-65)
- 5. Which Law Applies
- 6. Risk Assessment
- 7. HIPAA Notices
- 8. North Carolina Notices (G.S. 75-65)
- 9. Business Associates and Law Enforcement Delay
- 10. Procedure
- 11. Responsibilities
- 12. Records and Compliance Monitoring
- 13. Staff Training
- 14. References
- 15. Related Policies and Forms
- 16. Approval
- 17. Revision History
An inspector may ask
- Show me your breach log and the risk assessment for each incident.
- An aide left another patient’s visit sheet in a home. Was that a breach, and who decided?
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.