Orange County NC Website
Browse       Search
compromises the security of information.The same is true for <br /> clinical information,especially detailed clinical information(e.g., <br /> treatment,medication,medical history information,etc.). <br /> 2. The person who Consider whether the person who received the information has <br /> used the PHI or to obligations to protect the information. For example,other <br /> whom the covered entities are obligated to protect PHI that they receive in <br /> disclosure was the same manner as North State Medical Transport. <br /> made <br /> 3. Whether the Determine whether the improperly disclosed PHI was returned <br /> PHI was actually before being accessed for an improper purpose. <br /> acquired or viewed <br /> 4. The extent to Consider whether immediate steps were taken to mitigate the <br /> which the risk to potential harm from the improper use or disclosure of the PHI. <br /> the PHI has been <br /> mitigated <br /> Step Five: Does a breach exception apply? The HIPAA Compliance Officer must also Yes NO <br /> determine whether one of the breach exceptions outlined in the Breach Notification Rule <br /> applies to the incident. if so,there is no reportable breach. The three breach exceptions North State North State Medical Transport must make breach notification <br /> are: Medical in accordance with North State Medical Transport's"Policy on <br /> Transport does Breaches of Unsecured Protected Health Information." <br /> • Unintentional Access,Acquisition or Use of PHI. The incident involved unintentional not have to <br /> access,acquisition or use of PHI by a workforce member of North State Medical make breach <br /> Transport or someone acting under the authority of North State Medical Transport. notification. <br /> The unintentional incident must:(1)be made in good faith;(2)made within the scope <br /> of employment;and(3)not result in further improper use or disclosure of PHI. <br /> • Inadvertent Disclosure to an Authorized Party. Inadvertent disclosure between parties <br /> at North State Medical Transport who are authorized to access PHI is not a breach if the <br /> PHI is not further used or disclosed in violation of HIPAA. "Authorized to access PHI" <br /> means that the two parties involved in the incident are authorized to access PHI in <br /> general-not necessarily that they are authorized to access the same type of PHI. <br /> • Disclosure Where Retention Was Not Possible. If the HIPAA Compliance Officer can <br /> demonstrate that an unauthorized recipient of the improperly disclosed PHI would not <br />