Orange County NC Website
Browse       Search
Policy 23: HIPAA Compliance Officer Action Plan: Breach Analysis Steps <br /> North State Medical Transport HIPAA Compliance Officer Action Plan: <br /> Breach Analysis Steps <br /> Step 1: Was there an acquisition,access,use or disclosure of PHI that was created, YES NO <br /> received,maintained,or transmitted by North State Medical Transport? The HIPAA <br /> Compliance Officer shall determine whether PHI was actually involved in the incident, Go to Step 2 There has been no breach of unsecured PHI and breach <br /> keeping in mind that PHI only includes individually identifiable information that relates to an notification is unnecessary. <br /> individual's healthcare or payment for healthcare. <br /> Ste 2: Was the PHI involved in the incident"unsecured?" PHI involved in an incident YES NO <br /> will be considered to be"unsecured"when it is in electronic form and it is not encrypted in <br /> accordance with North State Medical Transport's"Policy on Encryption and Decryption of e- Go to Step 3 If the HIPAA Compliance Officer determines that the PHI <br /> PHI;' involved in the incident was secured in accordance with North <br /> State Medical Transport's policies on securing hard copy and <br /> electronic PHI,then there has been no breach of unsecured PHI <br /> and breach notification is unnecessary. <br /> Step 3: Was there a HIPAA violation? The HIPAA Compliance Officer must make a YES NO <br /> determination that there was a violation of the HIPAA Privacy Rule. The incident must <br /> involve a use or disclosure that is not permitted by HIPAA. Go to Step 4 There has been no breach of unsecured PHI and breach <br /> notification is unnecessary. <br /> Step 4: Did the incident compromise the security or privacy of the PHI involved? To Yes NO <br /> determine whether the incident compromised the security or privacy of the PHI that was <br /> potentially breached,the HIPAA Compliance Officer must look to the 4-factors outlined Go to Step 5 There has been no breach of unsecured PHI and breach <br /> below: notification is unnecessary. <br /> Factor Explanation <br /> 1. The nature and Consider the type and amount of PHI involved and whether the <br /> extent of the PHI incident involved sensitive information. For example,credit card <br /> involved numbers,social security numbers,or other information that could <br /> be used for identity theft or financial fraud more likely <br />