2014-141 Health - NC HIE to oversee, administer and operate electronic health information exchange network

Browse Search

(c) Contents of Notification. The notification required by this Section 9 shall include sufficient information for NC HIE and notified Participants to understand the nature and the extent of the Breach. For instance,such notification should include,to the extent available at the time of the notification the following information: i. A brief description of what happened,including the date of the Breach and the date of discovery of the Breach,if known; ii. The identification of each Individual whose Patient Information has been,or is reasonably believed to have been, accessed,acquired,used, or Disclosed during the Breach; iii. Description of the roles of the people involved in the Breach (e.g., employees,Authorized Users,service providers,unauthorized persons, etc.); iv. Description of the types of Patient Information that were involved in the Breach(whether full name, Social Security number, date of birth, home address, account number, diagnosis, disability code, or other types of information were involved); V. Description of Participants likely impacted by the Breach; vi. Number of Individuals or records impacted/estimated to be impacted by the Breach; vii. Description of actions taken to investigate the Breach, to mitigate harm to Individuals,and to protect against any further Breach; viii. Current status of the Breach(under investigation or resolved); ix. Contact procedures for Individuals to ask questions or learn additional information, which shalt include a toll-free telephone number, an e- mail address,Web site,or postal address;and X. Corrective action taken and steps planned to be taken to prevent a similar Breach. (d) The notifying party shall have a duty to supplement the information contained in the notification as it becomes available and to cooperate with other Participants and NC HIE in mitigating the effects of the Breach. (e) Except as provided for in Section 9(c)(ii),the notification required by this Section 9 shall not include any Patient Information. (f) NC HIE will provide, in a timely manner, a summary of the Breach to such Participants that does not identify any of the Participants or Individuals involved in the Breach. (g) This Section 9 shall not be deemed to supersede or relieve a party's reporting obligations(if any) under relevant security incident, breach notification or confidentiality provisions of Applicable Law, including, but not limited to, those related to Individuals. (h) The parties shall work together to coordinate any notification to Individuals, and applicable regulatory agencies, and any public announcement regarding the Breach that may be required by Applicable Law or the policies of a party. 10. CONFIDENTIAL BUSINESS INFORMATION. 11