Crafting A Breach Notification Policy

By Author: Jaun Paul
Total Articles: 53
Comment this article

February 22 is the enforcement deadline for the ARRA/HITECH breach notification regulations. As such, it's high time to train your eyes on creating a specific policy that covers what happens when and if you experience a breach of the information contained in personal health records.


Jim Scheldon-Dean, director of compliance services at Lewis Creek Systems says that you have to have some policies in place so you have an organized response in case of a breach or incident. He suggested you start with an incident handling policy and procedure which should cover:


Definition of what an incident is, designate an Incident Response Team (IRT)


Explain how the IRT will evaluate and prioritize the incident


IRT should investigate incidents thoroughly


Second, your breach notification policy needs to add definitions of the PHI that is covered by both HIPAA and applicable Breach notification rules and laws: ...
...


This should need some flow and risk analysis.
Your policy should also call for using approved encryption and data disposal methods.
Explain how you'll report and evaluate reportable breaches.
Lastly, even if the breach doesn't fit into one of those exceptions ask if it meets the significant risk of harm requirement. If so, provide notification.


The last thing that you need to incorporate in your policy is how you will provide notification for losses of information that rise to the level of a reportable breach.


This should cover the time limits you are subject to.
Delineate the content that will be included in your beach notice as well as a substitute or additional notices that may be required to be made to HHS.
Credit reporting agencies, law enforcement and business associates, and the media.
Finally, document how you evaluated the harm, made the decisions to report or not and what actions you took.

Provides weekly digest newswire about compliance procedures in healthcare industry, and offers advanced Learning Opportunities about health care breach notification for healthcare executives and physician billers according to 2010 Work Plan.