Skip to content

Breach Notification

Sets out what the Agency does when consumer or staff information may have been lost, stolen or shared wrongly: report it at once, contain it, assess the risk, and give the notices required by HIPAA (individuals within 60 days of discovery, the Secretary of Health and Human Services, and the media for large breaches) and by the Pennsylvania Breach of Personal Information Notification Act (residents without unreasonable delay, the Attorney General and consumer reporting agencies when more than 500 people are notified, and free credit monitoring where Social Security, bank account or driver’s license numbers are involved).

Preview: full text with a package
About this policy
Policy number
PA-HC-PRV-03
Version
1.0
Main rule
45 CFR §164.404
Library
Pennsylvania home care · 49 policies
Category
Privacy
Sections
18

In short

  • If consumer or staff information may have been lost, stolen or sent to the wrong person, tell the Privacy Official the same day.
  • Do not wait to be sure, and do not try to hide or fix it yourself.
  • Help get the information back: for example, ask a wrong email recipient to delete it.
  • The Privacy Official decides who must be told. People affected must be told within 60 days at the latest.

What's inside

18 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (45 CFR §164.404)
  • 5. Reporting and Containing a Possible Breach
  • 6. Risk Assessment
  • 7. HIPAA Notices and Time Limits
  • 8. Content of the Notice to Individuals
  • 9. Pennsylvania Notices
  • 10. Business Associates
  • 11. Responsibilities
  • 12. Records and Compliance Monitoring
  • 13. Staff Training
  • 14. References
  • 15. Related Policies and Forms
  • 16. Approval
  • 17. Revision History

An inspector may ask

  • Walk me through what happened the last time a worker lost a phone or a paper visit note.
  • Show me your breach log and the four-factor risk assessment for each entry.

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in