Skip to content

Information Security and Data Breach Notification

The Agency's security safeguards for client and employee information under D.C. Code §28-3852.01, how staff report a lost device or misdirected message, how the Director assesses a security incident on Form DC-HC-PRV-02-A, and the notices District law requires after a breach: to affected District residents without unreasonable delay, to the Office of the Attorney General when 50 or more District residents are affected, to consumer reporting agencies when more than 1,000 persons are notified, and free identity theft protection when Social Security or taxpayer numbers are involved, plus the HIPAA breach notices if the Agency is a covered entity.

Preview: full text with a package
About this policy
Policy number
DC-HC-PRV-02
Version
1.0
Main rule
D.C. Code §28-3852
Library
Washington, DC home care · 50 policies
Category
Privacy
Sections
20

In short

  • Lock every phone or device you use for work with a passcode, and keep it updated.
  • If a phone, laptop or bag with client papers is lost or stolen, call the Director at once, before the end of your shift.
  • If you send a message or email to the wrong person, tell the Director at once. You will not be disciplined for reporting a mistake promptly.
  • Never share your password or forward Agency email to a personal account.
  • After a breach, the Director tells the people affected and, when 50 or more District residents are affected, the DC Attorney General, as District law requires.

What's inside

20 sections. The full text comes with the One-time Policy Pack.

Full text with a package
  • Terms of Reference
  • 1. Purpose
  • 2. Scope
  • 3. Definitions
  • 4. Policy Statement (D.C. Code §28-3852)
  • 5. Security Safeguards
  • 6. Reporting a Security Incident
  • 7. Assessing the Incident
  • 8. Notice to Affected District Residents
  • 9. Notice to the Office of the Attorney General
  • 10. Other Notices and Remedies
  • 11. If the Agency Is a HIPAA Covered Entity
  • 12. After the Breach
  • 13. Responsibilities
  • 14. Records and Compliance Monitoring
  • 15. Staff Training
  • 16. References
  • 17. Related Policies and Forms
  • 18. Approval
  • 19. Revision History

An inspector may ask

  • How do you protect client information on phones and computers?
  • What does an aide do if a phone with client information is lost?

See Cura Core with your agency's name on it.

Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.

Get startedSign in