Orange County NC Website
Browse       Search
investigation to isolate the problem and take whatever action is necessary to protect <br /> the information system and e-PHI and other vital electronic information. <br /> 4. The HIPAA Compliance Officer will notify management immediately in the event the <br /> incident cannot be immediately corrected, or if any e-PHI or other vital information is <br /> altered or destroyed. Management will also be notified of any completed investigation <br /> and the outcome of the investigation. <br /> 5. In the event of unlawful activity via the use of North State Medical Transport's <br /> information system, local, state, or federal law enforcement may be notified. That <br /> determination will be made by management with recommendation from the HIPAA <br /> Compliance Officer. The HIPAA Compliance Officer is responsible for coordinating <br /> communications with outside organizations and law enforcement. <br /> 6. Whenever a security incident is suspected or confirmed to have occurred, remedial <br /> action will be taken, including action against any individual staff members when it has <br /> been confirmed that they caused or contributed to the incident. <br /> HIPAA Compliance Officer Responsibility <br /> The HIPAA Compliance Officer is responsible for the following: <br /> 1. Initiating the appropriate incident management action, including restoration. <br /> 2. Determining the physical and electronic evidence to be gathered as part of the incident <br /> investigation. <br /> 3. Monitoring that any damage from a security incident is repaired or mitigated and that <br /> the vulnerability is eliminated or minimized where possible. <br /> 4. Determining if a widespread communication is required,the content of the <br /> communication, and how best to distribute the communication. <br /> 5. Communicating new issues or vulnerabilities to the system vendor and working with the <br /> vendor to eliminate or mitigate the vulnerability. <br /> 6. Initiating, completing, and documenting the incident investigation. <br /> 7. Determining whether the incident may qualify as a breach of unsecured PHI requiring <br /> breach notification under North State Medical Transport's "Policy on Breaches of <br /> Unsecured Protected Health Information." <br />