To safeguard patient health information, workers must know how to implement policies, procedures, and security audits.
HIPAA requires the workforce to be trained on policies and procedures. Staff must also receive formal training on breach notification.
About breach notification:
If a breach is discovered, you must You must notify HHS. Notification obligations differ based on whether the breach affects 500 or more individuals or fewer than 500 individuals. If the number of individuals is uncertain, you should estimate in your initial notification, and submit more accurate information as it becomes available.
Breaches Affecting 500 or More Individuals:
If a breach of unsecured protected health information affects 500 or more individuals, you must notify HHS no later than 60 calendar days from the discovery of the breach. Submit the notice electronically by filling out a form from the HHS website, and completing all of the required fields of the breach notification form (see below tools). You may report all breaches affecting fewer than 500 individuals on one date, but must complete a separate notice for each breach incident.
Tools and Resources for Step 7
You can learn more about breach notification on the website of the Office for Civil Rights.
The electronic form for breach notification must be accessed via the OCR website. It must be filled out and submitted electronically.