Cal. Code Regs. Tit. 22, § 79902 - Breach Reporting Requirements
(a) A health care facility, excluding a
business associate, shall report to the Department a breach of a patient's
medical information, or a breach reasonably believed to have occurred, no later
than 15 business days after the breach has been detected. Such breaches shall
be reported to the Department by the health care facility by electronic mail,
telephone, facsimile transmission, first-class mail, or through an internet
website maintained by the Department.
(1) In
its reporting of a breach, the health care facility shall provide the
Department, in writing and signed by a representative of the health care
facility, the following:
(A) Name and address
of the health care facility where the breach occurred;
(B) Date and time that each breach
occurred;
(C) Date and time that
each breach was detected;
(D) Name
of patient(s) affected;
(E)
Description of the medical information that was breached, including the nature
and extent of the medical information involved, including the types of
individually identifiable information (as defined in Civil Code section 56.05),
and the likelihood of re-identification;
(F) Description of the events surrounding the
breach;
(G) Name(s) and contact
information of the individual(s) who performed the breach, any witness(es) to
the breach, and any unauthorized person(s) who used the medical information or
to whom the disclosure was made, to the extent known;
(H) Date that patient or patient's
representative was notified, was attempted to be notified, or will be notified
of breach;
(I) The contact
information of a health care facility representative whom the Department may
contact for additional information;
(J) Description of any corrective or
mitigating action taken by the health care facility;
(K) Any other instances of a reported event
that includes a breach of that patient's medical information by the health care
facility in the previous six years.
(L) A copy of the notification sent to the
patient or patient's representative, pursuant to section
79902(b), and any
additional information provided to the patient or patient's representative
relating to the breach; and
(M) Any
audit reports, witness statements, or other documents that the health care
facility relied upon in determining that a breach occurred.
(2) A health care facility shall report any
additional information relevant to the breach, as it becomes available to the
health care facility, beyond the 15 business days.
(3) If a health care facility fails to report
a breach of a patient's medical information to the Department, the Department
may assess a penalty in the amount of $100 for each day that the breach is not
reported to the Department, not to exceed the limits set forth in Health and
Safety Code section 1280.15.
(4) A
breach shall not be deemed reported to the Department unless the health care
facility has provided, or made a good faith effort to provide, to the
Department the items required in section
79902(a)(1). Any
items required for reporting under section
79902(a)(1) not
available to the health care facility at the time of the reporting shall be
provided to the Department as they are available to the health care facility.
Any unreasonable delays in reporting by the health care facility pursuant to
this subdivision are subject to an administrative penalty assessed pursuant to
section 79902(a)(3). In
assessing whether delay is unreasonable, the Department will consider, among
other factors, the size of the affected population, lack of sufficient
information in the reporting of an incident to make a determination of
compliance, time passed between the time of an incident and its discovery,
whether the cause of an incident was a business associate or workforce member,
and availability of staff to respond to an incident.
(5) In the event a health care facility has
performed, pursuant to section
79901(b)(1)(F), a
risk assessment and has determined that an incident does not constitute a
breach of a patient's medical information, the health care facility shall
maintain a centralized record of each non-breach incident, along with all
materials the health care facility relied upon in performing the risk
assessment. All such centralized records shall be maintained by the health care
facility and available for inspection by the Department at all times. A health
care facility shall retain records relating to such a risk assessment for a
period of at least six years from the time of the incident.
(b) Except as provided in Health and Safety
Code section 1280.15(c), a health care facility shall report a breach of a
patient's medical information in writing by first-class mail to the patient or
the patient's representative at the last known address, or by electronic mail,
if the individual agrees and such agreement has not been withdrawn, pursuant to
Part 164.404(d) of Title 45 of the Code of Federal Regulations, no later than
15 business days after the breach has been detected by the health care
facility. The notification may be provided in one or more mailings as
information is available.
(1) In its
reporting of the breach, the health care facility shall provide the patient or
the patient's representative:
(A) A brief
description of what happened, including the health care facility name and
address, the date of the breach and the date of the discovery of the breach, if
known;
(B) A description of the
types of medical information that were involved in the breach (e.g., full name,
Social Security number, date of birth, home address, account number, diagnosis,
or other types of information);
(C)
Any steps the patient should take to protect himself or herself from potential
harm resulting from the breach;
(D)
A brief description of what the health care facility involved is doing to
investigate the breach, to mitigate harm to individuals, and to protect against
any further breaches; and
(E)
Contact procedures for individuals to ask questions or learn additional
information, which shall include a toll-free telephone number, an e-mail
address, internet website address, or postal address.
(2) The reporting required in subsection
(b)(1) shall be written in plain language.
(3) If a health care facility does not report
a breach of a patient's medical information to a patient or the patient's
representative, the Department may assess a penalty in the amount of $100 for
each day that the breach is not reported to the patient or the patient's
representative, not to exceed the limits set forth in Health and Safety Code
section 1280.15.
Notes
Note: Authority cited: Sections 131000, 131050, 131051, 131052 and 131200, Health and Safety Code. Reference: Section 1280.15, Health and Safety Code.
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.