Orange County NC Website
Browse       Search
iii. Whether the PHI was actually acquired or viewed; and <br /> iv. The extent to which the risk to the PHI has been mitigated. <br /> b. "Unsecured protected health Information"is PHI that has not been rendered <br /> unusable, unreadable, or indecipherable to unauthorized individuals through the use <br /> of a technology or methodology specified by HHS for securing PHI - available on <br /> HHS's website at: http://www.hhs.gov/ocr/privacy. Generally, PHI is "unsecured" if <br /> it is not encrypted by strong encryption technology or if it has not been properly <br /> destroyed. If the PHI is able to be used, read, or deciphered it is "unsecured." <br /> 2. A breach does not include any of the following: <br /> a. Unintentional acquisition, access, or use of unsecured PHI by a staff member at <br /> North State Medical Transport or someone acting under the authority of North State <br /> Medical Transport if the acquisition, access, or use was made in good faith and <br /> within that individual's scope of authority, so long as the information was not <br /> further used or disclosed in violation of HIPAA. <br /> b. Any inadvertent disclosure of PHI by a North State Medical Transport staff member <br /> who is generally authorized to access PHI to another person at North State Medical <br /> Transport who is generally authorized to access PHI, so long as the information <br /> received as a result of such disclosure was not further used or disclosed in violation <br /> of HIPAA. <br /> c. A disclosure of PHI where North State Medical Transport has a good faith belief that <br /> an unauthorized person to whom the disclosure was made would not reasonably <br /> have been able to retain the information. <br /> Reporting a Suspected Breach Incident <br /> 1. All North State Medical Transport staff members are responsible for immediately <br /> reporting a suspected breach incident to a supervisor or the HIPAA Compliance Officer. <br /> North State Medical Transport staff members shall report all known and suspected <br /> HIPAA violations. <br /> 2. The HIPAA Compliance Officer will notify management about the suspected incident. <br /> 3. The HIPAA Compliance Officer shall document the date that the suspected breach of <br /> unsecured PHI occurred (if known) and the date(s) on which the supervisor and the <br /> HIPAA Compliance Officer were notified about the incident. <br /> Investigating a Suspected Breach Incident <br />