Hospitals and Health Systems

What arrives

The risk analysis
HIPAA Security Rule, 45 CFR 164.308(a)(1)(ii)(A). An accurate and thorough assessment of the risks and vulnerabilities to electronic protected health information.
Source
Breach notice
HIPAA Breach Notification Rule, 45 CFR 164.404. Notice to each affected individual without unreasonable delay, and no later than 60 calendar days after discovery.
Source
The HHS notice
45 CFR 164.408(b). For a breach involving 500 or more individuals, notice to the Secretary of HHS at the same time as notice to individuals.
Source
The media notice
45 CFR 164.406. For a breach involving more than 500 residents of a State or jurisdiction, notice to prominent media outlets serving it.
Source
The BAA
HIPAA business associate contract, 45 CFR 164.504(e), including the business associate's duty to report breaches of unsecured protected health information to the covered entity.
Source
A long hospital corridor seen through open double doors.

Request an Introduction