Q&A: How would you construct a letter to inform patients about stolen PHI?
Compliance Monitor, June 24, 2009
Want to receive articles like this one in your inbox? Subscribe to Compliance Monitor!
Q: How would you construct a letter to inform patients about stolen Protected Health Information (PHI)?
A: Most states have enacted identity theft protection laws, and their provisions specify the information providers must include in this type of letter.
The breach notification provisions of the American Recovery and Reinvestment Act of 2009, Title XIII, Subpart D, also specify the information covered entities must include in a letter when a patient’s PHI is stolen. Knowing which state agency enforces breach notification laws in the state in which an organization operates is sound business practice. Most can provide a sample letter for use in notifying patients of such thefts. Sample letters are also likely to be available from HHS within the next few months.
Generally, the following information is required:
- What information was stolen or breached
- When the breach occurred or during what period of time
- The likely cause of the breach
- Information patients can use to protect their identities from being stolen (e.g., credit bureau contact information, advice about contacting law enforcement officials or the Federal Trade Commission, and information about requesting a credit freeze)
- A contact within the organization and that individual’s phone number in case patients have questions not answered by the letter
- Steps taken to mitigate damages
Want to receive articles like this one in your inbox? Subscribe to Compliance Monitor!
Related Products
-
Strategies for Health Care Compliance
News and real-life examples to increase the effectiveness of your compliance program. Strategies for Health Care Compliance...
-
Compliance Monitor
This HTML e-mail newsletter delivers news on Medicare and Medicaid fraud and abuse, as well as recent documents and targets...
-
The HIPAA and HITECH Toolkit
The HIPAA and HITECH Toolkit is a valuable resource that helps both CEs and BAs understand and meet the HITECH Act's...
-
HIPAA Training Handbook for Business Associates
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
-
HIPAA Handbook for Executive, Administrative and Corporate Staff
Train all of your staff members with this handbook and others in the 2009 HIPAA Handbook Series. Ensure they understand...
Most Popular
- Articles
-
- HIPAA Q&A: Flu shot requirement for hospital employees
- HealthDataInsights posts new issues for medical necessity claims
- Running an effective peer review committee meeting
- Q&A: Incidental disclosures and patient privacy
- Sneak Peek: Effort underway to establish caseload benchmarks
- New FAQ posted on storing laryngoscope blades
- Tip: Perform your own internal investigation prior to government audit
- What does case-mix index mean to you?
- HIPAA 5010 deadline extended, but threat remains, says AMA
- HHS task force: Consider privacy, security with text messages
- E-mailed
-
- Running an effective peer review committee meeting
- HIPAA Q&A: Flu shot requirement for hospital employees
- What does case-mix index mean to you?
- HHS task force: Consider privacy, security with text messages
- Featured blog post: Nurses face felony charges after reporting physician to the Texas Medical Board
- Tip: Correctly code bilateral pain management procedures
- 2012 CPT code changes for ASCs: Shoulder and knee scopes and pain management
- COT basics to best
- Documentation and coding for toxic metabolic encephalopathy
- Guidance and tact key to compliant, effective physician queries
- Searched