Source: http://www.law.cornell.edu/cfr/text/45/164.404?qt-cfr_tabs=1
Timestamp: 2014-09-30 19:33:20
Document Index: 793091461

Matched Legal Cases: ['art 164', '§ 164', '§ 164', '§ 164', '§ 164', 'art 164']

45 CFR 164.404 - Notification to individuals. | LII / Legal Information Institute
CFR › Title 45 › Subtitle A › Subchapter C › Part 164 › Subpart D › Section 164.404 45 CFR 164.404 - Notification to individuals.
There is 1 rule appearing in the Federal Register for 45 CFR 164. View below or at eCFR (GPOAccess)
§ 164.404
Notification to individuals.
Standard—
A covered entity shall, following the discovery of a breach of unsecured protected health information, notify each individual whose unsecured protected health information has been, or is reasonably believed by the covered entity to have been, accessed, acquired, used, or disclosed as a result of such breach.
Breaches treated as discovered.
For purposes of paragraph (a)(1) of this section, §§ 164.406(a), and 164.408(a), a breach shall be treated as discovered by a covered entity as of the first day on which such breach is known to the covered entity, or, by exercising reasonable diligence would have been known to the covered entity. A covered entity shall be deemed to have knowledge of a breach if such breach is known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the breach, who is a workforce member or agent of the covered entity (determined in accordance with the federal common law of agency).
Implementation specification: Timeliness of notification.
Except as provided in § 164.412, a covered entity shall provide the notification required by paragraph (a) of this section without unreasonable delay and in no case later than 60 calendar days after discovery of a breach.
Implementation specifications: Content of notification—
The notification required by paragraph (a) of this section shall include, to the extent possible:
A description of the types of unsecured protected health information that were involved in the breach (such as whether full name, social security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved);
Any steps individuals should take to protect themselves from potential harm resulting from the breach;
A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against any further breaches; and
Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an e-mail address, Web site, or postal address.
Plain language requirement.
The notification required by paragraph (a) of this section shall be written in plain language.
Implementation specifications: Methods of individual notification.
The notification required by paragraph (a) of this section shall be provided in the following form:
Written notification by first-class mail to the individual at the last known address of the individual or, if the individual agrees to electronic notice and such agreement has not been withdrawn, by electronic mail. The notification may be provided in one or more mailings as information is available.
If the covered entity knows the individual is deceased and has the address of the next of kin or personal representative of the individual (as specified under § 164.502(g)(4) of subpart E), written notification by first-class mail to either the next of kin or personal representative of the individual. The notification may be provided in one or more mailings as information is available.
In the case in which there is insufficient or out-of-date contact information that precludes written notification to the individual under paragraph (d)(1)(i) of this section, a substitute form of notice reasonably calculated to reach the individual shall be provided. Substitute notice need not be provided in the case in which there is insufficient or out-of-date contact information that precludes written notification to the next of kin or personal representative of the individual under paragraph (d)(1)(ii).
In the case in which there is insufficient or out-of-date contact information for fewer than 10 individuals, then such substitute notice may be provided by an alternative form of written notice, telephone, or other means.
In the case in which there is insufficient or out-of-date contact information for 10 or more individuals, then such substitute notice shall:
Be in the form of either a conspicuous posting for a period of 90 days on the home page of the Web site of the covered entity involved, or conspicuous notice in major print or broadcast media in geographic areas where the individuals affected by the breach likely reside; and
Include a toll-free phone number that remains active for at least 90 days where an individual can learn whether the individual's unsecured protected health information may be included in the breach.
Additional notice in urgent situations.
In any case deemed by the covered entity to require urgency because of possible imminent misuse of unsecured protected health information, the covered entity may provide information to individuals by telephone or other means, as appropriate, in addition to notice provided under paragraph (d)(1) of this section.
Title 45 published on 2013-10-01The following are only the Rules published in the Federal Register after the published date of Title 45.For a complete list of all Rules, Proposed Rules, and Notices view the Rulemaking tab.2014-02-06; vol. 79 # 25 - Thursday, February 6, 201479 FR 7290 - CLIA Program and HIPAA Privacy Rule; Patients&apos; Access to Test Reports
Title 45 published on 2013-10-01The following are ALL rules, proposed rules, and notices (chronologically) published in the Federal Register relating to 45 CFR 164 after this date.2014-02-06; vol. 79 # 25 - Thursday, February 6, 201479 FR 7290 - CLIA Program and HIPAA Privacy Rule; Patients&apos; Access to Test Reports
2014-01-07; vol. 79 # 4 - Tuesday, January 7, 201479 FR 784 - Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and the National Instant Criminal Background Check System (NICS)
typeregulations.gov FR Doc.2014-00055 RIN DEPARTMENT OF HEALTH AND HUMAN SERVICES, Office of the Secretary Notice of proposed rulemaking. Submit comments on or before March 10, 2014. 45 CFR Part 164 SummaryThe Department of Health and Human Services (HHS or “the Department”) is issuing this notice of proposed rulemaking to modify the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule to expressly permit certain HIPAA covered entities to disclose to the National Instant Criminal Background Check System (NICS) the identities of individuals who are subject to a Federal “mental health prohibitor” that disqualifies them from shipping, transporting, possessing, or receiving a firearm. The NICS is a national system maintained by the Federal Bureau of Investigation (FBI) to conduct background checks on persons who may be disqualified from receiving firearms based on federally prohibited categories or State law. Among the persons subject to the Federal mental health prohibitor are individuals who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise have been determined by a court, board, commission, or other lawful authority to be a danger to themselves or others or to lack the mental capacity to contract or manage their own affairs, as a result of marked subnormal intelligence or mental illness, incompetency, condition, or disease. Under this proposal, only covered entities with lawful authority to make adjudication or commitment decisions that make individuals subject to the Federal mental health prohibitor, or that serve as repositories of information for NICS reporting purposes, would be permitted to disclose the information needed for these purposes. This disclosure would be restricted to limited demographic and certain other information and would not include medical records, or any mental health information beyond the indication that the individual is subject to the Federal mental health prohibitor. HHS notes that the Department of Justice (DOJ) has proposed clarifications to the regulatory definitions relevant to the Federal mental health prohibitor. The DOJ proposal is published elsewhere in this issue of the Federal Register . While commenters should consider this proposed regulation in light of the clarifications proposed in DOJ&apos;s proposal, we note that those clarifications would not change how this proposed HIPAA permission would operate.