Breach Notification Under HIPAA and District Law
Sets out how the Agency finds, assesses, and reports breaches of patient information: staff report at once, the privacy official completes a documented four-factor risk assessment, patients are notified without unreasonable delay and no later than 60 calendar days after discovery, HHS (and for large breaches the media) is notified, and under District law the Attorney General for the District of Columbia is notified in writing whenever a breach of computerized personal information affects 50 or more District residents.
About this policy
- Policy number
- DC-HH-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §§164.400-164.414
- Library
- Washington, DC home health · 58 policies
- Category
- Privacy
- Sections
- 23
In short
- If patient information is lost, stolen, sent to the wrong person, or seen by someone who should not see it, call the privacy official right away.
- Report even if you are not sure. The deadline starts when any staff member knew.
- Help get the information back. Do not delete or hide anything.
- The privacy official decides if it is a breach and who must be told.
- Patients are told without unreasonable delay and never later than 60 days after the breach is discovered.
What's inside
23 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §§164.400-164.414; D.C. Code §28-3852)
- 5. Report at Once
- 6. Contain and Assess
- 6.1 Contain
- 6.2 Is it excluded?
- 6.3 Risk assessment
- 6.4 Decision
- 7. Notice to Patients
- 8. Notice to HHS and the Media
- 9. Notice to the Attorney General for the District of Columbia
- 10. Business Associates and Law Enforcement
- 11. The Breach Log and After-Action Review
- 12. Responsibilities
- 13. Records and Compliance Monitoring
- 14. Staff Training
- 15. References
- 16. Related Policies and Forms
- 17. Approval
- 18. Revision History
An inspector may ask
- Show me your breach log for this year and the risk assessment for each entry.
- Walk me through what happened when the last laptop or phone was lost.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.