2016-698 Emergency Svc - North State Medical Transport - Application for Services Franchise by Ordinance

Browse Search

Policy 22: Policy on Breaches of Unsecured PHI North State Medical Transport Policy on Breaches of Unsecured Protected Health Information Purpose Under the Health Information Technology for Economic and Clinical Health Act (the "HITECH Act") North State Medical Transport has an obligation, following the discovery of a breach of unsecured protected health information ("PHI"), to notify each individual whose unsecured PHI has been, or is reasonably believed to have been, accessed, acquired, used, or disclosed. North State Medical Transport also has an obligation to notify the Department of Health and Human Services ("HHS") of all breaches. In some cases, North State Medical Transport must notify media outlets about breaches of unsecured PHI. This policy details how North State Medical Transport will handle and respond to suspected and actual breaches of unsecured PHI. Scope This Policy applies to all North State Medical Transport staff members who come into contact with PHI. All suspected breach incidents shall be brought to the attention of the HIPAA Compliance Officer and the HIPAA Compliance Officer shall investigate each incident and initiate the appropriate response to the incident. Procedure Breach Defined 1. A breach is the acquisition, access, use, or disclosure of unsecured PHI in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the PHI. a. An acquisition, access, use, or disclosure of PHI created, received, maintained or transmitted by North State Medical Transport that is not permitted by HIPAA is presumed to be a breach unless North State Medical Transport demonstrates that there is a low probability that the PHI has been compromised based on a "risk assessment" of at least the following factors: i. The nature and extent of the PHI involved, including the types of identifiers and the likelihood of re-identification; ii. The unauthorized person who used the PHI or to whom the disclosure was made;