Breach Notification
Sets out how the Agency recognizes, assesses and reports a breach of patient information: notice to each patient without unreasonable delay and no later than 60 calendar days after discovery, notice to HHS and, for more than 500 District residents, the media under HIPAA, and the District’s added duties under D.C. Code §28-3852, including written notice to the DC Attorney General when 50 or more District residents are affected.
About this policy
- Policy number
- DC-HSP-PRV-03
- Version
- 1.0
- Main rule
- 45 CFR §164.400-414
- Library
- Washington, DC hospice · 60 policies
- Category
- Privacy
- Sections
- 17
In short
- A breach is when patient information is lost, stolen, sent to the wrong person or seen without a reason.
- Tell the privacy official or security official at once, and no later than the same day.
- Do what you safely can to limit harm, such as asking a wrong recipient to delete an e-mail.
- The Agency tells affected patients no later than 60 days after it finds out, and sooner when it can.
- If 50 or more District residents are affected, the Agency also tells the DC Attorney General.
What's inside
17 sections. The full text comes with the One-time Policy Pack.
- Terms of Reference
- 1. Purpose
- 2. Scope
- 3. Definitions
- 4. Policy Statement (45 CFR §164.400-414)
- 5. Reporting a Suspected Breach
- 6. Assessment
- 7. Notices Under HIPAA
- 8. District of Columbia Duties
- 9. Mitigation and Follow-Up
- 10. Responsibilities
- 11. Records and Compliance Monitoring
- 12. Staff Training
- 13. References
- 14. Related Policies and Forms
- 15. Approval
- 16. Revision History
An inspector may ask
- What would you do if a nurse’s laptop with patient information was stolen today?
- How do you decide whether a privacy incident is a reportable breach? Show me your last risk assessment.
See Cura Core with your agency's name on it.
Choose your state and type of agency, buy your Policy Pack online and get your sign-in by email. Already a customer? Sign in to your portal.