Orange County NC Website
Browse       Search
1. North State Medical Transport shall notify HHS of all breaches of unsecured PHI in <br /> accordance with this policy. <br /> a. For breaches of unsecured PHI involving 500 or more individuals, North State <br /> Medical Transport shall provide notice to HHS when it provides notice to affected <br /> individuals. Notice must be provided in the manner specified on the HHS Website <br /> at: http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/. <br /> The HIPAA Compliance Officer shall be responsible for ensuring that such notice is <br /> submitted to HHS and must consult management before submitting the information <br /> to HHS. <br /> b. For breaches of unsecured PHI involving less than 500 individuals, North State <br /> Medical Transport shall maintain a log of such breaches and report them to HHS on <br /> an annual basis. The HIPAA Compliance Officer shall track these breaches on North <br /> State Medical Transport's "Log for Tracking Breach Incidents." The HIPAA <br /> Compliance Officer shall report these breaches to HHS annually, no later than 60 <br /> days after the end of the calendar year in which these breaches were discovered. <br /> This shall be done in the manner specified on the HHS Website at: <br /> http://www.hhs.gov/ocr/privacy/hipaa/administrative/breachnotificationrule/. The <br /> HIPAA Compliance Officer shall ensure that the information is submitted to HHS by <br /> March 1 of each year and must consult with management before submitting the <br /> information to HHS. <br /> Breach Notification in Accordance with State Law <br /> 1. The HIPAA Compliance Officer shall also determine, in consultation with legal counsel, <br /> whether North State Medical Transport has any additional breach notification <br /> obligations under applicable North Carolina laws or other state laws. <br /> 2. North State Medical Transport must look to each state in which an affected individual <br /> resides when making this determination and shall consult legal counsel licensed to <br /> practice in those states. <br /> Administrative Requirements <br /> 1. The HIPAA Compliance Officer shall record and maintain thorough records of all <br /> activities related to suspected and actual breach incidents. <br /> 2. In the event of a suspected crime, or other unlawful activity, local, state, or federal law <br /> enforcement may need to be notified. That determination will be made by <br /> management with recommendation from the HIPAA Compliance Officer.The HIPAA <br /> Compliance Officer shall coordinate communications with outside organizations and law <br /> enforcement. <br />