Source: http://docplayer.net/30490490-Dates-revised-september-23-2013-july-1-2014-december-14-2015.html
Timestamp: 2018-10-19 17:02:46
Document Index: 477184733

Matched Legal Cases: ['art 164', 'art 164', 'art 164', 'art 164', 'art 164', 'art 164', 'art 164', 'art 164']

Dates Revised: September 23, 2013; July 1, 2014; December 14, PDF
Download "Dates Revised: September 23, 2013; July 1, 2014; December 14, 2015"
1 Policy Level: Policy Title: Policy Number: Breach Notification PP-29 Superseded Policy(ies) or Entity Policy: N/A Date Established: March 17, 2010 Date Effective: December 14, 2015 Dates Revised: September 23, 2013; July 1, 2014; December 14, 2015 Next Review Date: December 14, 2018 PURPOSE AND SCOPE The purpose of this policy is to establish the following: s obligation to notify patients and other parties of a breach of Protected Health Information (PHI); The parties that must be notified and timelines that must be observed; Required elements of notifications made to patients; and Parties responsible for implementing the policy. This policy applies to the healthcare components of the University of Washington (UW) affiliated covered entity. DEFINITIONS 1. Breach: the acquisition, access, use or disclosure of PHI that is: Not for treatment, payment or healthcare operations; Not authorized by the patient; Not otherwise allowed by law; and Compromises the security or privacy of the PHI. A breach excludes: An unintentional acquisition, access or use of PHI by a workforce member or business associate (BA) who is acting in good faith within the scope of their authority (providing it does not result in further impermissible use or disclosure); An inadvertent disclosure of PHI between two persons who are both authorized to access PHI, providing the information received as a result of such disclosure is not further impermissibly used or disclosed; Page 1
2 A disclosure of PHI to an unauthorized person, who believes, in good faith, would not reasonably have been able to retain such information; and Situations where a formal risk assessment based on required factors demonstrates that there is a low probability that the PHI has been compromised. 2. Breach Discovery Date: The first day on which the breach is known (or should have reasonably been known) to have occurred by any workforce member or agent of (other than the person committing the breach). 3. Unsecured Protected Health Information: PHI that is not rendered unusable, unreadable or indecipherable to unauthorized persons through a technology or methodology specified in guidance issued by the Secretary of U.S. Department of Health and Human Services (DHHS) (for example, encryption). See Policy: PP-00 Glossary of Terms. POLICY I. Obligation to Notify will review all relevant facts to determine if a breach of PHI has occurred, including a formal risk assessment based on required factors to determine the probability that the PHI has been compromised. When a breach is confirmed, will provide written notification to appropriate parties. II. Parties that must be notified Patients. The Secretary of the DHHS. The Washington State Attorney General must be notified when a privacy breach involves more than 500 Washington state residents. The local media must be notified when a privacy breach involves more than 500 residents of any given state or jurisdiction. III. Notification Timelines In general, notifications are made as soon as possible, without unreasonable delay, and in no case later than 60 calendar days after the breach discovery date. Exceptions: Notification may be delayed if it would impede a criminal investigation or cause damage to national security. If a breach involves less than 500 patients, the timeframe for notification to DHHS is within 60 days of the end of the calendar year in which the breach occurred. Page 2
3 IV. Required Elements of Patient Notifications A. Written Notifications 1. Must be sent by and signed by the UW Privacy Official or designee. 2. Must be sent by first-class mail to the patient s last known address (or to the patient s personal representative if the patient is deceased and has the personal representative s address). If specified in the patient s medical record as a preference, the notification may be sent by Must contain the following elements: A brief description of what happened, including the breach discovery date and the actual date of the incident, if known; A specific description of the unsecured PHI that was involved in the breach (such as full name, Social Security number, date of birth, home address, account number or disability code); The steps patients should take to protect themselves from potential harm resulting from the breach; A brief description of what is doing to investigate the breach, mitigate losses and help prevent further breaches; and Instructions for obtaining further information, making inquiries, and obtaining assistance (including toll-free telephone number, address, website or postal address). B. Alternatives to Written Notification 1. If there is insufficient or out-of-date contact information that precludes direct written notification to 10 or more patients, will provide substitute notice. The substitute notices must include a toll-free phone number for obtaining additional information about the breach and may be in one of the following forms: A conspicuous posting for 90 days on the covered entity s website; A notice in appropriate print or broadcast media that serve geographic areas where affected patients likely reside; An alternative form of written notice, such as by or by telephone. 2. If imminent misuse of unsecured PHI is suspected, notification may be by telephone or other means. Page 3
4 V. Documentation Requirements Written documentation must be maintained to demonstrate completion of the following actions: Breach risk assessment. Notification to required parties, including copies of letters. VI. Responsibility for Implementation 1. assesses whether an incident constitutes a breach as defined by HIPAA, makes the relevant recommendation to the UW Privacy Official, makes the required notifications and maintains all documentation. 2. The UW Privacy Official makes the final breach determination and issues (or delegates authority) patient notifications. 3. The department in which the breach occurred may be required to pay for the cost of notifying patients. REGULATORY/LEGISLATION/REFERENCES 45 CFR Part 164; Section Definitions. 45 CFR Part 164; Section Notification to individuals. 45 CFR Part 164; Section Notification to the media. 45 CFR Part 164; Section Notification to the Secretary. 45 CFR Part 164; Section Notification by a business associate. 45 CFR Part 164; Section Law enforcement delay. 45 CFR Part 164; Section (g) (1) Standard: Personal representatives Uses and disclosures requiring an opportunity for the individual to agree or to object. 45 CFR Part 164; Section (e) (4) Implementation specifications: Data use agreement. RCW Disclosure, notice Definitions Rights, remedies. RCW Civil action for damages Treble damages authorized Action by governmental entities. RCW Personal Information Notice of Security Breaches PROCEDURE ADDENDUM(s) REFERENCES/LINKS Policy: PP-00 Glossary of Terms ROLES AND RESPONSIBILITIES Defined within POLICY. Page 4
5 AUTHORITIES Custodian Responsible Officer Implementation Administrative Officer Officer Privacy Official Author Owner Auditor Endorser Executive Committee APPROVALS UW Privacy Official Johnese M. Spisso, Chief Health System Officer, & Vice President for Medical Affairs, UW Date Page 5
PURPOSE AND SCOPE This table is applicable to all UW Medicine Compliance Policies governing privacy.
Applicability: Policy Title: Policy Number: Glossary of s PP-00 Superseded Policy(ies) or Entity Policy: N/A Date Established: October 27, 2003 Date Effective: September 21, 2015 Dates Revised: November