Breach Notification
Sets out what the Agency does when patient information may have been lost, stolen, sent to the wrong person or otherwise compromised: same-day internal reporting, containment, a documented four-factor risk assessment, and every notice HIPAA requires (individuals within 60 calendar days of discovery, the HHS Secretary, and the media for large breaches). Explains that Ohio’s data breach notice law does not apply to a HIPAA covered entity, so HIPAA governs.
About this policy
- Policy number
- OH-HH-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §164.404
- Library
- Ohio home health · 59 policies
- Category
- Privacy
- Sections
- 18
In short
- If patient information is lost, stolen, sent to the wrong person or seen by someone who should not see it, tell the office the same day.
- Report even if you are not sure anything went wrong. The Privacy Official decides, not you.
- Help get the information back: ask the person who received it to return or destroy it, and tell the office.
- Patients must be told of a breach within 60 days of its discovery, so a late report puts the Agency at risk.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §164.404)
- 5. Risk Assessment
- 6. Federal Notification Requirements
- 7. Content and Method of Notice to Individuals
- 8. Ohio Law
- 9. Business Associates and Law Enforcement Delay
- 10. Procedure
- 11. Responsibilities
- 12. Records and Compliance Monitoring
- 13. Staff Training
- 14. References
- 15. Related Policies and Forms
- 16. Approval
- 17. Revision History
An inspector may ask
- Walk me through what happens when a nurse reports a lost tablet or a misdirected fax.
- Show me the risk assessment for your last privacy incident and how you concluded whether notice was required.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.