Skip to content

Breach Notification

Sets out what staff do the moment health or personal information may have gone to the wrong person: report at once, contain, assess the four HIPAA risk factors, and, for a breach, notify each patient (or the next of kin of a patient who has died) without unreasonable delay and within 60 calendar days, the media and HHS as the size of the breach requires, and, under the North Carolina Identity Theft Protection Act, the Consumer Protection Division of the Attorney General's Office and, above 1,000 persons, the consumer reporting agencies.

Preview: full text with a package
About this policy
Policy number
NC-HSP-PRV-03
Version
1.0
Main rule
45 CFR §164.404
Library
North Carolina hospice · 60 policies
Category
Privacy
Sections
22

In short

  • If information goes to the wrong person, a device is lost, or someone sees what they should not, tell the Privacy Official at once and before the end of your shift.
  • Take the obvious steps to stop harm: ask the wrong recipient to destroy or return it, and get the device wiped.
  • Do not delete emails or logs and do not investigate on your own.
  • Write down what happened, when, who was involved and what information was affected.
  • The Privacy Official decides whether it is a breach. Patients, or the family of a patient who has died, must be told within 60 days.

What's inside

22 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR §164.404)
  • 5. Report and Contain at Once
  • 6. Risk Assessment
  • 6.1 Recording the decision
  • 7. Notice to Each Affected Patient
  • 7.1 How notice is sent
  • 8. Notice to the Media and to HHS
  • 9. North Carolina Identity Theft Protection Act
  • 10. Breaches at a Business Associate
  • 11. Law Enforcement Delay
  • 12. After the Notice
  • 13. Responsibilities
  • 14. Records and Compliance Monitoring
  • 15. Staff Training
  • 16. References
  • 17. Related Policies and Forms
  • 18. Approval
  • 19. Revision History

An inspector may ask

  • A nurse faxed a medication list to the wrong pharmacy. Walk me through what happens next.
  • How do you decide whether an incident is a reportable breach? Show me a completed assessment.

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in