HIPAA Breach Notification
Explains what every staff member does when patient information is lost, stolen, misdirected, or seen by the wrong person, how the Administrator decides whether it is a breach, and who must be notified and by when under HIPAA and Texas law: patients, the HHS Secretary, the media, the Texas Attorney General, and consumer reporting agencies.
About this policy
- Policy number
- TX-HH-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §§164.400-164.414
- Library
- Texas home health · 56 policies
- Category
- Privacy
- Sections
- 18
In short
- If patient information is lost, stolen, sent to the wrong person, or seen by the wrong person, tell the office the same day.
- Report even if you are not sure it matters. The Privacy Official decides.
- After hours, call (512) 555-0199.
- Do not try to fix it alone or contact the person who got the information unless the office tells you to.
What's inside
18 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §§164.400-164.414)
- 5. Risk Assessment
- 6. Federal Notification Requirements
- 7. Content and Method of Notice to Individuals
- 8. Texas Notification Requirements
- 9. Business Associates and Law Enforcement Delay
- 10. Procedure
- 11. Responsibilities
- 12. Records and Compliance Monitoring
- 13. Staff Training
- 14. References
- 15. Related Policies and Forms
- 16. Approval
- 17. Revision History
An inspector may ask
- A nurse left a visit folder in a patient’s home with another patient’s notes in it. Walk me through what you did.
- Show me the risk assessment for your last reported incident and how you decided whether to notify.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.