HIPAA and Pennsylvania Breach Notification

Sets out how the Agency recognizes, contains, assesses and reports a breach of patient or staff information: the HIPAA breach notification rule (individuals within 60 calendar days of discovery at the latest; media for more than 500 residents of a State; the HHS Secretary), and the Pennsylvania Breach of Personal Information Notification Act (notice without unreasonable delay; the Attorney General when more than 500 Pennsylvania residents must be notified; consumer reporting agencies when more than 500 persons are notified at one time; free credit report and credit monitoring where certain identifiers are involved).

Preview: full text with a package

About this policy

Policy number: PA-HH-PRV-03
Version: 1.0
Main rule: 45 CFR §§164.400-164.414
Library: Pennsylvania home health · 56 policies
Category: Privacy
Sections: 17

In short

If patient or staff information may have been lost, seen or sent to the wrong person, tell the office the same day.
Do not decide on your own that it is too small to report. The Privacy Official decides.
Help get the information back: ask the person who received it to return or destroy it, and tell the office what they said.
Do not contact affected patients yourself. The Agency sends any notice the law requires.

What's inside

17 sections. The full text comes with the One-time Policy Pack.

Full text with a package

Terms of Reference
1. Purpose
2. Scope
3. Definitions
4. Policy Statement (45 CFR §§164.400-164.414)
5. Risk Assessment
6. Federal Notification Requirements
7. Pennsylvania Notification Requirements
8. Business Associates and Law Enforcement Delay
9. Procedure
10. Responsibilities
11. Records and Compliance Monitoring
12. Staff Training
13. References
14. Related Policies and Forms
15. Approval
16. Revision History

An inspector may ask

What does a nurse do if she leaves a patient folder at the wrong house?
Show me your breach risk assessments for the past year, including incidents you decided were not breaches.

Pennsylvania home health

Get it for your agency

All 56 Pennsylvania home health policies, filled in with your details, in Word and PDF.

$950one-time · Policy Pack, required

The files are yours to keep. Includes 90 days in the portal with Premium; keep it after that for $99 a month or $990 a year.

Buy the Policy Pack See pricing

Rules it follows

45 CFR §§164.400-164.414Breach of Personal Information Notification Act (Act 94 of 2005), 73 P.S. §2301 et seq.73 P.S. §230273 P.S. §230373 P.S. §230573 P.S. §230745 CFR §164.40245 CFR §164.40445 CFR §164.40645 CFR §164.40845 CFR §164.41045 CFR §164.41245 CFR §164.41445 CFR §164.530(j)

Forms included

PA-HH-PRV-03-A Breach Risk Assessment

Read a sample in full

Guides on this topic

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get started Sign in